GSD-2022-1002537 sysrq: do not omit current cpu when showing backtrace of all active CPUs

sysrq: do not omit current cpu when showing backtrace of all active CPUs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

pacemaker enhancement update

An update is available for pacemaker. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Pacemaker cluster resource manager is a collection of technologies...

samba bug fix and enhancement update

An update is available for samba. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Samba is an open-source implementation of the Server Message Block SMB protocol...

samba bug fix and enhancement update

An update is available for samba. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Samba is an open-source implementation of the Server Message Block SMB protocol...

CISA Log4Shell warning: Patch VMware Horizon installations immediately

CISA and the United States Coast Guard Cyber Command CGCYBER are warning that the threat of Log4Shell hasnt gone away. Its being actively exploited and used to target organisations using VMware Horizon and Unified Access Gateway servers. Log4Shell: what is it? Log4Shell was a zero-day vulnerabili...

CVE-2022-1916

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a...

WordPress plugin Active Products Tables for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Active Products Tables for WooCommerce plugin version prior to 1.0.5 has a cross-site scripting...

CVE-2021-30651

A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access...

Design/Logic Flaw

A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access...

CVE-2021-30651

A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access...

CVE-2021-30651

CVE-2021-30651 relates to Broadcom Symantec Messaging Gateway (SMG). An authenticated SMG administrator can obtain passwords for external LDAP/Active Directory servers, representing an information disclosure vulnerability. The NVD entry records network access with authenticated, low complexity co...

PT-2022-10021 · Smg · Smg

Name of the Vulnerable Software and Affected Versions: SMG affected versions not specified Description: A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access. Recommendations: At the...

NibblVault permit functionality allows redeeming only one "active" signature

Lines of code Vulnerability details Impact Contract NibblVault implements function permit that allows approving spender to spend value of tokens that belongs to owner. The issue is that structHash keeps incrementing noncesowner++ which in case of multiple "active" permits signatures of the same...

Intermittent Session Launch Failure with Active/Active StoreFront Server Groups

Users intermittently fail to receive ICA files from StoreFront when trying to launch a new session in the following circumstances all of the below conditions must apply: Multiple active StoreFront server groups are in use, connected by GSLB, configured either for direct access or authentication...

Detecting malicious key extractions by compromised identities for Azure Cosmos DB

Azure Cosmos DB is a fully managed NoSQL cloud database service for modern app development. It offers a variety of advanced built-in features, such as automatic worldwide data replication, lightning-fast response types, and a variety of APIs. In this blog post, we describe security practices for...

Vulnerability fixed in TheHive and Cortex

A vulnerability has been fixed in TheHive and Cortex. The vulnerability allows an unauthenticated remote malicious person able to bypass authentication by providing an existing username but not including a password. send. This vulnerability is only exploitable if TheHive and Cortex use an AD to...

The vulnerability of the Intel Setup and Configuration Software (SCS) data collection tool, as well as the configuration tools for the Intel Management Engine BIOS Extension and the Intel Active Management Technology implementation, related to insufficient protection of registration data, allows a perpetrator to disclose protected information.

The vulnerability of the Intel Setup and Configuration Software SCS data collection tool, as well as the configuration tools for the Intel Management Engine BIOS Extension and the Intel Active Management Technology implementation, is related to insufficient protection of registration data...

CVE-2022-22967

Removed by vendor...

DFSCoerce, a new NTLM relay attack, can take control over a Windows domain

A researcher has published a Proof-of-Concept PoC for an NTLM relay attack dubbed DFSCoerce. The method leverages the Distributed File System: Namespace Management Protocol MS-DFSNM to seize control of a Windows domain. Active Directory A directory service is a hierarchical arrangement of objects...

CVE-2022-23342

The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An attacker can obtain valid users based on the response returned for invalid and valid users by sending a POST login...