CVE-2022-23678

A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access VIA client for Microsoft Windows...

CVE-2022-23678

The CVE-2022-23678 entry describes a vulnerability in the Aruba Virtual Intranet Access (VIA) client for Windows (versions 4.3.0 build 2208101 and below) where an attacker on a privileged network position could intercept sensitive information. Affected component: VIA Client for Windows; root caus...

PT-2022-16187 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system versions 4.3.0 build 2208101 and below Description: A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client...

CVE-2022-0336

The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as...

DEBIAN-CVE-2022-0336

The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as...

KLA19260 XSS vulnerability in Apache Tomcat

Cross-site scripting XSS vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to perform cross-site scripting attack. Original advisories Apache Tomcat 8.5.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2022-34305 high Solution Update to the late...

The vulnerability of the Illumina Local Run Manager software lies in the absence of an authentication process, which allows attackers to infiltrate, replicate, modify, and/or intercept confidential data.

The vulnerability of the Illumina Local Run Manager software lies in the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to remotely infiltrate, replicate, modify, and/or intercept sensitive data...

RedGuard - C2 Front Flow Control Tool, Can Avoid Blue Teams, AVs, EDRs Check

0x00 Introduction Tool introduction RedGuard is a derivative work of the C2 facility pre-flow control technology. It has a lighter design, efficient flow interaction, and reliable compatibility with go language development. The core problem it solves is also in the face of increasingly complex re...

CVE-2022-37001

The diag-router module has a vulnerability in intercepting excessive long and short instructions. Successful exploitation of this vulnerability will cause the diag-router module to crash...

CVE-2022-37001

The diag-router module has a vulnerability in intercepting excessive long and short instructions. Successful exploitation of this vulnerability will cause the diag-router module to crash...

Design/Logic Flaw

The diag-router module has a vulnerability in intercepting excessive long and short instructions. Successful exploitation of this vulnerability will cause the diag-router module to crash...

USN-5160-1: Midnight Commander vulnerability

It was discovered that Midnight Commander would not check server fingerprints when establishing an SFTP connection. If a remote attacker were able to intercept communications this flaw could be exploited to impersonate the SFTP server...

The vulnerability of the WS-UsernameToken authentication mechanism in Dahua cameras, related to the possibility of intercepting ONVIF requests. Exploiting this vulnerability could allow a malicious actor to gain full access to the IP camera.

The vulnerability of the WS-UsernameToken authentication mechanism in Dahua IP cameras lies in the ability to intercept ONVIF requests. Exploiting this vulnerability could allow a malicious actor to gain full access to the IP camera...

The vulnerability of the microprogrammed software of Modicon M241 and Modicon M251 control units lies in the insufficient protection of registration data, allowing attackers to intercept login credentials and access the web application.

The vulnerability of the microprogrammed logic controllers Modicon M241 and Modicon M251 is related to insufficient protection for registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to intercept login credentials and gain access to the web application...

KLA19262 XSS vulnerability in Apache Tomcat

Cross-site scripting XSS vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to perform cross-site scripting attack. Original advisories Apache Tomcat 10.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2022-34305 high Solution Update to the lates...

Design/Logic Flaw

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via...

The vulnerability of the OpenSSH cryptographic protection mechanism, related to bypassing permissions and access control, allows attackers to elevate their privileges within the system.

The vulnerability of the OpenSSH cryptographic protection lies in the fact that the application does not properly enforce security restrictions when the “LogVerbose” keyword is enabled along with certain parameters that trigger logging for the sshd process running with low privileges. Exploiting...

ALPINE-CVE-2022-32208

When curl 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client...

Galaxkey 跨站脚本漏洞

Galaxkey is an application from Galaxkey UK for viewing Galaxkey Secure Documents and composing and sending Galaxkey Secure Email. A security vulnerability exists in Galaxkey Secure Mail Client. An attacker could use this vulnerability to intercept HTTP Post requests when sending email and perfor...

CVE-2022-2102

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file...