The vulnerability of the remote connection function of the microprogramming software for Lenovo ThinkSystem storage servers, Lenovo ThinkStation workstations, and Lenovo ThinkEdge industrial computers, as well as the Lenovo ThinkAgile software/hardware system, allows attackers to increase their privileges.

The vulnerability of the Remote Presence subsystem of the microprogramming software for Lenovo ThinkSystem servers, Lenovo ThinkStation workstations, Lenovo ThinkEdge industrial computers, and the Lenovo ThinkAgile software/hardware system lies in the fact that the operation data is stored outsid...

The vulnerability of the Remote Presence subsystem of the microprogramming software used in Lenovo ThinkSystem servers, Lenovo ThinkStation workstations, and Lenovo ThinkEdge industrial computers. This vulnerability allows a attacker to cause a service failure.

The vulnerability of the Remote Presence subsystem of the microprogramming software for Lenovo ThinkSystem servers, Lenovo ThinkStation workstations, Lenovo ThinkEdge industrial computers, and the Lenovo ThinkAgile software/hardware system lies in the fact that the operation data is stored outsid...

Fedora: Security Advisory for golang-github-hashicorp-consul-migrate (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for grpcurl (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: grpcurl-1.8.6-3.fc35

Like cURL, but for gRPC: Command-line tool for interacting with gRPC servers...

[SECURITY] Fedora 35 Update: golang-k8s-kube-aggregator-1.22.0-4.fc35

Aggregator for Kubernetes-style API servers: dynamic registration, discovery summarization, secure proxy...

[SECURITY] Fedora 35 Update: golang-github-hashicorp-serf-0.9.5-5.fc35

Serf is a decentralized solution for service discovery and orchestration that is lightweight, highly available, and fault tolerant. Serf runs on Linux, Mac OS X, and Windows. An efficient and lightweight gossip protocol is used to communicate with other nodes. Serf can detect node failur es and...

[SECURITY] Fedora 35 Update: golang-github-hashicorp-consul-migrate-0.1.0-9.20190602git678fb10.fc35

Consul-migrate is a Go package and CLI utility to perform a very specific data migration for Consul servers nodes. Between Consul versions 0.5.0 and 0.5.1, the backend for storing Raft data was changed from LMDB to BoltDB. To support seamless upgrades, this library is embedded in Consul version...

Hackers Targeting VoIP Servers By Exploiting Digium Phone Software

VoIP phones using Digium's software have been targeted to drop a web shell on their servers as part of an attack campaign designed to exfiltrate data by downloading and executing additional payloads. "The malware installs multilayer obfuscated PHP backdoors to the web server's file system,...

GO-2022-0288 Unbounded memory growth in net/http and golang.org/x/net/http2

An attacker can cause unbounded memory growth in servers accepting HTTP/2 requests...

GO-2022-0191 Denial of service in chain verification in crypto/x509

The crypto/x509 package does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients verifying certificates are affected...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1813 (ALAS-2022-1813)

The version of kernel installed on the remote host is prior to 4.14.285-215.501. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1813 advisory. A kernel information leak flaw was identified in the scsiioctl function in drivers/scsi/scsiioctl.c in the Linux...

CVE-2022-32210

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via...

The vulnerability of the Metasys Application and Data Server (ADS), Metasys Extended Application and Data Server (ADX), and Metasys Open Application Server (OAS) lies in the insecure management of privileges, allowing attackers to elevate their privileges to the level of administrators.

The vulnerabilities of the Metasys Application and Data Server ADS, Metasys Extended Application and Data Server ADX, and Metasys Open Application Server OAS are related to insecure management of privileges. Exploiting these vulnerabilities can allow a malicious actor to elevate their privileges ...

Targeted attack on Government Agencies

Targeted Attack on Government Agencies By Sushant Kumar Arya, Mohsin Dalla · July 13, 2022 Executive summary The Trellix Email Security Research Team has discovered a malicious campaign targeting government agencies of Afghanistan, India, Italy, Poland, and the United States since 2021. The attac...

July 12, 2022—KB5015874 (Monthly Rollup)

None None...

Microsoft Windows 缓冲区错误漏洞

Microsoft Windows is a suite of operating systems used by Microsoft Corporation USA for personal devices. A buffer error vulnerability exists in the Microsoft Windows Client/Server Runtime Subsystem. The following products and editions are affected:Windows 10 Version 1809 for x64-based...

BSA-2022-1983

Security Advisory ID : BSA-2022-1983 Component : com.alibaba:fastjson Revision : 1.0: Final The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions...

Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. The vulnerable method is used to create a work directory for embedd...

KubeEdge 资源管理错误漏洞

KubeEdge is KubeEdge open source a Kubernetes native edge computing framework. Built on Kubernetes and extends native containerized application orchestration and device management to edge hosts. A security vulnerability exists in KubeEdge versions prior to 1.11.1, 1.10.2, and 1.9.4. The...