PT-2022-32105

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v4.0 through v4.19.246 Description The issue is related to memory leaks in EVT TRANSACTION handling in the st21nfca NFC driver. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-32301

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.318 Description The issue is related to memory leaks in EVT TRANSACTION handling in the st21nfca NFC driver. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kern...

PT-2022-31774

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.0 through 5.10.121 Description The issue concerns incorrect sizing calculations in EVT TRANSACTION, which may potentially lead to security vulnerabilities. The actual impact and attack plausibility have not yet been...

CVE-2022-0987: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists...

Espressif ESP-IDF Memory Corruption Vulnerability

Espressif ESP-IDF is an IoT development framework from China Lexin Information Technology Espressif.A memory corruption vulnerability exists in Espressif ESP-IDF, which stems from not checking the SegN field of the Transaction Start PDU, and can be exploited by an attacker during configuration to...

CVE-2022-24893

ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK "ESP-BLE-MESH", a memory corruption vulnerability can be triggered during provisioning, because there is no check for the "SegN" field of the Transaction Start PDU. This can result in memory...

CVE-2022-24893 Espressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruption

ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK ESP-BLE-MESH, a memory corruption vulnerability can be triggered during provisioning, because there is no check for the SegN field of the Transaction Start PDU. This can result in memory corruption...

CVE-2022-24893: Out-of-bounds Write

ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK ESP-BLE-MESH, a memory corruption vulnerability can be triggered during provisioning, because there is no check for the SegN field of the Transaction Start PDU. This can result in memory corruption...

CVE-2022-31767

IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980...

IBM CICS TX Standard and Advanced 操作系统命令注入漏洞

IBM CICS TX Standard and Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. IBM CICS TX Standard and Advanced is vulnerable to operating system command injection, which can be exploited by...

IBM Financial Transaction Manager for Digital Payments SQL注入漏洞

IBM Financial Transaction Manager for Digital Payments is a financial transaction manager from IBM Corporation in the United States. IBM Financial Transaction Manager for Digital Payments for Multi-Platform versions 3.2.0 through 3.2.9 are vulnerable to SQL injection, which can be exploited by...

Security Bulletin: June 2022 : Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed a CVE that could allow an unauthenticated attacker to cause a denial of service and two CVEs that could allow an...

Security Bulletin: A vulnerability (CVE-2022-21299) in IBM Java Runtime affects CICS Transaction Gateway

Summary IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 is used by CICS Transaction Gateway. The fix removes vulnerability CVE-2022-21299 that could allow an unauthenticated attacker to cause a denial of service. Vulnerability Details CVEID: CVE-2022-21299 DESCRIPTION: An unspecified...

Security Bulletin: A vulnerability (CVE-2021-35603) in IBM Java Runtime affects CICS Transaction Gateway

Summary IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 is used by CICS Transaction Gateway. The fix removes vulnerability CVE-2021-35603 that can allow an unauthenticated attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2021-35603 DESCRIPTION: An unspecified...

Security Bulletin: A vulnerability (CVE-2021-35561) in IBM Java Runtime affects CICS Transaction Gateway

Summary IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 is used by CICS Transaction Gateway. The fix removes vulnerability CVE-2021-35561 that can allow an unauthenticated attacker to cause a denial of service. Vulnerability Details CVEID:CVE-2021-35561 DESCRIPTION: An unspecified...

CVE-2022-31767

IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980...

Security Bulletin: A vulnerability (CVE-2021-35550) in IBM Java Runtime affects CICS Transaction Gateway

Summary IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 is used by CICS Transaction Gateway. The fix removes vulnerability CVE-2021-35550 that can allow an unauthenticated attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2021-35550 DESCRIPTION: An unspecified...

Security Bulletin: June 2022 :Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed seven CVEs that can allow denial of service and three CVEs that can allow no confidentiallty impact. Vulnerability Detail...

Malicious code in uphold-transaction-sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ea209da0e4959dfdb4352f36d013c60dac7d193cb8bb476c1baa9ff328f8088 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6811 Malicious code in uphold-transaction-sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ea209da0e4959dfdb4352f36d013c60dac7d193cb8bb476c1baa9ff328f8088 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...