Moderate: Red Hat Security Advisory: convert2rhel security, bug fix, and enhancement update

An update for convert2rhel is now available for Convert2RHEL for RHEL-7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2022-2953

LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8...

Kirby 跨站脚本漏洞

Kirby is a file-based content management system CMS. A cross-site scripting vulnerability exists in Kirby versions prior to 3.5.8.1, which can be exploited by an attacker to inject HTML code into an option source, such as the content of a sibling page or an API endpoint...

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

...

CVE-2022-36537

creationtimestamp| type| source ---|---|--- 2022-08-27 00:30:26+00:00| seen| https://t.me/cibsecurity/48923 2022-11-01 12:31:11+00:00| seen| https://t.me/thehackernews/2720 2022-12-09 12:28:21+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/3580 2022-12-09 14:25:09+00:00|...

CVE-2022-38766

creationtimestamp| type| source ---|---|--- 2022-08-26 16:58:46+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/3048 2022-08-29 11:37:02+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6693 2022-09-27 07:30:24+00:00| published-proof-of-concept|...

CVE-2017-7501

creationtimestamp| type| source ---|---|--- 2022-08-26 00:24:10+00:00| seen| https://t.me/cibsecurity/48820 2022-08-26 20:30:35+00:00| seen| https://t.me/cibsecurity/48898...

CVE-2017-7500

creationtimestamp| type| source ---|---|--- 2022-08-26 00:24:10+00:00| seen| https://t.me/cibsecurity/48820 2022-08-26 20:30:35+00:00| seen| https://t.me/cibsecurity/48898...

CVE-2022-25647

creationtimestamp| type| source ---|---|--- 2022-08-25 11:55:31+00:00| seen| https://t.me/truesecator/3334 2023-09-22 12:07:23+00:00| seen| https://t.me/KomunitiSiber/831 2023-09-22 13:04:58+00:00| seen| Telegram/2IZN8BPcELSiNhB3yoxCrhOcfpa3u9fucjYYoYzOd3-XNg 2023-09-22 14:38:21+00:00| seen|...

Boundary Allowed Access To Host Sets And Credential Sources For Authorized Users Of Another Scope

Summary HashiCorp Boundary versions up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. This vulnerability, CVE-2022-36130, is fixed in Boundary...

CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to...

AZL-10637 CVE-2021-3521 affecting package rpm for versions less than 4.18.0-1

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to...

DEBIAN-CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to...

CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to...

CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to...

UBUNTU-CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to...

CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to...

PT-2022-4344 · Aveva · Aveva Edge

Name of the Vulnerable Software and Affected Versions: AVEVA Edge 2020 SP2 Patch 04201.2111.1802.0000 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious...

CVE-2022-36966

creationtimestamp| type| source ---|---|--- 2022-08-16 20:42:04+00:00| seen| https://t.me/cKure/10076 2022-10-21 00:29:54+00:00| seen| https://t.me/cibsecurity/51910 2022-10-21 06:06:26+00:00| seen| https://t.me/cKure/10334 2022-10-21 06:06:55+00:00| seen| https://t.me/ckuRED/205 2022-12-24...

Code injection

This library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript's eval function is used to execute strings that begin with "function" as Javascript. This unfortunately could allow arbitrary code to be executed if it exists as ...