CVE-2022-26872

CVE-2022-26872 (AMI MegaRAC BMC): password reset interception via API could enable an attacker to alter passwords through social engineering and, if exploited, enable remote control of affected servers and deployment of malware or firmware implants. Public discussions summarize the vulnerability ...

PT-2023-1336 · Ami · Ami Megarac

Name of the Vulnerable Software and Affected Versions: AMI MegaRAC affected versions not specified Description: The issue is related to insufficient password hash computation in the Redfish and API components of the AMI MegaRAC firmware. This could allow a remote attacker to gain unauthorized...

Amazon Linux AMI : exim (ALAS-2023-1662)

The version of exim installed on the remote host is prior to 4.92-1.34. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1662 advisory. A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex...

Amazon Linux AMI : php71-pecl-memcached (ALAS-2023-1674)

The version of php71-pecl-memcached installed on the remote host is prior to 3.2.0-1.4. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1674 advisory. PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection...

Amazon Linux AMI : postgresql92 (ALAS-2023-1657)

The version of postgresql92 installed on the remote host is prior to 9.2.24-3.68. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1657 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

Amazon Linux AMI : postgresql96 (ALAS-2023-1661)

The version of postgresql96 installed on the remote host is prior to 9.6.24-1.86. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1661 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

Amazon Linux AMI : vim (ALAS-2023-1663)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1663 advisory. - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. CVE-2022-3520 - Use After Free in GitHub repository vim/vim prior to 9.0.0789. CVE-2022-3591 - A vulnerability was foun...

Amazon Linux AMI : php56-pecl-memcached (ALAS-2023-1672)

The version of php56-pecl-memcached installed on the remote host is prior to 2.2.0-5.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1672 advisory. PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injectio...

Amazon Linux AMI : php70-pecl-memcached (ALAS-2023-1673)

The version of php70-pecl-memcached installed on the remote host is prior to 3.2.0-1.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1673 advisory. PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection...

Amazon Linux AMI : php55-pecl-memcached (ALAS-2023-1671)

The version of php55-pecl-memcached installed on the remote host is prior to 2.2.0-5.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1671 advisory. PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injectio...

Amazon Linux AMI : hsqldb (ALAS-2023-1666)

The version of hsqldb installed on the remote host is prior to 1.8.1.3-1.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1666 advisory. Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb HyperSQL DataBase to process untrusted input may be...

Amazon Linux AMI : vim (ALAS-2023-1664)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1664 advisory. The target's backtrace indicates that libc has detected a heap error or that the target was executing a heap function when it stopped. This could be due to heap corruption, passing a bad pointer to a heap...

Amazon Linux AMI : postgresql95 (ALAS-2023-1660)

The version of postgresql95 installed on the remote host is prior to 9.5.24-1.83. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1660 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

Amazon Linux AMI : krb5 (ALAS-2023-1667)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1667 advisory. Integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for...

Amazon Linux AMI : bcel (ALAS-2023-1668)

The version of bcel installed on the remote host is prior to 5.2-7.2.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1668 advisory. Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an...

Amazon Linux AMI : postgresql94 (ALAS-2023-1659)

The version of postgresql94 installed on the remote host is prior to 9.4.26-1.78. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1659 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

Amazon Linux AMI : postgresql93 (ALAS-2023-1658)

The version of postgresql93 installed on the remote host is prior to 9.3.25-1.73. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1658 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

Amazon Linux AMI : nginx (ALAS-2023-1665)

The version of nginx installed on the remote host is prior to 1.18.0-1.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1665 advisory. NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and...

PT-2023-12790 · Razer +3 · Razer +3

Name of the Vulnerable Software and Affected Versions: Razer affected versions not specified EVGA affected versions not specified MSI affected versions not specified AMI affected versions not specified Description: The issue concerns multiple Time-of-Check-to-Time-of-Use TOCTOU vulnerabilities in...

CVE-2022-44754

HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described i...