GStreamer, GStreamer Plugins: Multiple Vulnerabilities

Background GStreamer is an open source multimedia framework. Description Multiple vulnerabilities have been found in GStreamer and its plugins. Please review the CVE and GStreamer-SA identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Chromium, Google Chrome, Microsoft Edge, QtWebEngine: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

Apache HTTPD: Multiple Vulnerabilities

Background The Apache HTTP server is one of the most popular web servers on the Internet. Description Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Can add member and publish project to future community without community owner approval

Lines of code Vulnerability details Impact Anyone can add himself as a member of community for any future community. This can be done due to a combination of facts: Non initialized address storage values are defaulted to address0 addMember doesn't check if community is already created...

Mathematical impossibility in Modifier

Lines of code Vulnerability details Impact In the resolvable modifier, there is a mathematical check for disputeID disputeCount, and unless this is true, the modifier will revert. The default value of the variable disputeCount, which must be mathematically large, is 0 and its value is never...

libmcpp: Denial of service

Background libmcpp is a portable C/C++ preprocessor. Description A buffer overflow and an out-of-bounds read vulnerability have been discovered in libmcpp, which could be exploited for denial of service. Impact An attacker that can provide crafted input to libmcpp could achieve denial of service...

PT-2023-5883

Name of the Vulnerable Software and Affected Versions curl versions 7.82.0 through 8.4.0 libcurl versions 7.82.0 through 8.4.0 MySQL versions 5.7.43 and earlier, 8.0.34 and earlier, 8.1.0 and earlier Description curl and libcurl are vulnerable to a heap buffer overflow in the SOCKS5 proxy...

CVE-2021-42537 VISAM VBASE Editor Improper Restriction of XML

VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output...

Pretender - Your MitM Sidekick For Relaying Attacks Featuring DHCPv6 DNS Takeover As Well As mDNS, LLMNR And NetBIOS-NS Spoofing

Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing pretender is a tool developed by RedTeam Pentesting to obtain machine-in-the-middle positions via spoofed local name resolution and DHCPv6 DNS takeover attacks. pretender primarily...

Security Advisory 0079

Security Advisory 0079 . CSAF PDF Date: July 26th, 2022 Revision | Date | Changes ---|---|--- 1.0 | July 26th 2022 | Initial release CVE-2022-2907 The CVE-ID tracking this issue: CVE-2022-29071 CVSSv3.1 Base Score: 4.0 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Common Weakness Enumeration CWE: CWE-200...

GHSA-QWRJ-9HMP-GPXH FlyteAdmin Insufficient AccessToken Expiration Check

Impact Authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Using flyteadmin as the OAuth2 Authorization Server is unaffected by this issue. Patches 1.1.30 Workarounds Rotating signing keys immediately will: Invalidate all...

OPENSUSE-SU-2022:1157-1 Security update for libsolv, libzypp, zypper

This update for libsolv, libzypp, zypper fixes the following issues: Security relevant fix: - Harden package signature checks bsc1184501. libsolv update to 0.7.22: - reworked choice rule generation to cover more usecases - support SOLVABLEPREREQIGNOREINST in the ordering code bsc1196514 - support...

SUSE-SU-2022:1157-2 Security update for libsolv, libzypp, zypper

This update for libsolv, libzypp, zypper fixes the following issues: Security relevant fix: - Harden package signature checks bsc1184501. libsolv update to 0.7.22: - reworked choice rule generation to cover more usecases - support SOLVABLEPREREQIGNOREINST in the ordering code bsc1196514 - support...

Huawei EulerOS: Security Advisory for libarchive (EulerOS-SA-2022-2027)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the microprogrammed software of industrial switches SCALANCE W1788-1 M12, SCALANCE W1788-2 EEC M12, SCALANCE W1788-2 M12, SCALANCE W1788-2IA M12 allows a intruder to trigger a service failure.

The vulnerability of the microprogrammed software of industrial switches SCALANCE W1788-1 M12, SCALANCE W1788-2 EEC M12, SCALANCE W1788-2 M12, and SCALANCE W1788-2IA M12 is related to errors in processing ARP packets. Exploiting this vulnerability can allow a remote attacker to cause service...

2022-07 Cumulative Update for Windows 11 for x64-based Systems (KB5015814)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

Code injection in Apache Commons Configuration

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the...

Gallagher Controller 6000 安全漏洞

The Gallagher Controller 6000 is an interface between the Gallagher Command Center server and distributed field hardware from Gallagher New Zealand. A security vulnerability exists in the Gallagher Controller 6000 that originates from an attack via conflicting ARP packets with duplicate IP...

kernel security and bug fix update

4.18.0-372.13.1.0.16.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32...

The vulnerability of the microprogramming software for the SIMATIC CP 442-1 RNA and SIMATIC CP 443-1 RNA communication modules, related to uncontrolled resource consumption, allows attackers to execute an “ARP storm” attack and cause service failure.

The vulnerability of the microprogramming software for the SIMATIC CP 442-1 RNA and SIMATIC CP 443-1 RNA communication modules is related to an uncontrolled consumption of resources during the processing of ARP requests. Exploiting this vulnerability can allow attackers to execute an “ARP storm”...