Cisco IP Phone Duplicate Key Vulnerability

A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager CUCM is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could resul...

Oracle Database Server Java VM Partial DoS

The vulnerability of the Java VM component of the Oracle Database Server management system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a partial service failure using the Oracle Net network protocol...

CVE-2022-20817: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager CUCM is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could resul...

Subscription-Manager cross-site scripting vulnerability

Subscription-Manager is a subscription management system by the individual developer of China's JiYouRan youranreus. A cross-site scripting vulnerability exists in Subscription-Manager v1.0, which stems from a lack of filtering and escaping of the machineDetail parameter in /main.js...

CVE-2022-27221

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown strin...

June 14, 2022—KB5014738 (Monthly Rollup)

June 14, 2022—KB5014738 Monthly Rollup Applies To Windows 8.1 Windows RT 8.1 Windows Server 2012 R2 Windows Embedded 8.1 Industry Enterprise Windows Embedded 8.1 Industry Pro Summary Learn more about this cumulative security update, including improvements, any known issues, and how to get the...

June 14, 2022—KB5014748 (Monthly Rollup)

June 14, 2022—KB5014748 Monthly Rollup Applies To Windows 7 Enterprise ESU Windows 7 Professional ESU Windows 7 Ultimate ESU Windows Server 2008 R2 Enterprise ESU Windows Server 2008 R2 Standard ESU Windows Server 2008 R2 Datacenter ESU Windows Embedded Standard 7 ESU Windows Embedded POSReady 7...

June 14, 2022—KB5014699 (OS Builds 19042.1766, 19043.1766, and 19044.1766)

June 14, 2022—KB5014699 OS Builds 19042.1766, 19043.1766, and 19044.1766 Applies To Windows Server, version 20H2, all editions Windows 10, version 21H1, all editions Windows 10, version 21H2, all editions Windows 10 Enterprise Multi-Session, version 20H2 Windows 10 Enterprise and Education, versi...

CVE-2022-27221: Observable Discrepancy

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown strin...

CVE-2022-32156: Improper Certificate Validation

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI...

Malicious code in linkbubble-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 422793632268d1179cb6c4c4393383391c01c422b27b5de1083e15fa33e0237d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in holvi-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5460a2a5a97e4820eee0a96ea4c76758e1b0cb8bd86d8c71dc5c8ae6dd29b600 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vso-workbench (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e83ff4e45823ca3ebdebc2d5dd79142cc80f0747161b2555e2593073956d4318 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ghost-in-the-machine (0.0.70), restful-starlette (>=0.0.1, <=0.0.4) +3 more potentially affected by CVE-2022-2054 via nuitka (>=0.6.10, <=0.6.19.7)

nuitka PYPI version =0.6.10, =0.0.1, =0.0.8, =7.15.0, =7.15.3 - teamscale-cli 7.1.0 Source cves: CVE-2022-2054 Source advisory: OSV:GHSA-4V3R-HQR9-69JF...

ghost-in-the-machine (0.0.70), restful-starlette (>=0.0.1, <=0.0.4) +3 more potentially affected by CVE-2022-2054 via nuitka (>=0.6.10, <=0.6.19.7)

nuitka PYPI version =0.6.10, =0.0.1, =0.0.8, =7.15.0, =7.15.3 - teamscale-cli 7.1.0 Source cves: CVE-2022-2054 Source advisory: GHSA-4V3R-HQR9-69JF...

ghost-in-the-machine (0.0.70), restful-starlette (>=0.0.1, <=0.0.4) +3 more potentially affected by CVE-2022-2054 via nuitka (>=0.6.10, <=0.6.19.7)

nuitka PYPI version =0.6.10, =0.0.1, =0.0.8, =7.15.0, =7.15.3 - teamscale-cli 7.1.0 Source cves: CVE-2022-2054 Source advisory: MEND:CVE-2022-2054...

PacketStreamer - Distributed Tcpdump For Cloud Native Environments

Deepfence PacketStreamer is a high-performance remote packet capture and collection tool. It is used by Deepfence's ThreatStryker security observability platform to gather network traffic on demand from cloud workloads for forensic analysis. Primary design goals: Stay light, capture and stream, n...

Amazon Linux AMI : git (ALAS-2022-1589)

The version of git installed on the remote host is prior to 2.36.1-1.75. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1589 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system...

PYSEC-2022-43053

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address including side effects could be evaluated twice. This may result in incorrect outcomes for contracts. This issue...

Xen security vulnerabilities

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in all...