CVE-2022-23294

Technical details about CVE-2022-23294 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2022-23294 Windows Event Tracing Remote Code Execution Vulnerability

...

PT-2022-7508 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc6-next-20220307-nico+ 19 Description: The issue is related to the tracing/osnoise component of the Linux kernel, where an attempt to unregister an unregistered tracepoint results in a kernel warning. Th...

Windows Event Tracing Remote Code Execution Vulnerability

...

Microsoft Windows Event Tracing 代码注入漏洞

Microsoft Windows Event Tracing is an application from Microsoft Corporation USA. It provides a mechanism to track and log events raised by user-mode applications and kernel-mode drivers. A code injection vulnerability exists in Microsoft Windows Event Tracing. The following products and editions...

PT-2022-1982 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a buffer overflow in memory within the Windows Event Tracing service, allowing remote attackers to execute arbitrary code on the system. This can potentially enable ...

The vulnerability of the Windows Event Tracing service allows a perpetrator to execute arbitrary code.

The vulnerability of the Windows Event Tracing service in Microsoft Windows operating systems is related to improper handling of code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

USN-5299-1: Linux kernel vulnerabilities

Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation could reassemble mixed encrypted and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets or exfiltrate selected fragments. CVE-2020-26147 It was discovered that the bluetooth...

GSD-2022-1000244 tracing/histogram: Fix a potential memory leak for kstrdup()

tracing/histogram: Fix a potential memory leak for kstrdup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.19 by commit...

GSD-2022-1000149 tracing/histogram: Fix a potential memory leak for kstrdup()

tracing/histogram: Fix a potential memory leak for kstrdup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.176 by commit...

xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream...

Security Bulletin: Vulnerabilities in Apache Log4j affect IBM Spectrum Control (CVE-2021-45105, CVE-2021-45046)

Summary There are two vulnerabilities in Apache Log4j: denial of service CVE-2021-45105 and remote code execution CVE-2021-45046. These vulnerabilities may affect IBM Spectrum Control due to its use of Log4j for logging, tracing, alerting, and the local help documentation. The fix includes Apache...

The vulnerability of the Windows Event Tracing service, related to the discretionary list of access control (DACL) in the Windows operating system, allows a perpetrator to trigger a service failure.

The vulnerability of the Windows Event Tracing service related to the discretionary access control list DACL of the Windows operating system involves an uncontrolled consumption of resources. Exploiting this vulnerability could allow a perpetrator to cause a service failure...

The vulnerability of the Windows Event Tracing service allows a perpetrator to enhance their privileges within the system.

The vulnerability of the Windows Event Tracing service is related to insecure privilege management. Exploiting this vulnerability can allow an attacker to enhance their privileges within the system...

Moderate: Red Hat Security Advisory: Red Hat OpenShift distributed tracing 2.1.0 security update

An update is now available for Red Hat Openshift distributed tracing 2.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream...

xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream...

The vulnerability of the Covid-19 contact tracing system’s web app that uses QR code scanning lies in the insufficient protection of operational data, allowing attackers to carry out cross-site attacks.

The vulnerability of the Covid-19 contact tracing system’s web app with QR code scanning lies in the insufficient protection of sensitive data when the username parameter is used on the login page. Exploiting this vulnerability could allow a malicious actor to perform cross-site attacks using a...

Vulnerabilities that aren’t. Cross Site Tracing / XST

This is the first of my posts that explain why some common security vulnerabilities are most likely not real threats. They should be treated as security enhancements rather than vulnerabilities. Bearing in mind the number of scanning tools that rate such vulnerabilities as "high" its no wonder...

CVE-2022-22166

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause an rdp crash and thereby a Denial of Service DoS. If a BGP update message is received over an established BGP...