PT-2022-6318 · Zyxel · Zywall/Usg +3

Name of the Vulnerable Software and Affected Versions: Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72 Zyxel VPN series firmware versions 4.30 through 5.32 Zyxel USG FLEX series firmware versions 4.50 through 5.32 Zyxel ATP series firmware versions 4.32 through 5.32 Description: The...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

GLSA-202208-32 : Vim, gVim: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202208-32 Vim, gVim: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Vim and gVim. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

Security Bulletin: Vulnerability in Apache Commons in IBM WebSphere Application Server affects Intelligent Operations Center and related products (CVE-2015-7450)

Summary Remote execution vulnerability in Apache Commons Collections affects Intelligent Operations Center components WebSphere Application Server WAS or WAS Hypervisor Edition. Vulnerability Details CVE ID :CVE-2015-7450 Description: Apache Commons Collections could allow a remote attacker to...

FLIX AX8 1.46.16 Remote Command Execution

-- coding: utf-8 -- Exploit Title: FLIR AX8 Unauthenticated OS Command Injection Date: 8/19/2022 Exploit Author: Samy Younsi Naqwada https://samy.link Vendor Homepage: https://www.flir.com/ Software Link: https://www.flir.com/products/ax8-automation/ PoC: https://www.youtube.com/watch?v=dh0rfAIWo...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2022-2250)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Buffer Over-read in function grabfilename in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software,...

CVE-2022-38362

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host...

The vulnerability of Microsoft Office package applications and Microsoft 365 Apps for Enterprise arises due to insufficient validation of input data, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft Office package applications and Microsoft 365 Apps for Enterprise exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Hewlett Packard Enterprise Integrated Lights-Out 5 安全漏洞

Hewlett Packard Enterprise Integrated Lights-Out 5 iLO 5 is a remote control solution from Hewlett Packard Enterprise. The solution enables remote monitoring and operation of IT assets such as servers. A security vulnerability exists in Hewlett Packard Enterprise Integrated Lights-Out 5 iLO 5...

PT-2022-5984 · Centreon · Centreon

Name of the Vulnerable Software and Affected Versions: Centreon affected versions not specified Description: The issue is related to the lack of protection for the SQL query structure in Centreon, a software for monitoring IT infrastructure. This could allow a remote attacker to execute arbitrary...

CVE-2022-20841

CVE-2022-20841 affects Cisco Small Business RV160/RV260/RV340/RV345 Series Routers. The vulnerability arises from insufficient validation in the Open Plug and Play (PnP) module, enabling an unauthenticated, remote attacker to inject and execute arbitrary commands on the underlying OS, potentially...

The vulnerability of the Jenkins Maven Metadata Plugin, which exists due to the lack of protective measures for website structure, allows attackers to execute XSS attacks.

The vulnerability of the Jenkins Maven Metadata Plugin exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2022-33636

Microsoft Edge Chromium-based Remote Code Execution Vulnerability...

Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

...

Siemens Teamcenter

1. EXECUTIVE SUMMARY CVSS v3 7.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Teamcenter Vulnerabilities: Command Injection, Infinite Loop 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead to command injection and denial-of-service...

The vulnerability of the database update function in the web-filtering microprogramming software for Cisco Small Business RV160, RV260, RV340, and RV345 lies in errors during the processing of input data, allowing an attacker to execute arbitrary code with root privileges.

The vulnerability of the database update function in Cisco Small Business RV160, RV260, RV340, and RV345 router microprogramming systems lies in errors in processing input data. Exploiting this vulnerability allows an attacker to execute arbitrary code with root privileges remotely...

CVE-2022-27864

CVE-2022-27864 concerns Autodesk Design Review (DesignReview.exe). The issue is a Double Free vulnerability that allows remote code execution through PDFs opened in affected installations. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. Mul...

[ASA-202207-3] webkit2gtk: multiple issues

Arch Linux Security Advisory ASA-202207-3 ========================================= Severity: Critical Date : 2022-07-29 CVE-ID : CVE-2022-32792 CVE-2022-32816 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2790 Summary ======= The package...

EulerOS 2.0 SP10 : busybox (EulerOS-SA-2022-2126)

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible...