September 20, 2022-KB5017856 Cumulative Update Preview for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10, version 20H2

None None...

CVE-2022-40766

Modern Campus Omni CMS formerly OU Campus 10.2.4 allows login-page SQL injection via a '" OR 1 = 1 -- - , ?php' substring...

CVE-2022-3173

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...

GHSA-3F7H-MF4Q-VRM4 vulnerabilities

Vulnerabilities for packages: sonarqube-10...

PT-2022-34529 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.10 through v4.14.290 Description: The issue is related to a refcount leak in the bcm kona smc init function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versio...

PT-2022-34012 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.140 Description: The issue is related to the prohibition of usage of non-balanced queue id in the ice: xsk component. The actual impact and attack plausibility have not yet been proven. Recommendations: Fo...

PT-2022-34057 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.138 Description: A use-after-free issue was discovered, which may potentially lead to security vulnerabilities. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linu...

CVE-2022-36002

TensorFlow is an open source platform for machine learning. When Unbatch receives a nonscalar input id, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 4419d10d576adefa36b0e0a9425d2569f7c0189f. The fix will be included in TensorFlow...

GHSA-G468-QJ8G-VCJC TensorFlow vulnerable to `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs`

Impact When tensorflow::fulltype::SubstituteFromAttrs receives a FullTypeDef& t that is not exactly three args, it triggers a CHECK-fail instead of returning a status. cpp Status SubstituteForEachAttrMap& attrs, FullTypeDef& t DCHECKEQt.argssize, 3; const auto& cont = t.args0; const auto& tmpl =...

GHSA-M6CV-4FMF-66XF TensorFlow vulnerable to `CHECK` fail in `RaggedTensorToVariant`

Impact If RaggedTensorToVariant is given a rtnestedsplits list that contains tensors of ranks other than one, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf batchedinput = True rtnestedsplits = tf.constant0,32,64, shape=3,...

Huawei EMUI 资源管理错误漏洞

Huawei EMUI is an Android-based mobile operating system developed by Chinese company Huawei. A resource management error vulnerability exists in Huawei EMUI, which stems from a double release vulnerability in the memory module, successful exploitation of which will result in memory being released...

Microsoft Teams does not display video and shared screen

Microsoft Teams does not display video and shared screenwhen Endpoint OS is Windows 10 1607 Build 14393, Desktop Viewer is disabled showDesktopViewer=false, Teams optimization is enabled, and Viewing session in full screen mode...

PT-2022-23090

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1, 2.8.1, and 2.7.2 are also affected Description The issue occurs when TensorListFromTensor receives an element shape of a rank greater than one, resulting in a CHECK fail that can...

CVE-2022-3211

Cross-site Scripting XSS - Stored in GitHub repository pimcore/pimcore prior to 10.5.6...

HPESBHF04366 rev.3 - HPE Integrated Lights-Out 5 (iLO 5), or Integrated Lights-out 4 (iLO 4) Using OpenSSL, Remote Denial of Service

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers - Prior to v2.72 HPE Integrated Lights-Out 4 iLO 4 - Prior to v2.81 HP ConvergedSystem 700 - Varies, based on server...

CVE-2022-29492

Improper Input Validation vulnerability in the handling of a malformed IEC 104 TCP packet in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a...

CVE-2022-2277

Improper Input Validation vulnerability exists in the Hitachi Energy MicroSCADA X SYS600's ICCP stack during the ICCP communication establishment causes a denial-of-service when ICCP of SYS600 is request to forward any data item updates with timestamps too distant in the future to any remote ICCP...

CVE-2022-1778

Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-overflow that causes a failure to start the SYS600. The configuration file can only be accessed by an administrator access. This issue affects: Hitachi Energy...

GLPI 跨站脚本漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

CVE-2022-1602

A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 SP8. The security vulnerability in SP8 is not remedied after upgrading from SP8 to Service Pack 9 SP9. HP has released Service Pack 10 SP10 to remediate the potential vulnerability introduced in SP8...