CVE-2022-32210

CVE-2022-32210 concerns Undici’s ProxyAgent, which, per the connected document, does not verify the remote server’s TLS certificate and propagates all request/response data to the proxy. This can enable a proxy to perform a Man‑in‑the‑Middle on HTTPS traffic, and if the proxy URL is HTTP, nominal...

CVE-2022-32210

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via...

CVE-2022-32210

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via...

WS-2022-0205

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in erudika/para...

CVE-2022-32210: Improper Certificate Validation

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via...

Fedora: Security Advisory for caddy (FEDORA-2022-ba365d3703)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-34756

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used for the device Web HMI. Affected Products: Easergy P5 V01.401.102 and prior...

Design/Logic Flaw

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used for the device Web HMI. Affected Products: Easergy P5 V01.401.102 and prior...

CVE-2022-34756

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used for the device Web HMI. Affected Products: Easergy P5 V01.401.102 and prior...

CVE-2022-34756

The CVE-2022-34756 affects Schneider Electric Easergy P5 (v01.401.102 and prior) and is caused by a CWE-120 buffer copy without checking input size. This vulnerability can lead to remote code execution or a crash of the device’s HTTPs Web HMI stack. Documented impact is high with a CVSS base scor...

Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing is vulnerable to External Service Interaction (CVE-2021-39016)

Summary In IBM Engineering Lifecycle Optimization - Publishing, it is possible to induce the application to perform server-side HTTP and HTTPS requests to arbitrary domains. CVE-2021-39016. Vulnerability Details CVEID:CVE-2021-39016 DESCRIPTION: IBM Engineering Lifecycle Optimization - Publishing...

[SECURITY] Fedora 36 Update: caddy-2.4.6-3.fc36

Caddy is the web server with automatic HTTPS...

CVE-2022-34756: Buffer Copy without Checking Size of Input

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used for the device Web HMI. Affected Products: Easergy P5 V01.401.102 and prior...

Schneider Electric Easergy P5 安全漏洞

The Schneider Electric Easergy P5 is a protective relay for demanding medium voltage applications from Schneider Electric, France. A security vulnerability exists in Schneider Electric Easergy P5 V01.401.102 and prior versions, which stems from a buffer copy vulnerability that does not check the...

CVE-2022-29884

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C All versions CPC80 V16.30, CP-8000 MASTER MODULE WITH I/O -40/+70°C All versions CPC80 V16.30, CP-8021 MASTER MODULE All versions CPC80 V16.30, CP-8022 MASTER MODULE WITH GPRS All versions CPC80 V16.30. When using the...

Race condition

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C All versions CPC80 V16.30, CP-8000 MASTER MODULE WITH I/O -40/+70°C All versions CPC80 V16.30, CP-8021 MASTER MODULE All versions CPC80 V16.30, CP-8022 MASTER MODULE WITH GPRS All versions CPC80 V16.30. When using the...

CVE-2022-29884

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C All versions CPC80 V16.30, CP-8000 MASTER MODULE WITH I/O -40/+70°C All versions CPC80 V16.30, CP-8021 MASTER MODULE All versions CPC80 V16.30, CP-8022 MASTER MODULE WITH GPRS All versions CPC80 V16.30. When using the...

CVE-2022-29884: Missing Release of Resource after Effective Lifetime

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C All versions CPC80 V16.30, CP-8000 MASTER MODULE WITH I/O -40/+70°C All versions CPC80 V16.30, CP-8021 MASTER MODULE All versions CPC80 V16.30, CP-8022 MASTER MODULE WITH GPRS All versions CPC80 V16.30. When using the...

PT-2022-3623

Name of the Vulnerable Software and Affected Versions Easergy P5 versions V01.401.102 and prior Description A buffer copy without checking the size of input vulnerability exists, which could result in remote code execution or the crash of the HTTPS stack used for the device Web HMI. This issue ma...

PT-2022-19892

Name of the Vulnerable Software and Affected Versions CP-8000 MASTER MODULE WITH I/O -25/+70°C versions prior to CPC80 V16.30 CP-8000 MASTER MODULE WITH I/O -40/+70°C versions prior to CPC80 V16.30 CP-8021 MASTER MODULE versions prior to CPC80 V16.30 CP-8022 MASTER MODULE WITH GPRS versions prior...