Vulnerabilities fixed in Oracle Communications

Vulnerabilities have been fixed in Oracle Communications. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Bypassing authentication Remote code execution User rights Access to system data...

CVE-2022-4289

An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users...

UBUNTU-CVE-2022-4289

An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from unhidden Google IAP...

virtio-win bug fix and enhancement update

An update is available for virtio-win. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The virtio-win package provides paravirtualized network drivers for most...

Restore or Failback to Server 2022 Hyper-V host fails with "Unable to update VM security descriptor Error"

Article Applicability This article is specific to an error that occurs when attempting to restore or failback to a Hyper-V host running Windows Server 2022 or versions 2004 and 20H2 of the Semi-Annual Channel versions of Windows Server. This article addresses an issue that is mentioned in the Vee...

How to Disable Oracle Processing Without Disabling Application-Aware Processing

Purpose This article documents how to disable the processing of Oracle instances by Application-Aware Processing without disabling Application-Aware Processing processing for other applications running on the same machine. Solution Disable Oracle Processing for a VM Protected by Veeam Backup &...

[SECURITY] Fedora 36 Update: open-policy-agent-0.31.0-7.fc36

An open source, general-purpose policy engine. The Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack...

[SECURITY] Fedora 36 Update: open-policy-agent-0.31.0-6.fc36

An open source, general-purpose policy engine. The Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack...

WIZPLAT PD065 Denial of Service Vulnerability

WIZPLAT PD065 is a fingerprint-aware secure USB memory from WIZPLAT Korea.A denial of service vulnerability exists in WIZPLAT PD065 v1.19, which stems from a failure to properly verify authentication in the authentication module. An attacker could use this vulnerability to access sensitive data a...

WIZPLAT PD065 安全漏洞

WIZPLAT PD065 is a fingerprint-aware secure USB memory from WIZPLAT Korea.A denial of service vulnerability exists in WIZPLAT PD065 v1.19, which stems from a failure to properly verify authentication in the authentication module. An attacker could use this vulnerability to access sensitive data a...

CVE-2022-24797

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This...

CVE-2022-24797

CVE-2022-24797 affects Pomerium in distributed service mode, where the Authenticate service exposes pprof debug and Prometheus metrics endpoints to untrusted traffic. This can leak environmental information and cause limited denial of service. The issue is fixed in v0.17.1. Workarounds include bl...

CVE-2022-24797 Exposure of Sensitive Information in Pomerium

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This...

WordPress Content Aware Sidebars plugin <= 3.17.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Content Aware Sidebars plugin versions = 3.17.1. Solution Update the WordPress Content Aware Sidebars plugin to the latest available version at least 3.17.2...

WordPress Content Aware Sidebars plugin <= 3.17.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Content Aware Sidebars plugin versions = 3.17.1. Solution Update the WordPress Content Aware Sidebars plugin to the latest available version at least 3.17.2...

GO-2021-0258 Incorrect authorization in github.com/pomerium/pomerium

Pomerium is an open source identity-aware access proxy. Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make incorrect authorizati...

Authorization

Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make...

CVE-2021-41230

Pomerium (open source identity-aware access proxy) is affected when using allowed_idp_claims: changes to a user’s OIDC claims after initial login may not be reflected in policy evaluation, causing incorrect authorization decisions. The issue has been fixed in v0.15.6. For users who cannot upgrade...

Teleport授权问题漏洞

Teleport is an identity-aware, multi-protocol access agent from Teleport USA, Inc. Used by engineers and security professionals to unify access to SSH servers, Kubernetes clusters, web applications, and databases across all environments, Teleport suffers from an authorization issue vulnerability...