PT-2022-27626 · Ip Com · Ip-Com M50

Name of the Vulnerable Software and Affected Versions: IP-COM M50 version 15.11.0.3310768 Description: A buffer overflow issue was discovered via the rules parameter in the formAddDnsForward function. This issue can be exploited, potentially leading to unintended consequences. Recommendations: Fo...

pfSense pfBlockerNG Host header command injection

Added: 12/23/2022 Background pfSense is an open-source network firewall based on the FreeBSD operating system. pfSense is the software which powers Netgate Security Gateway Appliances. pfBlockerNG is a pfSense package which allows creation of firewall rules on the appliance. Problem A vulnerabili...

PT-2022-27631 · Ip Com · Ip-Com M50

Name of the Vulnerable Software and Affected Versions: IP-COM M50 version 15.11.0.3310768 Description: A buffer overflow issue was discovered via the rules parameter in the formIPMacBindAdd function. This issue affects the specified version of the IP-COM M50 device. Recommendations: For IP-COM M5...

IBM Security Verify Governance Identity Manager Cross-Site Scripting Vulnerability

IBM Security Verify Governance Identity Manager is an IBM network appliance-based integration that focuses on business-centric rules, activities, and processes. version 10.0.1 of IBM Security Verify Governance Identity Manager is vulnerable to A cross-site scripting vulnerability exists. An...

IBM Security Verify Governance Identity Manager Information Disclosure Vulnerability

IBM Security Verify Governance Identity Manager is an IBM network appliance-based integration that focuses on business-centric rules, activities, and processes.IBM Security Verify Governance Identity Manager version 10.0.1 is vulnerable to An information disclosure vulnerability exists in IBM...

IP-COM M50 安全漏洞

The IP-COM M50 is a wireless router from IP-COM USA. A security vulnerability exists in IP-COM M50 version V15.11.0.3310768, which stems from the discovery of a contained buffer overflow vulnerability via the rules parameter in the formIPMacBindAdd function...

Stored XSS bypass the protection rules

Description Hi there, Someone submitted an xss vulnerability about your project before.And please see "https://huntr.dev/bounties/f353adfb-e5b8-43e7-957a-894670fd4ccd/" for details.You submitted a fix in 7.0.0.2 with commit 4565d8.But after my tests, I found that it was still unsafe. The followin...

Vulnerability Spotlight: Authentication bypass and enumeration vulnerabilities in Ghost CMS

Dave McDaniel and other members of Cisco Talos discovered these vulnerabilities. Cisco Talos recently discovered two vulnerabilities in Ghost CMS, one authentication bypass vulnerability and one enumeration vulnerability. Ghost is a content management system with tools to build a website, publish...

Microsoft Patch Tuesday for December 2022 — Snort rules and prominent vulnerabilities

Microsoft released its monthly security update on Tuesday, disclosing 48 vulnerabilities. Of these vulnerabilities, 6 are classified as "Critical", 41 are classified as "Important", with the remaining vulnerability classified as "Moderate." One of the critical vulnerabilities, which Microsoft...

Cross-site Scripting (XSS)

yiisoft/yii2-gii is vulnerable to cross-site scripting. The vulnerability exists in the rules function of Generator.php due to a lack of proper validation rules for enableI18N and messageCategory which allows an attacker to inject and execute malicious JavaScript...

CVE-2022-45934

An integer overflow flaw was found in the Linux kernel’s L2CAP bluetooth functionality in how a user generates malicious L2CAPCONFREQ packets. This flaw allows a local or bluetooth connection user to crash the system. Mitigation To mitigate these vulnerabilities on the operating system level,...

CLSA-2022-1670518357 Fix CVE(s): CVE-2021-20224

SECURITY UPDATE: Integer overflow - debian/patches/CVE-2021-20224.patch: fix outside the range of representable values of type 'unsigned char' - CVE-2021-20224 Fix internal test system: - debian/patches/fix-validation-suite.patch: fix validate suite -...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (puppet-firewall) security update

An update for puppet-firewall is now available for Red Hat OpenStack Platform 16.1.9 Train for Red Hat Enterprise Linux RHEL 8.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Vulnerability Spotlight: Memory corruption vulnerability discovered in PowerISO

Piotr Bania of Cisco Talos discovered this vulnerability. Cisco Talos recently discovered a memory corruption vulnerability in PowerISO. TALOS-2022-1644 CVE-2022-41992 is a memory corruption vulnerability that exists in the VHD File Format parsing functionality of PowerISO 8.3. A specially crafte...

Rocky Linux 8 : redis:6 (RLSA-2022:7541)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7541 advisory. - Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior ...

Vulnerability Spotlight: NVIDIA driver memory corruption vulnerabilities discovered

Piotr Bania of Cisco Talos discovered these vulnerabilities. Cisco Talos recently discovered two memory corruption vulnerabilities in shader functionality of an NVIDIA driver. NVIDIA Graphics drivers are software for NVIDIA Graphics GPU installed on the PC. They are used to communicate between th...

CVE-2022-43706

Cross-site scripting XSS vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users...

CVE-2022-3564

A use-after-free flaw was found in the Linux kernel’s L2CAP bluetooth functionality in how a user triggers a race condition by two malicious flows in the L2CAP bluetooth packets. This flaw allows a local or bluetooth connection user to crash the system or potentially escalate privileges. Mitigati...

CVE-2022-43706

Cross-site scripting XSS vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users...

CVE-2022-43706

Cross-site scripting XSS vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users...