4525 matches found
pesign 路径遍历漏洞
pesign is a tool for signing PE-COFF binaries, hoping to be at least vaguely compliant with the PE and Authenticode specifications. A security vulnerability exists in pesign. An attacker could exploit this vulnerability to access privileged files and directories via a path traversal attack...
Microsoft Urges Customers to Secure On-Premises Exchange Servers
Microsoft is urging customers to keep their Exchange servers updated as well as take steps to bolster the environment, such as enabling Windows Extended Protection and configuring certificate-based signing of PowerShell serialization payloads. "Attackers looking to exploit unpatched Exchange...
CVE-2022-47632
Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed a...
kernel security and bug fix update
3.10.0-1160.83.1.0.1.OL7 - debug: lock down kgdb Orabug: 34270798 CVE-2022-21499 3.10.0-1160.83.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 2481767...
grub2 security update
2.02-142.0.3.el87.1 - Fix CVE-2022-3775, CVE-2022-2601 Orabug: 34867710 - Bump SBAT metadata for grub to 3 Orabug: 34871758 - Enable signing on aarch64 - Don't try to switch to a BLS config if GRUBENABLEBLSCFG is already set Javier Martinez Canillas Orabug: 34375996 - Enable back btrfs module by...
CVE-2021-43444
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key...
CVE-2021-43445
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key...
CVE-2021-43444: Improper Authentication
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key...
CVE-2021-43444
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key...
CVE-2021-43444
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key...
PT-2023-12449 · Unknown · Onlyoffice
Name of the Vulnerable Software and Affected Versions: ONLYOFFICE all versions as of 2021-11-08 Description: The issue is related to Incorrect Access Control, allowing an attacker to authenticate with the web socket service of the ONLYOFFICE document editor. This service is protected by JWT auth,...
kernel security and bug fix update
4.18.0-425.10.1.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...
grub2 security update
2.06-46.0.4 - Bump SBAT metadata for grub to 3 Orabug: 34872719 2.06-46.0.3 - Fix CVE-2022-2601 and CVE-2022-3775 Orabug: 34871953 - Enable signing for aarch64 EFI...
Description of the security update for Microsoft Exchange Server 2016: January 10, 2023 (KB5022143)
None None...
Description of the security update for Microsoft Exchange Server 2019: January 10, 2023 (KB5022193)
None None...
CVE-2022-3927
The affected products store both public and private key that are used to sign and protect Custom Parameter Set CPS file from modification. An attacker that manages to exploit this vulnerability will be able to change the CPS file, sign it so that it is trusted as the legitimate CPS file. This iss...
CVE-2022-3927
CVE-2022-3927 concerns Hitachi Energy FOXMAN-UN and UNEM products. The issue arises from storing public and private keys used to sign and protect Custom Parameter Set (CPS) files, enabling an attacker to modify a CPS and sign it as legitimate. Affected products/versions: FOXMAN-UN R9C–R15B and UN...
Hitachi FOXMAN-UN 信任管理问题漏洞
Hitachi FOXMAN-UN is a powerful toolset for a comprehensive NMS suite from Hitachi, Japan. A security vulnerability exists in Hitachi FOXMAN-UN, which stems from the fact that it contains public and private keys used to sign and protect Custom Parameter Sets CPS files from modification, allowing ...
KubePi 信任管理问题漏洞
KubePi is a K8s panel. It allows administrators to import multiple Kubernetes clusters and assign permissions for different clusters, namespaces to specified users through permission control. KubePi 1.6.2 and prior versions have a trust management issue vulnerability that stems from its jwt...