395 matches found
Microsoft Patch Tuesday December 2022: SPNEGO RCE, Mark of the Web Bypass, Edge Memory Corruptions
Hello everyone! This episode will be about Microsoft Patch Tuesday for December 2022, including vulnerabilities that were added between November and December Patch Tuesdays. As usual, I use my open source Vulristics project to analyse and prioritize vulnerabilities. Alternative video link for...
Microsoft Reclassifies SPNEGO Extended Negotiation Security Vulnerability as 'Critical'
Microsoft has revised the severity of a security vulnerability it originally patched in September 2022, upgrading it to "Critical" after it emerged that it could be exploited to achieve remote code execution. Tracked as CVE-2022-37958 CVSS score: 8.1, the flaw was previously described as an...
Denial Of Service (DoS)
heimdal is vulnerable to denial of service. The vulnerability exists due to a NULL dereference in SPNEGO acceptors which allows an attacker to cause an application crash...
PT-2022-12224 · Heimdal +4 · Heimdal +4
Name of the Vulnerable Software and Affected Versions: Heimdal versions prior to 7.7.1 Description: The issue allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor. This can be achieved via a preferred mech type of GSS C NO OID and a nonzero initial response value to send...
Vulnerabilities fixed in Heimdal
Vulnerabilities have been fixed in Heimdal, an implementation of ASN.1/DER, PFIX and Kerberos. The vulnerabilities allow a remote malicious party to potentially execute arbitrary code execute in Heimdal's Key Distribution Center KDC, obtain secret keys obtain secret keys when using 1DES, 3DES, or...
FreeBSD -- Multiple vulnerabilities in Heimdal
Problem Description: Multiple security vulnerabilities have been discovered in the Heimdal implementation of the Kerberos 5 network authentication protocols and KDC. CVE-2022-42898 PAC parse integer overflows CVE-2022-3437 Overflows and non-constant time leaks in DES,3 and arcfour CVE-2021-44758...
CVE-2022-3116
The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance. An attacker with network access to an application that depends on the vulnerable code path can cause the application to crash...
Microsoft Windows Multiple Vulnerabilities (KB5017327)
This host is missing an important security update according to Microsoft KB5017327 SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
CVE-2022-37958
SPNEGO Extended Negotiation NEGOEX Security Mechanism Remote Code Execution Vulnerability...
CVE-2022-37958
SPNEGO Extended Negotiation NEGOEX Security Mechanism Remote Code Execution Vulnerability...
CVE-2022-37958
SPNEGO Extended Negotiation NEGOEX Security Mechanism Remote Code Execution Vulnerability...
Remote code execution
SPNEGO Extended Negotiation NEGOEX Security Mechanism Remote Code Execution Vulnerability...
CVE-2022-37958
CVE-2022-37958 is a SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution vulnerability. The connected materials confirm a network-exposed RCE path via SPNEGO negotiation in affected systems, with public reporting of an upgrade from High to Critical severity by Microsoft a...
CVE-2022-37958 SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
...
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
...
PT-2022-5749 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to the SPNEGO Extended Negotiation NEGOEX security mechanism in Microsoft Windows, which can lead to information disclosure. It allows remote attackers to...
KLA19245 Multiple vulnerabilities in Microsoft Windows
Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, cause denial of service, obtain sensitive information, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A remote cod...
Improper Privilege Management in Apache Hadoop
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification...
RHEL 6 : bind (RHSA-2021:0672)
"The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0672 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVEL...
