[SECURITY] Fedora 36 Update: krb5-1.19.2-12.fc36

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...

Fedora: Security Advisory for krb5 (FEDORA-2022-78038a4441)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for krb5 (FEDORA-2022-88cefef88c)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for krb5 (FEDORA-2022-a1747aca80)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-35250

A privilege escalation vulnerability exists in Rocket.chat v5 which made it possible to elevate privileges for any authenticated user to view Direct messages without appropriate permissions...

CVE-2022-32226

An improper access control vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not type validated, so that MongoDB query operator objects are accepted by the server, so that instead of a matching rid String a$regex query can be...

Information disclosure

A information disclosure vulnerability exists in Rockert.Chat v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection...

CVE-2022-32229

A information disclosure vulnerability exists in Rockert.Chat v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection...

CVE-2022-28741

aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion LFI vulnerability that occurs due to missing input validation in v5.x...

CVE-2021-45027

An arbitrary file download vulnerability in Oliver v5 Library Server Versions 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input...

Input validation

An arbitrary file download vulnerability in Oliver v5 Library Server Versions 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input...

CVE-2021-45027

An arbitrary file download vulnerability in Oliver v5 Library Server Versions 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input...

CVE-2021-45027

Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function, allowing an unauthenticated attacker to read arbitrary files on Windows servers (e.g., win.ini) through unsanitized input in the fileName parameter. Affected lineage from CV...

PT-2022-12293 · Unknown · Oliver V5 Library Server

Name of the Vulnerable Software and Affected Versions: Oliver v5 Library Server versions prior to 5.00.008.053 Description: The issue allows for arbitrary file download by an attacker using unsanitized user-supplied input via the FileServlet function. Recommendations: For versions prior to...

PT-2022-11574

Name of the Vulnerable Software and Affected Versions TP-Link Archer A7 version Archer A7US V5 210519 Description The issue is caused by a command injection vulnerability in the /usr/bin/tddp program, which takes part of the received data packet as part of the command. This allows an attacker to...

CVE-2022-33087

CVE-2022-33087 describes a stack overflow in TP-Link Archer C50 and A5 (US) devices, triggered by a crafted HTTP request in the function variants named DM_Infillobjbystr()/DM_ Infillobjbystr(), leading to Denial of Service. Public references in NVD and vendor trackers confirm the vulnerability an...

Malicious code in myetherwallet-kb-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae04121a4bec3299bbbc3f8d81cac34db0035ffef4fd20cb6361f9e857b86aad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4762 Malicious code in myetherwallet-kb-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae04121a4bec3299bbbc3f8d81cac34db0035ffef4fd20cb6361f9e857b86aad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-41039

In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excessive CPU usage, leading to a loss of performance and possible denial of service...

Metasploit Weekly Wrap-Up

Mucking out the pipes. Thanks to some quick work by timwr, CVE-2022-0847 aka "Dirty Pipe" gives Metasploit a bit of digital plumber's training. The exploit targeting modern Linux v5 kernels helps elevate user privileges by overwriting a SUID binary of your choice by plunging some payload gold...