13211 matches found
CVE-2022-3275
Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise...
PT-2022-21443 · Puppet +1 · Puppetlabs-Apt +1
Name of the Vulnerable Software and Affected Versions: puppetlabs-apt versions prior to 9.0.0 Description: Command injection is possible in the puppetlabs-apt module. A malicious actor can exploit this issue if they can provide unsanitized input to the module. This condition is rare in most...
bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate unexpectedly
A flaw was found in the Bind package, where the resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query. By sending specific queries to the resolver, an attacker can cause named...
Horner Automation Cscape 缓冲区错误漏洞
Horner Automation Cscape is a suite of programming software for industrial control system development from Horner Automation. A buffer error vulnerability exists in Horner Automation Cscape 9.90 SP 7 and prior versions, which arises from failure to properly validate user-supplied data, and allows...
PT-2022-4954 · Omron · Cx-Programmer
Name of the Vulnerable Software and Affected Versions: Omron CX-Programmer versions 9.78 and prior Description: The issue is related to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. This is due to a buffer overflow vulnerability in the CX-P.exe executable file,...
bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate unexpectedly
A flaw was found in the Bind package, where the resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query. By sending specific queries to the resolver, an attacker can cause named...
Desdev DedeCMS 代码问题漏洞
Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing, content management, content editing and content retrieval functions. DedeCMS 5.7.98 version of the code...
Puppet 安全漏洞
Puppet is a client/server C/S architecture-based configuration management tool from Puppet Labs that can be used to manage configuration files, users, cron tasks, packages, system services, etc. A command injection vulnerability exists in versions of Puppet Puppetlabs-apt module prior to 9.0.0. T...
PT-2022-34606 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v4.8 through v5.19.8 Description: A use-after-free issue was discovered. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions v4.8 through v5.19.8, update to...
PT-2022-34618 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.9 Description: The issue is related to GEM handle release errors in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...
PT-2022-34615 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.9 Description: The issue is related to handling data vault when the value is ZERO SIZE PTR in the thermal/int340x thermal component. The actual impact and attack plausibility have not yet been proven...
PT-2022-34596 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.9 Description: The issue concerns the tcp TX zerocopy functionality in relation to the pfmemalloc status. It has been noted that this functionality should not sense the pfmemalloc status. The actual impact...
CVE-2022-20856
A vulnerability in the processing of Control and Provisioning of Wireless Access Points CAPWAP Mobility messages in Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected...
Pulse Secure Pulse Connect Secure 环境问题漏洞
Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. An environmental issue vulnerability exists in Pulse Secure Pulse Connect Secure version 9.115 and prior versions. An attacker could exploit this...
Discourse 安全漏洞
Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. versions of Discourse prior to 2.8.9, and prior to 2.9.0.beta10, contain an input validation error vulnerability that could be exploited by an attacker to add large text load...
PT-2022-24828 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions 2.9.0.beta5 through 2.9.0.beta9 Description: The issue arises when an incomplete quote generates a JavaScript error, potentially crashing the current page in the browser. This occurs in certain cases and is related to how t...
CVE-2022-20847
A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to the improper processing of DHCP messages. An...
PT-2022-6086 · Cisco · Cisco Ios Xe Wireless Controller +1
Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family affected versions not specified Description: A vulnerability in the processing of Control and Provisioning of Wireless Access Points CAPWAP Mobility messages could allow a...
