CVE-2022-41949 Semi-blind Server-Side Request Forgery in dhis2-core

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources like third party servers. This could allow...

Update now! NetGear routers’ default configuration allows remote attacks

NetGear has made a hotfix available for its Nighthawk routers after researchers found a network misconfiguration in the firmware allowed unrestricted communication with the internet facing ports of the device listening through IPv6. No auto-update The hotfix is available for the model RAX30, also...

CVE-2022-43553

A remote code execution vulnerability in EdgeRouters Version 2.0.9-hotfix.4 and earlier allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later...

CVE-2022-43553

A remote code execution vulnerability in EdgeRouters Version 2.0.9-hotfix.4 and earlier allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later...

PT-2022-26961 · Ubiquiti · Edgerouters

Name of the Vulnerable Software and Affected Versions: EdgeRouters versions 2.0.9-hotfix.4 and earlier Description: A remote code execution issue allows a malicious actor with an operator account to run arbitrary administrator commands. This issue is fixed in Version 2.0.9-hotfix.5 and later...

Vulnerabilities fixed in Sophos firewall

Sophos has fixed several vulnerabilities in Sophos firewall. A malicious party could exploit the vulnerabilities to obtain system data through API calls and Cross-Site-Scripting XSS attacks. In addition, arbitrary code can be executed if the malicious party has gained management rights or gained...

Virtuozzo Hybrid Infrastructure 5.3 Hotfix 1 (5.3.0-132)

This update provides important stability fixes. Vulnerability id: VSTOR-59696 Some compute alerts may not be raised. Vulnerability id: VSTOR-59714, VSTOR-60216 Stability fixes for the core storage...

Vulnerability fixed in F-Secure Policy Manager

A vulnerability has been fixed in F-Secure Policy Manager from WithSecure. The vulnerability allows an authenticated malicious person able to write files to the server on which the application is running on. This can have several possible types of impact have, such as denial of service or executi...

High Severity Vulnerabilities Reported in F5 BIG-IP and BIG-IQ Devices

Multiple security vulnerabilities have been disclosed in F5 BIG-IP and BIG-IQ devices that, if successfully exploited, to completely compromise affected systems. Cybersecurity firm Rapid7 said the flaws could be abused to remote access to the devices and defeat security constraints. The issues...

Update 19.13 for Microsoft Dynamics 365 Business Central (on-premises) 2021 Release Wave 2 (Application Build 19.13.48486, Platform Build 19.0.48446)

None None...

CVE-2022-41669

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3...

Citrix Hypervisor Security Bulletin for CVE-2022-42316, CVE-2022-42317 & CVE-2022-42318

Description of Problem Several security issues have been identified in Citrix Hypervisor 8.2 LTSR CU1, each of which may allow a privileged user in a guest VM to cause part of the management service to become unresponsive, resulting in the inability to create new guests or modify the configuratio...

Command injection

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands wa...

Siemens Siveillance Video Mobile Server

1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Siveillance Video 2022 R2 Vulnerability: Weak Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to access...

CVE-2022-43184

D-Link DIR878 1.30B08 Hotfix04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi...

PT-2022-5275 · D Link · D-Link Dir-878

Name of the Vulnerable Software and Affected Versions: D-Link DIR878 version 1.30B08 Hotfix 04 Description: The issue is related to a command injection vulnerability via the component /bin/proc.cgi. This vulnerability may allow a remote attacker to execute arbitrary code. The /bin/proc.cgi...

D-Link DIR-878 操作系统命令注入漏洞

The D-Link DIR-878 is a wireless router from China-based AUO D-Link. An operating system command injection vulnerability exists in the D-Link DIR-878 version 1.30B08 Hotfix 04, which originates from a command injection in the component /bin/proc.cgi...

PT-2022-6501 · Schneider Electric · Ecostruxure Operator Terminal Expert +1

Name of the Vulnerable Software and Affected Versions: EcoStruxure Operator Terminal Expert versions V3.3 Hotfix 1 or prior Pro-face BLUE versions V3.3 Hotfix 1 or prior Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as a path...

PT-2022-6502 · Schneider Electric · Ecostruxure Operator Terminal Expert +1

Name of the Vulnerable Software and Affected Versions: EcoStruxure Operator Terminal Expert versions prior to V3.3 Hotfix 1 Pro-face BLUE versions prior to V3.3 Hotfix 1 Description: The issue is related to incorrect project conversion, which can be exploited to execute malicious code. An adversa...

Zero-day vulnerability in Windows terminal management tool gets a hotfix

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Microsoft Endpoint Configuration Manager MECM has a spoofing vulnerability that allows remote attackers to access sensitive data. The zero-day vulnerability has been identified as CVE-2022-37972...