CVE-2022-35234

Trend Micro Security 2021 and 2022 Consumer is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine...

How to Combat the Biggest Security Risks Posed by Machine Identities

The rise of DevOps culture in enterprises has accelerated product delivery timelines. Automation undoubtedly has its advantages. However, containerization and the rise of cloud software development are exposing organizations to a sprawling new attack surface. Machine identities vastly outnumber...

CLSA-2022-1659018147 Fixed CVE-2021-22543 in kernel

KVM: do not allow mapping valid but non-reference-counted pages CVE-2021-22543...

Zulip security vulnerabilities

Zulip is a powerful open source group chat application from the Zulip team. It is used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. A security vulnerability exists in versions prior to Zulip 1.3.12, which stems from the fact that other users...

Malicious code in db-dolphin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f31c91df2858e430559be9af39930325d40063e82634ee7dff673a2d7fab5cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-31206

The Omron SYSMAC Nx product family PLCs NJ series, NY series, NX series, and PMAC series through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software which compiles IEC 61131-3 conformant POU code to native machine code for execution...

Design/Logic Flaw

The Omron SYSMAC Nx product family PLCs NJ series, NY series, NX series, and PMAC series through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software which compiles IEC 61131-3 conformant POU code to native machine code for execution...

Memory corruption

JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-by-block basis with a given memory...

CVE-2022-31206

CVE-2022-31206 affects Omron SYSMAC Nx product family PLCs (NJ/NY/NX/PMAC) prior to 2022-05-18. The issue is that the transferred PLC logic is not cryptographically authenticated, allowing an attacker to modify transmitted object code and execute arbitrary machine code on the PLC CPU module withi...

CVE-2022-31206

The Omron SYSMAC Nx product family PLCs NJ series, NY series, NX series, and PMAC series through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software which compiles IEC 61131-3 conformant POU code to native machine code for execution...

CVE-2022-29958

CVE-2022-29958 affects JTEKT TOYOPUC PLCs up to 2022-04-29, where control logic and projects can be downloaded via unauthenticated CMPLink/TCP without cryptographic authentication. The downloaded code is block-based and executed in the PLC runtime without memory protection, on CPU modules (e.g., ...

Demo: Your data has been encrypted! Stopping ransomware attacks with Malwarebytes EDR

It’s no secret that ransomware is one of the most pressing cyber threats of our day. What worse, ransomware gangs have increased their attacks on a range of vulnerable industries, with disruptions to business operations, million-dollar ransom demands, data exfiltration, and extortion. With...

Malicious code in totaralms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05c9db01a67113b6a65bda9e61a061e87b78052c4c25c020444d03f2f88d892c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Waston Machine Learning Acclerator is affected by an OpenSSL vulnerability

Summary There is a vulnerability in OpenSSL used by IBM Watson Machine Learning Accelerator. IBM Watson Machine Learning Accelerator havs addressed the applicable CVE, CVE-2020-1971. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products an...

CVE-2022-31206: Improper Verification of Cryptographic Signature

The Omron SYSMAC Nx product family PLCs NJ series, NY series, NX series, and PMAC series through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software which compiles IEC 61131-3 conformant POU code to native machine code for execution...

CVE-2022-29958: Insufficient Verification of Data Authenticity

JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-by-block basis with a given memory...

Security Bulletin: Multiple vulnerabilities in the IBM Java Runtime affect IBM Rational ClearCase ( CVE-2021-35578, CVE-2021-35603, CVE-2021-35550, CVE-2021-35561, CVE-2022-21299 )

Summary There are vulnerabilities in the IBM® Runtime Environment Java™ Versions 7 and 8, which is used by IBM Rational ClearCase. These issues were disclosed as part of the IBM Java SDK updates in October 2021 and January 2022. Vulnerability Details CVEID:CVE-2021-35578 DESCRIPTION: An unspecifi...

Malicious code in pod-publishing-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0009f40b84012f59aa5423c3fc367190efbd389b30b848fc85bd2ddcd5a63611 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview machine-mapper is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

MAL-2022-4444 Malicious code in machine-mapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c368602ddffcde3e255807da9c94c25aa86d5780ec4ccb89406d97735c70265f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...