CVE-2022-34295

totd before 1.5.3 does not properly randomize mesg IDs...

Code injection

totd before 1.5.3 does not properly randomize mesg IDs...

CVE-2022-34295

totd before 1.5.3 does not properly randomize mesg IDs...

CVE-2022-34295

CVE-2022-34295 affects totd, a DNS proxy nameserver by F.W. Dillema. The flaw stems from improper randomization of message IDs in versions prior to 1.5.3. The impact is exposure of how messages are matched/handled due to weak ID randomness, with the CVSS metrics indicating moderate severity (CVSS...

PT-2022-22111

Name of the Vulnerable Software and Affected Versions totd versions prior to 1.5.3 Description The issue is related to the improper randomization of mesg IDs. Recommendations For versions prior to 1.5.3, update to version 1.5.3 or later to resolve the issue...

CVE-2022-34295: Use of Insufficiently Random Values

totd before 1.5.3 does not properly randomize mesg IDs...

Security Bulletin: IBM Robotic Process Automation is vulnerable to cross tenant disclosure of user ids (CVE-2022-30607)

Summary IBM Robotic Process Automation is vulnerable to cross tenant disclosure of user ids CVE-2022-30607 Vulnerability Details CVEID: CVE-2022-30607 DESCRIPTION: IBM Robotic Process Automation contains a vulnerability that could allow a user to obtain sensitive information due to information...

Lógico y Creativo SQL Injection Vulnerability

Lógico y Creativo is an e-commerce service from Lógico y Creativo Argentina. version 1.0 of Lógico y Creativo is vulnerable to SQL injection, which can be exploited by attackers to manipulate parameter ids to cause sql injection problems...

CVE-2022-32565

An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids...

CVE-2022-32565

An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids...

CVE-2022-33175

Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/getparam.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrator...

CVE-2022-33175

Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/getparam.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrator...

PT-2022-21377

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 7.0.4 Description An issue was discovered in the Backup Service log, which leaks unredacted usernames and document ids. Recommendations For versions prior to 7.0.4, update to version 7.0.4 or later to resolve...

CVE-2022-32565: Insertion of Sensitive Information into Log File

An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids...

PYSEC-2022-206

OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service. The vulnerability exists in the netItemStackToCore function in TypeConverter.php due to a lack of validation in item ids which allows an attacker to cause an application crash...

GHSA-FQX3-R75H-VC89 Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP

Impact Due to a workaround for unmapped network items implemented in 4.0.0-BETA5 8ac16345a3bc099b62c1f5cfbf3b736e621c3f76, arbitrary item IDs are able to be written into an item's NBT. The intended purpose of this is to make said unmapped network items able to be moved around the inventory withou...

CVE-2022-31279

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2022-28242

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to the version containing the patch 5fd685e07d61ef670584ed11a52fd5f4b99a81a7 Description The issue arises from a workaround implemented for unmapped network items, allowing arbitrary item IDs to be written into an...

Security Bulletin: NVIDIA DGX A100 Firmware - June 2022

NVIDIA has released a security update for NVIDIA DGX A100 firmware. This update addresses issues that may lead to information disclosure, denial of service, or escalation of privileges. To protect your system, download and install this firmware update through the NVIDIA Enterprise Support Portal...