Update now! Microsoft patches two zero-days

The Microsoft September 2022 Patch Tuesday includes fixes for two publicly disclosed zero-day vulnerabilities, one of which is known to be actively exploited. Five of the 60+ security vulnerabilities were rated as "Critical", and 57 as important. Two vulnerabilities qualify as zero-days, with one...

Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday

This months Patch Tuesday offers a little something for everyone, including security updates for a zero-day flaw in Microsoft Windows that is under active attack, and another Windows weakness experts say could be used to power a fast-spreading computer worm. Also, Apple has also quashed a pair of...

CVE-2022-34718

Windows TCP/IP Remote Code Execution Vulnerability...

Remote code execution

Windows TCP/IP Remote Code Execution Vulnerability...

CVE-2022-34718

CVE-2022-34718 is a Windows TCP/IP remote code execution vulnerability that can be exploited by sending a crafted IPv6 packet to a host with IPSec enabled. The issue affects the Windows TCP/IP stack and relies on a flaw in handling IPv6/IPsec traffic to achieve code execution, requiring no user i...

CVE-2022-34718 Windows TCP/IP Remote Code Execution Vulnerability

...

Windows TCP/IP Remote Code Execution Vulnerability

...

KLA19245 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, cause denial of service, obtain sensitive information, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A remote cod...

Baxter SIGMA Spectrum Infusion Pumps: Multiple Vulnerabilities (FIXED)

Rapid7, Inc. Rapid7 discovered vulnerabilities in two TCP/IP-enabled medical devices produced by Baxter Healthcare. The affected products are: SIGMA Spectrum Infusion Pump Firmware Version 8.00.01 SIGMA Wi-Fi Battery Firmware Versions 16, 17, 20 D29 Rapid7 initially reported these issues to Baxte...

Security Bulletin: Information Disclosure and Denial of Service Vulnerabilities in the IBM Spectrum Protect Backup-Archive Client may affect IBM Spectrum Protect for Space Management (CVE-2022-22478, CVE-2022-22474)

Summary The IBM Spectrum Protect back-up archive client is vulnerable to information disclosure and denial of service vulnerabilities which may affect IBM Spectrum Protect for Space Management. Vulnerability Details CVEID:CVE-2022-22478 DESCRIPTION: IBM Spectrum Protect Client 8.1.0.0 through...

SUSE-SU-2022:2806-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Fixed various vulnerabilities in the embedded TCP/IP stack bsc1179908: - CVE-2020-13987: Fixed an out of bounds memory access when calculating the checksums for IP packets. - CVE-2020-13988: Fixed an integer overflow when parsing TCP MSS...

VMware ESXi TCP/IP Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware ESXi. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TCP/IP kernel module. The issue results from the lack of proper validation of...

CVE-2022-30276

The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. They feature IP Gateway modules which allow for interfacing between Motorola Data Link Communication MDLC networks potentially over a variety of serial, RF and/or Ethernet links and TCP/IP networks...

CVE-2022-30276

The CVE-2022-30276 issue affects Motorola MOSCAD IP Gateway and ACE IP Gateway (MDLC lines) through 2022-05-02. The root cause is the IPGW protocol (port 5001/TCP) lacking authentication, enabling an adversary who can reach the port to invoke a range of engineering functions (e.g., RTU configurat...

CVE-2022-22474

IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP sockets. This can result in a denial of service for IBM Spectrum Protect client operations. IBM X-Force ID: 225348...

CVE-2022-22474

IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP sockets. This can result in a denial of service for IBM Spectrum Protect client operations. IBM X-Force ID: 225348...

Design/Logic Flaw

IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP sockets. This can result in a denial of service for IBM Spectrum Protect client operations. IBM X-Force ID: 225348...

CVE-2022-22474

Summary: CVE-2022-22474 affects IBM Spectrum Protect Client components dsmcad, dsmc, and dsmcsvc (IBM Spectrum Protect 8.1.0.0–8.1.14.0). The issue arises from how read operations on TCP/IP sockets are handled, which can lead to a denial-of-service condition for client operations. Affected versio...

CVE-2022-22474

IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP sockets. This can result in a denial of service for IBM Spectrum Protect client operations. IBM X-Force ID: 225348...

Security Bulletin: Information Disclosure and Denial of Service Vulnerabilities in IBM Spectrum Protect Backup-Archive Client (CVE-2022-22478, CVE-2022-22474)

Summary The IBM Spectrum Protect back-up archive client is vulnerable to information disclosure as user credentials are stored in memory in plain text. The back-up archive client is also vulnerable to a denial of service due to certain read operations on TCP/IP sockets. Vulnerability Details...