CVE-2022-3369 Improper handling of registry symbolic links in Bitdefender Engines

An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender Engines versions prior to 7.92659. It...

PYSEC-2022-43177

Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. T...

PT-2022-23210 · Automox · Automox Agent

Name of the Vulnerable Software and Affected Versions: Automox Agent versions prior to 40 Description: The issue is related to incorrect permissions set on key files by the Automox Agent on Windows systems. Recommendations: For versions prior to 40, update to version 40 or later to resolve the...

CVE-2022-39421

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-39427

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

Buffer overflow

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

Design/Logic Flaw

Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services for Microsoft...

CVE-2022-21606

Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services for Microsoft...

CVE-2022-39421

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-39427

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-39421

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-38047

Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability...

PT-2022-5596 · Microsoft · Windows Point-To-Point Tunneling Protocol +1

Name of the Vulnerable Software and Affected Versions: Windows Point-to-Point Tunneling Protocol affected versions not specified Description: The issue is related to the implementation of the Point-to-Point Tunneling Protocol PPTP in Windows operating systems, specifically concerning...

Microsoft Windows Kerberos 安全漏洞

Microsoft Windows Kerberos is a software for authentication in network clusters from Microsoft Corporation.Kerberos also serves as a network authentication protocol designed to provide strong authentication services to client/server applications via a key system. A security vulnerability exists i...

The vulnerability of the Layer 2 Tunneling Protocol (L2TP) implementation in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Layer 2 Tunneling Protocol L2TP implementation in Windows operating systems is related to insufficient protection for confidential data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

GO-2022-0355 Path traversal in github.com/valyala/fasthttp

The fasthttp.FS request handler is vulnerable to directory traversal attacks on Windows systems, and can serve files from outside the provided root directory. URL path normalization does not handle Windows path separators backslashes, permitting an attacker to construct requests with relative pat...

The vulnerability of the Cachuri module in the Microsoft Internet Information Services (IIS) network services for Windows operating systems allows a hacker to cause a service failure.

The vulnerability of the Cachuri module in the Microsoft Internet Information Services IIS network services for Windows operating systems is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Carriage Return And Line Feed (CLRF) Injection

shescape is vulnerable to carriage return line feed CRLF injection. User provided data for Powershell and cmd.exe on Windows systems are not escaped sufficiently, allowing an attacker to input a line feed character '\n'...

Hackers Exploiting Follina Bug to Deploy Rozena Backdoor

A newly observed phishing campaign is leveraging the recently disclosed Follina security vulnerability to distribute a previously undocumented backdoor on Windows systems. "Rozena is a backdoor malware that is capable of injecting a remote shell connection back to the attacker's machine," Fortine...

The vulnerability of clients for conducting real-time audio and video conferences via Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows allows a perpetrator to disclose protected information.

The vulnerability of clients for conducting real-time audio and video conferences using Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows involves the disclosure of information. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...