CVE-2022-29910

When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox 100...

curl 安全漏洞

Curl is a tool used to transfer data from or to a server. There is a security vulnerability in curl that stems from an HSTS check being bypassed to trick it into continuing to use HTTP. an attacker exploiting this vulnerability could access the data on curl to read sensitive information...

GHSA-GXQ5-79M2-GVVQ Apache Bookkeeper vulnerable to Improper Certificate Validation

The Apache Bookkeeper Java Client before 4.14.6 and also 4.15.0 does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 a...

PYSEC-2022-43060

The Apache Bookkeeper Java Client before 4.14.6 and also 4.15.0 does not close the connection to the bookkeeper server when TLS hostname verification fails. This leavesthe bookkeeper client vulnerable to a man in the middle attack.The problem affects BookKeeper client prior to versions 4.14.6 and...

Security Bulletin: IBM Tivoli Netcool/OMNIbus Probe and Integrations Library are affected by vulnerabilities in FasterXML jackson-databind (CVE-2022-42004, CVE-2022-42003)

Summary FasterXML jackson-databind is used by IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library and Probe for Microsoft Exchange Web Services. The latest patches include FasterXML jackson-databind 2.13.4.2 that fixes the vulnerabilities. CVE-2022-42004, CVE-2022-42003...

Security Bulletin: IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is affected by vulnerability in Apache Kafka (CVE-2022-34917)

Summary Apache Kafka is used by IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library as part of the Kafka integration. The latest patch includes Apache Kafka 2.8.2 to fix the vulnerability. CVE-2022-34917 Vulnerability Details CVEID:CVE-2022-34917 DESCRIPTION: Apache Kafka is...

Denial Of Service (DoS)

asterisk is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in respjsippubsub.c, allowing an attacker to crash the application by performing activity on a subscription via a reliable transport at the same time that Asterisk is also performing activity on th...

CVE-2022-25912 Remote Code Execution (RCE)

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution RCE when enabling the ext transport protocol, which makes it exploitable via clone method. This vulnerability exists due to an incomplete fix of CVE-2022-24066...

CVE-2022-3259

Openshift 4.9 does not use HTTP Strict Transport Security HSTS which may allow man-in-the-middle MITM attacks...

PT-2022-21391 · Red Hat · Openshift

Name of the Vulnerable Software and Affected Versions: Openshift version 4.9 Description: The issue is related to the lack of HTTP Strict Transport Security HSTS in Openshift, which may allow man-in-the-middle MITM attacks. HSTS is a security feature that helps prevent MITM attacks by ensuring th...

CVE-2022-3259

Openshift 4.9 does not use HTTP Strict Transport Security HSTS which may allow man-in-the-middle MITM attacks...

curl: Unpreserved file permissions

A vulnerability was found in curl. This issue occurs because when curl saves cookies, alt-svc, and HSTS data to local files, it makes the operation atomic by finalizing the process with a rename from a temporary name to the final target file name. This flaw leads to unpreserved file permissions,...

curl: HSTS bypass via IDN

A vulnerability was found in curl. The issue occurs because curl's HSTS check can be bypassed to trick it to keep using HTTP. Using its HSTS support, it can instruct curl to use HTTPS directly instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This mechanism...

GSD-2022-1008230 ata: libata-transport: fix double ata_host_put() in ata_tport_add()

ata: libata-transport: fix double atahostput in atatportadd This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.267 by commit...

Remote Code Execution (RCE)

simple-git is vulnerable to remote code execution.The vulnerability exists in the clone function of git.js because of enabling the ext transport protocol which allows an attacker to inject and execute arbitrary codes into the system. This is an incomplete fix of CVE-2022-24066...

GSD-2022-1008151 ata: libata-transport: fix double ata_host_put() in ata_tport_add()

ata: libata-transport: fix double atahostput in atatportadd This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.225 by commit...

GSD-2022-1008049 ata: libata-transport: fix error handling in ata_tlink_add()

ata: libata-transport: fix error handling in atatlinkadd This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.156 by commit...

GSD-2022-1007913 ata: libata-transport: fix error handling in ata_tlink_add()

ata: libata-transport: fix error handling in atatlinkadd This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.80 by commit...

GSD-2022-1007748 ata: libata-transport: fix double ata_host_put() in ata_tport_add()

ata: libata-transport: fix double atahostput in atatportadd This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.10 by commit...

GSD-2022-1007746 ata: libata-transport: fix error handling in ata_tlink_add()

ata: libata-transport: fix error handling in atatlinkadd This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.10 by commit...