EulerOS 2.0 SP8 : grilo (EulerOS-SA-2022-1567)

According to the versions of the grilo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - OpenSSL (CVE-2021-3601)

Summary Security Vulnerabilities affect IBM Cloud Private - OpenSSL Vulnerability Details CVEID: CVE-2021-3601 DESCRIPTION: OpenSSL could allow a remote authenticated attacker to bypass security restrictions, caused by the acceptance of a certificate with explicitly set Basic Constraints to...

Google Android Trust Management Issues Vulnerability (CNVD-2022-33102)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a trust management issue vulnerability that stems from a certificate validation error in A-GPS. A remote attacker can exploit this vulnerability to perform MitM attacks...

Important: Red Hat Security Advisory: Logging Subsystem 5.4 - Red Hat OpenShift Security and Bug update

Logging Subsystem 5.4 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the Reference...

CVE-2022-27048

A vulnerability has been discovered in Moxa MGate which allows an attacker to perform a man-in-the-middle MITM attack on the device. This affects MGate MB3170 Series Firmware Version 4.2 or lower. and MGate MB3270 Series Firmware Version 4.2 or lower. and MGate MB3280 Series Firmware Version 4.1 ...

CVE-2022-27048

A vulnerability has been discovered in Moxa MGate which allows an attacker to perform a man-in-the-middle MITM attack on the device. This affects MGate MB3170 Series Firmware Version 4.2 or lower. and MGate MB3270 Series Firmware Version 4.2 or lower. and MGate MB3280 Series Firmware Version 4.1 ...

Design/Logic Flaw

A vulnerability has been discovered in Moxa MGate which allows an attacker to perform a man-in-the-middle MITM attack on the device. This affects MGate MB3170 Series Firmware Version 4.2 or lower. and MGate MB3270 Series Firmware Version 4.2 or lower. and MGate MB3280 Series Firmware Version 4.1 ...

CVE-2022-27048

A vulnerability has been discovered in Moxa MGate which allows an attacker to perform a man-in-the-middle MITM attack on the device. This affects MGate MB3170 Series Firmware Version 4.2 or lower. and MGate MB3270 Series Firmware Version 4.2 or lower. and MGate MB3280 Series Firmware Version 4.1 ...

CVE-2022-27048

CVE-2022-27048 affects Moxa MGate protocol gateways (MB3170, MB3270, MB3280, MB3480) with firmware versions at or below 4.2/4.1/3.2 depending on model, where a MITM vulnerability is possible via network-facing components. The issue is described as enabling a man-in-the-middle attack on vulnerable...

Moxa MGate 安全漏洞

Moxa MGate is a series of Ethernet gateway products from Moxa China. A security vulnerability exists in the Moxa MGate that allows an attacker to perform a man-in-the-middle MITM attack on the device. This affects MGate MB3170 series firmware version 4.2 or lower. and MGate MB3270 series firmware...

Design/Logic Flaw

An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle MITM to send specifically crafted traffic to the firewall that causes the service to restart unexpectedly. Repeated attempts to...

CVE-2022-0023

The CVE-2022-0023 issue affects Palo Alto Networks PAN-OS DNS proxy. It is caused by improper handling of exceptional conditions, allowing a MITM to send crafted traffic that restarts the DNS proxy and can cause denial of service across PAN-OS services. Affected PAN-OS versions are: 8.1 before 8....

CVE-2022-0023 PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS Proxy

An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle MITM to send specifically crafted traffic to the firewall that causes the service to restart unexpectedly. Repeated attempts to...

PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS Proxy

An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle MITM to send specifically crafted traffic to the firewall that causes the service to restart unexpectedly. Repeated attempts to...

Palo Alto Networks PAN-OS 8.1.x < 8.1.22 / 9.0.x < 9.0.16 / 9.1.x < 9.1.13 / 10.0.x < 10.0.10 / 10.1.x < 10.1.5 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.22 or 9.0.x prior to 9.0.16 or 9.1.x prior to 9.1.13 or 10.0.x prior to 10.0.10 or 10.1.x prior to 10.1.5. It is, therefore, affected by a vulnerability. - An improper handling of exceptional conditions...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : nginx vulnerabilities (USN-5371-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5371-1 advisory. It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to perform an HTTP...

GitLab < 14.4.5, 14.5.x < 14.5.4, 14.6.x < 14.6.2 Certificate Valdidation Vulnerability

GitLab is prone to a certificate validation vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitlab:gitlab"; if...

Metasploit Wrap-Up

Windows Local Privilege Escalation for standard users In this week’s release, we have an exciting new module that has been added by our very own Grant Willcox which exploits CVE-2022-26904, and allows for normal users to execute code as NT AUTHORITY/SYSTEM on Windows machines from Windows 7 up to...

totolink EX300_v2 Command Injection Vulnerability (CNVD-2022-54662)

TotoLink EX300 is a 300 Mbps wireless N range extender from TotoLink China.TotoLink EX300v2 V4.0.3c.140B20210429 version has a command injection vulnerability, which can be exploited by attackers to remotely execute code as root via MitM attack...

TotoLink EX300_v2 Command Injection Vulnerability

TotoLink EX300 is a 300 Mbps wireless N range extender from TotoLink China.TotoLink EX300v2 V4.0.3c.140B20210429 is vulnerable to command injection, which can be exploited by unauthenticated attackers to remotely execute code as root via MitM attack...