CVE-2022-36130

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2...

Privilege escalation

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2...

CVE-2022-36130

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2...

CVE-2022-36130

CVE-2022-36130 concerns HashiCorp Boundary prior to 0.10.2. The issue is improper data integrity checks that allow privilege escalation for authorized users of another scope, by misallocating resources to scopes. A fixed version is Boundary 0.10.2. In practice, this means upgrading to 0.10.2 miti...

CVE-2022-36130

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2...

HashiCorp Boundary 数据伪造问题漏洞

HashiCorp Boundary is an open source solution from the US-based HashiCorp Inc. It automates secure identity-based user access to hosts and services across environments. A security vulnerability exists in HashiCorp Boundary versions prior to 0.10.1 that stems from not properly performing data...

The vulnerability of the qf_buf_add_line() function in the Vim text editor allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the qfbufaddline function in the Vim text editor is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the SX-Programmer Expert (D300win) programming tool, related to the execution of operations beyond the buffer boundaries, may affect data integrity.

The vulnerability of the SX-Programmer Expert D300win programming tool for programmable logic controllers is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

Debian DSA-5222-1 : dpdk - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5222 advisory. A buffer overflow was discovered in the vhost code of DPDK, a set of libraries for fast packet processing, which could result in denial of service or the executio...

The vulnerability of the SX-Programmer Expert (D300win) programming tool, which involves the use of memory after it is freed, allows a intruder to gain unauthorized access to protected information or compromise data integrity.

The vulnerability of the SX-Programmer Expert D300win programming tool relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information or compromise data integrity...

openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS

A flaw was found in OpenSSL's Online Certificate Status Protocol OCSP response functionality in the signer certificate verification routines. This flaw could result in a linked application falsely believing that an x.509 Digital Certificate is either "good" or "unknown" when revoked and requires...

PT-2022-4528 · Fuji Electric · Fuji Electric D300Win

Name of the Vulnerable Software and Affected Versions: Fuji Electric D300win versions prior to 3.7.1.17 Description: The issue is related to a buffer overflow operation. It may allow a remote attacker to impact data integrity by exploiting the vulnerability. The vulnerability could enable an...

The vulnerability of the Zabbix Frontend universal monitoring system arises from the lack of protective measures for the web page structure, allowing attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Zabbix Frontend universal monitoring system exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information through a specially...

CVE-2022-0336

The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as...

Security Bulletin: NVIDIA Data Plane Development Kit (MLNX_DPDK) - August 2022

NVIDIA has released a software update for MLNXDPDK to address a security issue that may lead to denial of service, and some impact to data integrity and confidentiality. To protect your system, contact your NVIDIA representative to obtain the MLNXDPDK version that contains the update and install...

The vulnerability of the get_next_valid_entry() function in the Vim text editor allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the getnextvalidentry function in the Vim text editor is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

...

wildfly-core allows user with access to management interface to access vault expression, retrieve item from vault

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly...

GHSA-CC99-WHM5-MMQ3 Openstack Keystone Incorrect Authorization vulnerability

A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is...

CVE-2021-35939

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threa...