SUSE CVE-2010-2954

The irdabind function in net/irda/afirda.c in the Linux kernel before 2.6.36-rc3-next-20100901 does not properly handle failure of the irdaopentsap function, which allows local users to cause a denial of service NULL pointer dereference and panic and possibly have unspecified other impact via...

SUSE CVE-2020-25660

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the...

CVE-2022-30613

IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366...

CVE-2022-35413

WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information such as SSL keys via an HTTPS request to the /webapi/ URI on port 443 or 5001...

CVE-2022-2330: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent...

CVE-2022-2031

A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other...

PT-2022-21835 · Unknown · Wi-Fi Service

Name of the Vulnerable Software and Affected Versions: Wi-Fi Service versions prior to SMR AUG-2022 Release 1 Description: The issue is related to improper access control in the Wi-Fi Service, allowing untrusted applications to manipulate the list of apps that can use mobile data. Recommendations...

CVE-2022-22445

An attacker that gains service access to the FSP POWER9 only or gains admin authority to a partition can compromise partition firmware...

CVE-2022-22445

An attacker that gains service access to the FSP POWER9 only or gains admin authority to a partition can compromise partition firmware...

CVE-2022-22445

An attacker that gains service access to the FSP POWER9 only or gains admin authority to a partition can compromise partition firmware...

Security Bulletin: An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware.

Summary PowerVM partition firmware is the portion that executes in each partition during boot. On POWER9 systems an attacker that gains service access to the FSP can compromise partition firmware for any partition configured on the system. On all affected systems an attacker that gains admin...

CVE-2022-22982: Server-Side Request Forgery (SSRF)

The vCenter Server contains a server-side request forgery SSRF vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service...

PT-2022-4132

Name of the Vulnerable Software and Affected Versions VMware vCenter Server affected versions not specified VMware Cloud Foundation affected versions not specified Description The issue is related to insufficient validation of incoming requests, allowing a remote attacker to perform a server-side...

Open Automation Software OAS Platform 访问控制错误漏洞

Open Automation Software OAS Platform is an industrial Internet of Things IoT suite from Open Automation Software, Inc. Open Automation Software OAS Platform V16.00.0121 is vulnerable to an access control error that could be exploited by an attacker to make unauthenticated use of the REST API wit...

PT-2022-6736 · Offis +5 · Offis Dcmtk +5

Name of the Vulnerable Software and Affected Versions: OFFIS DCMTK versions prior to 3.6.7 Description: The issue is related to a path traversal vulnerability in the service class provider SCP of OFFIS DCMTK, allowing an attacker to write DICOM files into arbitrary directories under controlled...

OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allow...

DEBIAN-CVE-2022-23302

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName...

CVE-2021-37196

A vulnerability has been identified in COMOS V10.2 All versions only if web components are used, COMOS V10.3 All versions = V10.3.3.3 only if web components are used, COMOS V10.4 All versions V10.4.1 only if web components are used. The COMOS Web component of COMOS unpacks specially crafted archi...

CVE-2021-38917: Undefined Security Weakness

IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and write arbitrary host system memory through a series of carefully crafted service procedures. IBM X-Force ID: 210018...

Security Bulletin: The PowerVM hypervisor can allow an attacker that gains service access to the FSP to read and write system memory

Summary On PowerVM systems an attacker that gains service access to the FSP can read and write system memory through a series of carefully crafted service procedures Vulnerability Details CVEID: CVE-2021-38917 DESCRIPTION: IBM PowerVM Hypervisor could allow an attacker that gains service access t...