1794 matches found
Amazon Linux AMI : sudo, sudo-devel (ALAS-2023-1682)
It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1682 advisory. In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append...
Amazon Linux AMI : emacs-git, emacs-git-el, git (ALAS-2023-1679)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1679 advisory. Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository,...
Amazon Linux AMI : vim-common, vim-data, vim-enhanced (ALAS-2023-1681)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1681 advisory. Use After Free in GitHub repository vim/vim prior to 9.0.0882. CVE-2022-4292 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. CVE-2023-0049 Tenable has extracted the preceding...
Amazon Linux AMI : krb5-devel, krb5-libs, krb5-pkinit-openssl (ALAS-2023-1680)
It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1680 advisory. Integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for...
Amazon Linux AMI : protobuf, protobuf-compiler, protobuf-devel (ALAS-2023-1676)
It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1676 advisory. A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute...
Amazon Linux AMI : squid, squid-migration-script (ALAS-2023-1677)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1677 advisory. In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses. CVE-2021-46784 A...
CVE-2022-43779
CVE-2022-43779 is a TOCTOU vulnerability affecting certain HP PC products utilizing AMI UEFI Firmware (system BIOS). The issue could allow arbitrary code execution, denial of service, and information disclosure. The root cause is a Time-of-Check to Time-of-Use weakness in the firmware. AMI and HP...
CVE-2022-43779
A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerabili...
CVE-2022-43779
A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerabili...
Additional Supply Chain Vulnerabilities Uncovered in AMI MegaRAC BMC Software
Two more supply chain security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller BMC software, nearly two months after three security vulnerabilities were brought to light in the same product. Firmware security firm Eclypsium said the two shortcomings were held back until n...
CVE-2022-40258
AMI Megarac Weak password hashes for Redfish & API...
CVE-2022-40258
AMI Megarac Weak password hashes for Redfish & API...
Design/Logic Flaw
AMI Megarac Weak password hashes for Redfish & API...
CVE-2022-40258 Weak password hashes for Redfish & API
AMI Megarac Weak password hashes for Redfish & API...
CVE-2022-40258 Weak password hashes for Redfish & API
AMI Megarac Weak password hashes for Redfish & API...
CVE-2022-40258
CVE-2022-40258 affects AMI MegaRAC BMC software, describing weak password hashes for Redfish and API. Technical details from connected sources show that older MegaRAC devices use MD5 with a global salt, while newer devices use SHA-512 with per-user salts, enabling potential password cracking. Rel...
AMI MegaRAC 安全漏洞
AMI MegaRAC is a family of service processor products from AMI. Complete out-of-band or unlit remote management of computer systems independent of operating system state or location is available to troubleshoot computers and ensure service continuity. A security vulnerability exists in AMI MegaRA...
CVE-2022-26872
AMI Megarac Password reset interception via API...
CVE-2022-26872 Password reset interception via API
AMI Megarac Password reset interception via API...
CVE-2022-26872 Password reset interception via API
AMI Megarac Password reset interception via API...