Exploit for Code Injection in Vmware Spring_Framework

Spring-Core JDK9+ RCE 使用说明 ╰─ ./CVE-2022-22965 -h...

PT-2022-16447 · Unknown · Simple-Git

Name of the Vulnerable Software and Affected Versions: simple-git versions prior to 3.5.0 Description: The issue arises from an incomplete fix of a previous command injection vulnerability, which only addressed the git fetch attack vector. The --upload-pack feature of git, also supported for git...

Security Bulletin: IBM Security Access Manager for Enterprise Single Sign-On may be vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-4104)

Summary Vulnerability in Apache Log4j CVE-2021-4104 may affect IBM Security Access Manager for Enterprise Single Sign-On. Although no known vulnerability impact has been proven, it is strongly recommended to apply the fix that upgrades log4j from version 1.x to version 2.1.17. Vulnerability Detai...

SUSE: Security Advisory (SUSE-SU-2022:1025-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:1027-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update Java 8.0 to Service Refresh 7 Fix Pack 5 bsc1197126. Including fixes for the following vulnerabilities: CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277,...

SUSE-SU-2022:1026-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update Java 8.0 to Service Refresh 7 Fix Pack 5 bsc1197126. Including fixes for the following vulnerabilities: CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277,...

RSA Archer 安全漏洞

RSA Security RSA Archer is an enterprise IT governance and compliance management product from RSA Security, which includes policy, risk and compliance definition and management. It is capable of aggregating all of our enterprise assets, as well as some of the monitored information, and organizing...

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Overview git-clone is a Clone a git repository Affected versions of this package are vulnerable to Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' due to insecure usage of the --upload-pack feature of git. Note: A note was added to the README file of the package t...

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Overview git-pull-or-clone is an Ensure a git repo exists on disk and that it's up-to-date Affected versions of this package are vulnerable to Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' due to the use of the --upload-pack feature of git which is also supporte...

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' due to an incomplete fix of CVE-2022-24433 which only patches...

Security Bulletin: IBM Maximo Asset Management is vulnerable to weak password requirements (CVE-2021-38935)

Summary IBM Maximo Asset Management does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Vulnerability Details CVEID: CVE-2021-38935 DESCRIPTION: IBM Maximo Asset Management does not require that users should have...

Security Bulletin: Multiple untrusted search path vulnerabilities in the IBM® Db2® DAS component on Windows (CVE-2018-1458).

Summary Multiple untrusted search path vulnerabilities in the Db2 Administration Server DAS component of Db2 on Windows could allow a local user to execute arbitrary code. Vulnerability Details CVEID: CVE-2018-1458 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could...

Security Bulletin: Multiple vulnerabilities in IBM® Java™ may affect IBM ILOG CPLEX Optimization Studio (CVE-2022-21360, CVE-2022-21365)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7 & 8 used by IBM CPLEX Optimization Studio. IBM CPLEX Optimization Studio has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2022-21365 DESCRIPTION: An unspecified vulnerability in Java SE...

WavPack 缓冲区错误漏洞

WavPack is an open source, free audio lossless compression software. A buffer error vulnerability exists in WavPack 5.4.0, which stems from an out-of-bounds read in the function WavpackPackSamples in the file src/packutils.c. The contaminated variable cnt is too large, causing the pointer sptr to...

Schneider Electric EcoStruxure Control Experta 缓冲区错误漏洞

Schneider Electric EcoStruxure Control Expert formerly Unity Pro is a suite of programming software for Schneider Electric logic controller products from Schneider Electric, France. A security vulnerability exists in Schneider Electric EcoStruxure Control Expert V15.0 SP1 and earlier versions tha...

March 8, 2022—KB5011525 (Security-only update)

None None...

Security Bulletin: IBM Security Directory Integrator has upgraded log4j

Summary IBM Security Directory Integrator SDI has upgraded to log4j 2.17.1. Although SDI was technically not vulnerable to the issue described below because it did not use JMSAppender, as a matter of good software hygiene the product has upgraded to the current version of log4j. SDI uses log4j as...

Security Bulletin: IBM Rational Build Forge is affected by Apache HTTP Server version used in it. (CVE-2021-44790)

Summary IBM Rational Build Forge version 8.0 - 8.0.0.20 is affected by CVE-2021-44790 Vulnerability Details CVEID: CVE-2021-44790 DESCRIPTION: Apache HTTP Server is vulnerable to a buffer overflow, caused by improper bounds checking in the modlua multipart parser called from Lua scripts. By sendi...

PT-2022-10707 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.2 through 7.3.6 Liferay DXP 7.3 before fix pack 2 Description: A cross-site scripting XSS issue exists in the Blogs module's edit blog entry page, allowing remote attackers to inject arbitrary web script or HTML vi...

Security Bulletin: Apache HTTP Server as used by IBM QRadar SIEM is vulnerable to buffer overflow and denial of service (CVE-2021-44790, CVE-2021-34798, CVE-2021-39275)

Summary Apache HTTP Server as used by IBM QRadar SIEM contains multiple vulnerabilities which include buffer overflow and denial of service. Vulnerability Details CVEID: CVE-2021-44790 DESCRIPTION: Apache HTTP Server is vulnerable to a buffer overflow, caused by improper bounds checking in the...