OpenSSL 3.0.4 < 3.0.5-dev Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.0.5-dev. It is, therefore, affected by a vulnerability as referenced in the 3.0.5-dev advisory. - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X8664 CPUs supporting the AVX512IFMA instructions...

OpenSSL -- Heap memory corruption with RSA private key operation

The OpenSSL project reports: The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X8664 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during t...

Cloud-init 日志信息泄露漏洞

Cloud-init is a virtual machine initialization tool for cloud platforms. Cloud-init suffers from a log message disclosure vulnerability that stems from a logged architecture failure...

GSD-2022-1003147 NFC: NULL out the dev->rfkill to prevent UAF

NFC: NULL out the dev-rfkill to prevent UAF This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

Detecting malicious key extractions by compromised identities for Azure Cosmos DB

Azure Cosmos DB is a fully managed NoSQL cloud database service for modern app development. It offers a variety of advanced built-in features, such as automatic worldwide data replication, lightning-fast response types, and a variety of APIs. In this blog post, we describe security practices for...

Detecting malicious key extractions by compromised identities for Azure Cosmos DB

Azure Cosmos DB is a fully managed NoSQL cloud database service for modern app development. It offers a variety of advanced built-in features, such as automatic worldwide data replication, lightning-fast response types, and a variety of APIs. In this blog post, we describe security practices for...

Siemens SIMATIC WinCC OA (Open Architecture) Detection

Binary data scadaappsiemenswinccoadetect.nbin...

CISA Releases Cloud Security Technical Reference Architecture

CISA has released its Cloud Security CS Technical Reference Architecture TRA to guide federal civilian departments and agencies in securely migrating to the cloud. Co-authored by CISA, the United States Digital Service, and the Federal Risk and Authorization Management Program, the CS TRA defines...

CVE-2022-1665

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing...

Code injection

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing...

CVE-2022-1665

CVE-2022-1665 affects Red Hat Enterprise Linux for IBM Power (ppc64le): pre-production kernel packages could bypass Secure Boot lockdown patches and load non-trusted code. Root cause: missing lockdown patches in affected builds. Impact: potential code execution with elevated privileges by booting...

CVE-2022-33139

A vulnerability has been identified in Cerberus DMS All versions, Desigo CC All versions, Desigo CC Compact All versions, SIMATIC WinCC OA V3.16 All versions in default configuration, SIMATIC WinCC OA V3.17 All versions in non-default configuration, SIMATIC WinCC OA V3.18 All versions in...

CVE-2022-1665

A flaw was found in the Linux kernel, where a set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture were signed with Red Hat's production secure boot keys. This issue allows kernel versions targeted for testing to eventually boot in PowerPC environments with...

IBM AIX and VIOS Denial of Service Vulnerability

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. IBM AIX versions 7.1, 7.2, 7.3 and VIOS version 3.1 have a denial-of-service vulnerability that stems from failure to properly process incoming error messages, which can be exploited by...

CVE-2022-29866

OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resource Consumption...

OPC UA .NET Standard Stack 资源管理错误漏洞

NET Standard Stack is an open source C++ framework from the OPC Foundation in the United States. NET Standard Stack is an open source C++ framework used by the OPC Foundation to develop and distribute OPC UA client/server applications. A security vulnerability exists in OPC UA .NET Standard Stack...

OPC UA .NET Standard Stack 安全漏洞

NET Standard Stack is an open source C++ framework from the OPC Foundation in the United States. NET Standard Stack is an open source C++ framework from the OPC Foundation for developing and distributing OPC UA client/server applications. A security vulnerability exists in OPC UA .NET Standard...

OPC UA .NET Standard Stack 资源管理错误漏洞

NET Standard Stack is an open source C++ framework from the OPC Foundation in the United States. NET Standard Stack is an open source C++ framework from the OPC Foundation for developing and distributing OPC UA client/server applications. A security vulnerability exists in OPC UA .NET Standard...

OPC UA .NET Standard Stack 授权问题漏洞

NET Standard Stack is an open source C++ framework from the OPC Foundation in the United States. NET Standard Stack is an open source C++ framework used by the OPC Foundation of the United States for developing and distributing OPC UA client/server applications. NET Standard Stack has a security...

Siemens SINEMA Remote Connect Server has an unspecified vulnerability (CNVD-2022-45222)

SINEMA Remote Connect is a remote network management platform that makes it easy to manage tunnel connections VPNs between headquarters, service technicians, and installed machines or plants.A security vulnerability exists in Siemens SINEMA Remote Connect Server, which stems from a system image...