Slackware: Security Advisory (SSA:2020-347-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

Important: java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: OpenJDK: Improper ECDSA signature verification Libraries, 8277233 CVE-2022-21449 OpenJDK: Defective secure validation in Apache Santuario Libraries, 82780...

Vulnerabilities fixed in Oracle Systems

Oracle has fixed vulnerabilities in the following products: Oracle Solaris Cluster Oracle ZFS Storage Appliance Kit Oracle StorageTek ACSLS Oracle StorageTek Tape Analytics STA Oracle Solaris Oracle Ethernet Switch ES1-24 Oracle Ethernet Switch TOR-72 The vulnerabilities allow a malicious party t...

SUSE: Security Advisory (SUSE-SU-2022:1160-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit for Code Injection in Vmware Spring_Framework

spring4shell ⭐ a python implementation of CVE-2022-22965 that...

Microsoft Azure 日志信息泄露漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. A log information disclosure vulnerability exists in the Microsoft Azure SDK. No information about this vulnerability is available at this time, please stay tuned to CNNVD or vendor...

CVE-2021-32994

Softing OPC UA C++ SDK Software Development Kit versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locatio...

CVE-2021-32994 Softing OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory Buffer

Softing OPC UA C++ SDK Software Development Kit versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locatio...

Accusoft ImageGear out-of-bounds write vulnerability (CNVD-2022-35419)

Accusoft ImageGear is a software development kit SDK for image processing from Accusoft, USA. Accusoft ImageGear suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to potentially cause memory corruption via a compiled file in the wrong format...

The vulnerability of the JNDI component in the OpenJDK application development kit allows a hacker to cause a service failure.

The vulnerability of the JNDI component in the OpenJDK application development kit is related to errors during resource release. Exploiting this vulnerability allows an attacker who operates remotely to cause service failures...

@afiether/gateware-kit (>=1.0.0 <=1.2.18), @afiether/kit (>=1.0.0 <=1.2.17) +42 more potentially affected by CVE-2022-24794 via express-openid-connect (>=0.5.0 <=2.20.2)

express-openid-connect NPM version =0.5.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.0.0, =1.1.6, =1.2.9 and more Source cves: CVE-2022-24794 Source advisory: OSV:GHSA-7P99-3798-F85C...

Chrome Zero-Day from North Korea

North Korean hackers have been exploiting a zero-day in Chrome. The flaw, tracked as CVE-2022-0609, was exploited by two separate North Korean hacking groups. Both groups deployed the same exploit kit on websites that either belonged to legitimate organizations and were hacked or were set up for...

SpringCore0day

Information https://spring.io/blog/2022/03/31/spring-framewor...

SUSE: Security Advisory (SUSE-SU-2022:1023-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

TEM FLEX-1080 和 TEM FLEX-1085 信息泄露漏洞

The TEM FLEX-1080 and TEM FLEX-1085 are both a home WiFi annunciator kit from TEM Brazil. A security vulnerability exists in TEM FLEX-1080 and FLEX-1085 1.6.0, which originates from information disclosure in log.cgi of the component Log Handler...

North Korean state-sponsored threat actor Lazarus Group exploiting Chrome Zero-day vulnerability

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here For more than a month before a fix was available, North Korean state hackers known as Lazarus group exploited a zero-day, remote code execution vulnerability CVE-2022-0609 in Google Chromes web browser. The attack mainly targe...

Google Chrome Zero-Day Bugs Exploited Weeks Ahead of Patch

North Korean threat actors exploited a remote code execution RCE zero-day vulnerability in Google’s Chrome web browser weeks before the bug was discovered and patched, according to researchers. Google Threat Analysis Group TAG discovered the flaw, tracked as CVE-2022-0609, on Feb. 10, reporting a...

North Korean Hackers Exploited Chrome Zero-Day to Target Fintech, IT, and Media Firms

Google's Threat Analysis Group TAG on Thursday disclosed that it acted to mitigate threats from two distinct government-backed attacker groups based in North Korea that exploited a recently-uncovered remote code execution flaw in the Chrome web browser. The campaigns, once again "reflective of th...

SUSE: Security Advisory (SUSE-SU-2022:0860-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...