kernel security and bug fix update

3.10.0-1160.83.1.0.1.OL7 - debug: lock down kgdb Orabug: 34270798 CVE-2022-21499 3.10.0-1160.83.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 2481767...

CVE-2021-43444

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key...

CVE-2021-43445

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key...

CVE-2021-43444: Improper Authentication

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key...

CVE-2021-43444

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key...

CVE-2021-43444

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key...

PT-2023-12449 · Unknown · Onlyoffice

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE all versions as of 2021-11-08 Description: The issue is related to Incorrect Access Control, allowing an attacker to authenticate with the web socket service of the ONLYOFFICE document editor. This service is protected by JWT auth,...

kernel security and bug fix update

4.18.0-425.10.1.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

grub2 security update

2.06-46.0.4 - Bump SBAT metadata for grub to 3 Orabug: 34872719 2.06-46.0.3 - Fix CVE-2022-2601 and CVE-2022-3775 Orabug: 34871953 - Enable signing for aarch64 EFI...

Description of the security update for Microsoft Exchange Server 2016: January 10, 2023 (KB5022143)

None None...

Description of the security update for Microsoft Exchange Server 2019: January 10, 2023 (KB5022193)

None None...

CVE-2022-3927

The affected products store both public and private key that are used to sign and protect Custom Parameter Set CPS file from modification. An attacker that manages to exploit this vulnerability will be able to change the CPS file, sign it so that it is trusted as the legitimate CPS file. This iss...

CVE-2022-3927

CVE-2022-3927 concerns Hitachi Energy FOXMAN-UN and UNEM products. The issue arises from storing public and private keys used to sign and protect Custom Parameter Set (CPS) files, enabling an attacker to modify a CPS and sign it as legitimate. Affected products/versions: FOXMAN-UN R9C–R15B and UN...

Hitachi FOXMAN-UN 信任管理问题漏洞

Hitachi FOXMAN-UN is a powerful toolset for a comprehensive NMS suite from Hitachi, Japan. A security vulnerability exists in Hitachi FOXMAN-UN, which stems from the fact that it contains public and private keys used to sign and protect Custom Parameter Sets CPS files from modification, allowing ...

KubePi 信任管理问题漏洞

KubePi is a K8s panel. It allows administrators to import multiple Kubernetes clusters and assign permissions for different clusters, namespaces to specified users through permission control. KubePi 1.6.2 and prior versions have a trust management issue vulnerability that stems from its jwt...

CVE-2022-30519

XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password field...

Code injection

XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password field...

PT-2022-20156 · Reprise · Reprise Software Rlm License Administration

Name of the Vulnerable Software and Affected Versions: Reprise Software RLM License Administration version 14.2BL4 Description: The issue allows a remote attacker to inject arbitrary code via the password field in the signing form, potentially leading to code execution. Recommendations: For Repri...

CVE-2022-30519: Improper Neutralization of Input During Web Page Generation

XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password field...

go-saml's XML Digital Signatures use SHA-1

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...