CVE-2022-44387: Cross-Site Request Forgery (CSRF)

EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery CSRF via the Basic Information component under the Edit Member module...

PT-2022-35407 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.74 Description: A potential issue exists in the Linux Kernel, specifically in the cfg80211 component, which may lead to corruption of the BSS list. The actual impact and attack plausibility have not yet be...

PT-2022-27206 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.5.9-UTF8-SP1 Description: A Cross-Site Request Forgery CSRF issue was discovered in the Basic Information component under the Edit Member module. This allows for unauthorized actions to be performed on behalf of a user...

PT-2022-23627 · Intel · Intel Nuc 10 Performance Mini Pcs +1

Name of the Vulnerable Software and Affected Versions: IntelR NUC 10 Performance Kits and IntelR NUC 10 Performance Mini PCs versions prior to FNCML357.0053 Description: The issue is related to improper access control in BIOS firmware, which may allow a privileged user to enable escalation of...

CVE-2022-33321

Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric...

CVE-2022-33321

Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric...

Design/Logic Flaw

Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric...

CVE-2022-33321

Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric...

@cerebroapp/cerebro-basic-apps (>=1.0.0-alpha.0, <=1.0.0-alpha.1), @finsemble/finsemble-core (>=1.0.0-beta-3, <=8.0.2) +7 more potentially affected by CVE-2022-36077 via electron (>=19.0.0, <=19.0.10)

electron NPM version =19.0.0, =1.0.0-alpha.0, =1.0.0-beta-3, =1.0.0-beta-3, =3.0.9, =0.36.0-canary.17, =2.0.74, =2.0.83 - simple-git-gui 3.8.31 Source cves: CVE-2022-36077 Source advisory: MEND:CVE-2022-36077...

CVE-2022-33321

Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric...

Mitsubishi Electric consumer electronics products have security vulnerabilities

Mitsubishi Electric consumer electronics products is a line of consumer electronics products from Mitsubishi Electric Corporation Mitsubishi Electric of Japan. A security vulnerability exists in Mitsubishi Electric consumer electronics products that stems from the use of basic authentication for...

CVE-2022-33321

Summary: CVE-2022-33321 is a vulnerability in Mitsubishi Electric consumer electronics products caused by using Basic Authentication over HTTP. This cleartext transmission can let a remote, unauthenticated attacker sniff credentials (username/password) and potentially cause a DoS. Affected produc...

CVE-2022-33321: Cleartext Transmission of Sensitive Information

Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric...

azkm (>=0.1.0, <=0.2.71), azure-knowledgemining-cli (0.1.0) +4 more potentially affected by CVE-2022-39327 via azure-cli (>=2.0.76, <=2.36.0)

azure-cli PYPI version =2.0.76, =0.1.0, =0.3.1, =0.1.10, =1.0.19 - projetaai-azure 0.1.0b0 Source cves: CVE-2022-39327 Source advisory: MEND:CVE-2022-39327...

Authentication Bypass

github.com/brokercap/bifrost is vulnerable to authentication bypass. The vulnerability exists in multiple functions of ajax.js because of removing the X-Requested-With: XMLHttpRequest field from the request header which allows an attacker to bypass permission using HTTP basic authentication...

CVE-2022-3158

Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantagePoint SQL Server lacks input validation when users enter SQL statements to retrieve information from the back-end database. If successfully...

DEBIAN-CVE-2022-42720

Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers able to inject WLAN frames to trigger use-after-free conditions to potentially execute code...

ALPINE-CVE-2022-42719

A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers able to inject WLAN frames to crash the kernel and potentially execute code...

CVE-2022-34390

Dell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM...

Support Statement - Exchange Online Basic Authentication Deprecation

Purpose This article provides information on actions that must be taken to ensure Veeam Backup for Microsoft 365 will continue to function after the Basic Authentication Deprecation in Exchange Online. Associated Error Messages The following errors may be shown in Veeam Backup for Microsoft 365...