CVE-2022-37958

SPNEGO Extended Negotiation NEGOEX Security Mechanism Remote Code Execution Vulnerability...

CVE-2022-37958 SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability

...

CVE-2022-37958

CVE-2022-37958 is a SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution vulnerability. The connected materials confirm a network-exposed RCE path via SPNEGO negotiation in affected systems, with public reporting of an upgrade from High to Critical severity by Microsoft a...

SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability

...

KLA19245 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, cause denial of service, obtain sensitive information, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A remote cod...

CVE-2022-35943

Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a...

Information Disclosure

go is vulnerable to information disclosure. The vulnerability exists in httputil.ReverseProxy.ServeHTTP with a Request.Header map containing nil value for the X-Forwarded-For header which allows to remote attacker to bypass security mechanism and access the sensitive information...

The vulnerability of HID Mercury programmable logic controllers’ microprogramming software, related to security mechanism errors, allows a intruder to remove the user from the system.

The vulnerability of HID Mercury programmable logic controllers’ microprogramming software is related to security mechanism errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to remove a user using a specially created network package...

GHSA-4PM3-F52J-8GGH Improper Input Validation in GeoServer

Impact The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota...

Deserialization of untrusted data

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can...

CVE-2022-24847 Improper Input Validation in GeoServer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can...

The vulnerability of Sumavision Enhanced Multimedia Router’s microprogramming software, related to security mechanism failures, allows attackers to create arbitrary users with elevated privileges.

The vulnerability of Sumavision Enhanced Multimedia Router’s microprogramming software is related to security mechanism errors. Exploiting this vulnerability allows a malicious actor to create arbitrary users with elevated privileges by using the command setString = newuser administrator 123456...

HTTP Strict Transport Security (HSTS) Bypass

webkit2gtk is vulnerable to HTTP Strict Transport Security bypass. The vulnerability exists due to a lack of authentication of the security mechanism allowing an attacker to bypass the security HSTS...

AD Starter Scan - Dangerous Trust Relationship

Binary data adsitrustunsafe.nbin...

Microsoft Edge’s browser vulnerability, related to security mechanism flaws, allows attackers to escalate their privileges.

The vulnerability of Microsoft Edge is related to security flaws in its mechanisms. Exploiting this vulnerability can allow a malicious actor to gain increased privileges...

PT-2021-3459 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue is related to security mechanism shortcomings in Microsoft Edge, allowing a remote attacker to potentially elevate their privileges. Recommendations: At the...

Reddit: Missing rate limit in current password change settings leads to Account takeover

Summary: Happy Wednesday, I've found a missing rate limit protection in https://reddit.com and https://vip.reddit.com in password change settings. Enter the current password security mechanism is implemented to prevent the the cyber attackers not to change the password without knowing the current...

The vulnerability of Huawei Mate 30 and Huawei Mate 30 Pro mobile phone microprogramming systems, related to security mechanism errors, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the microprogramming software in Huawei Mate 30 and Huawei Mate 30 Pro devices is related to security mechanism flaws. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Vulnerabilities of Cisco IOS XE operating systems, which allow attackers to compromise the confidentiality and integrity of protected information

The vulnerability of Cisco IOS XE operating systems is related to deficiencies in security mechanisms. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

SolarWinds TFTP Server 11.0.4.101 Remote Unauthenticated Reconfiguration Vulnerability

SolarWinds TFTP Server version 11.0.4.101 suffers from a remote unauthenticated reconfiguration vulnerability that could result in code execution. Older versions of SolarWinds' TFTP Server, which could have been installed from a standalone download or bundled with certain paid products, may have...