sssd bug fix and enhancement update

An update is available for sssd. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The System Security Services Daemon SSSD service provides a set of daemons to...

PowerHuntShares - Audit Script Designed In Inventory, Analyze, And Report Excessive Privileges Configured On Active Directory Domains

PowerHuntShares is design to automatically inventory, analyze, and report excessive privilege assigned to SMB shares on Active Directory domain joined computers. It is intented to help IAM and other blue teams gain a better understand of their SMB Share attack surface and provides data insights t...

CVE-2022-38187

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs...

Esri Portal For ArcGis 安全漏洞

Esri Portal For ArcGis is a component of Esri, Inc. that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A security vulnerability exists in Esri Portal For ArcGis versions prior to 10.9.0 that stems from an anonymous user always...

HackerOne: Ability to escape database transaction through SQL injection, leading to arbitrary code execution

HackerOne has an internal backend interface that gives debugging capabilities to its engineers. One of the features is the ability to run EXPLAIN ANALYZE queries against a connected database. This feature is accessible by a handful of engineers. The feature is vulnerable to a SQL injection that...

MAL-2022-4929 Malicious code in now-dashboard-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04c9c4dd295653d2e1a589fc80610b6a7d3817ca684ac34f8748ecc73073e3e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in now-dashboard-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04c9c4dd295653d2e1a589fc80610b6a7d3817ca684ac34f8748ecc73073e3e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-36028)

Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency. Delta...

Metasploit Weekly Wrap-Up

Meterpreter Debugging A consistent message Metasploit hears from users is that debugging and general logging support could be improved. The gaps in functionality make it difficult for users to understand what happens when things go wrong and for new and existing developers to fix bugs and add new...

USN-5375-1: GNU cflow vulnerability

It was discovered that GNU cflow was incorrectly handling memory cleanup operations at the end of a compilation module. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code...

The vulnerability of the md_analyze_line function (md4c.c) in the MD4C parser, which relates to the use of an uninitialized resource, allows a hacker to cause a service failure.

The vulnerability of the mdanalyzeline function in the MD4C parser is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Security Bulletin: IBM i2 Analyze and IBM i2 Analyst's Notebook Premium are affected by Apache Log4j Vulnerabilities (CVE-2021-45105 and CVE-2021-45046)

Summary Apache Log4j is used by IBM i2 Analyze for general purpose and application error logging. It is also used in IBM i2 Analyst's Notebook Premium when the chart store is deployed. This bulletin addresses the vulnerabilities for the reported CVE-2021-45105 and CVE-2021-45046. The below fix...

Security Bulletin: i2 Analyze, i2 Connect and Analyst's Notebook Premium are affected by the Log4j vulnerability (CVE-2021-44228)

Summary Log4j is used by i2 Analyze and i2 Connect for general purpose and application error logging. It is also used in Analyst's Notebook Premium when the chart store is deployed. This bulletin provides mitigation for the reported CVE-2021-44228 by providing configuration that addresses Log4j...

POWER METER SICAM Q100 Remote Code Execution Vulnerability

The POWER METER SICAM Q100 is a multifunctional device used to detect, report and analyze measured values and events.The POWER METER SICAM Q100 remote code execution vulnerability can be exploited by remote attackers to execute remote code...

Security Bulletin: DB2 bundled with IBM i2 Analyze is affected by multiple vulnerabilities (CVE-2021-38931, CVE-2021-29678, CVE-2021-20373, CVE-2021-39002, CVE-2021-38926)

Summary IBM i2 Analyze bundles DB2. IBM DB2 has issued fixes for multiple security vulnerabilities. Vulnerability Details CVEID: CVE-2021-38931 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server 11.1, and 11.5 is vulnerable to an information disclosure as a result of a...

Security Bulletin: Multiple vulnerabilities in IBM HTP server optionally used by i2 Analyze

Summary There are multiple vulnerabilities in the IBM HTTP Server bundled and optionally deployed with IBM i2 Analyze. The referenced bulletin points to fixes for the issues. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versio...

Exploit for CVE-2021-22006

CVE-2021-22005 - VMWare vCenter Server File Upload to RCE...

PDFTools stack buffer overflow vulnerability

PDFTools is a tool for converting PDF files to ePUB format. A stack buffer overflow vulnerability exists in the Analyze::AnalyzePages function in analyze.cpp in PDFTools 20200714 and earlier versions. An attacker could exploit this vulnerability to execute code...

PDFTools null pointer dereference vulnerability (CNVD-2021-73928)

PDFTools is a tool for converting PDF files to ePUB format. A null pointer dereference vulnerability exists in the Analyze::AnalyzeRoot function in analyze.cpp in PDFTools 20200714 and earlier versions. An attacker could exploit this vulnerability to cause a denial of service...

PDFTools null pointer dereference vulnerability (CNVD-2021-73926)

PDFTools is a tool for converting PDF files to ePUB format. A null pointer dereference vulnerability exists in the Analyze::AnalyzeXref function in analyze.cpp in PDFTools 20200714 and earlier versions. An attacker could exploit this vulnerability to cause a denial of service...