Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote authenticated attacker due to Node.js (CVE-2022-29244, CVE-2022-33987)

Summary IBM App Connect Enterprise and IBM Integration Bus ship with Node.js for which vulnerabilities were reported and have been addressed by an ifix, a fixpack release and an option to disable the node CVE-2022-29244, CVE-2022-33987 Vulnerability Details CVEID:CVE-2022-29244 DESCRIPTION: Node....

Security Bulletin: Multiple vulnerabilities due to OpenSSL and Node js which affect IBM App Connect Enterprise and IBM Integration Bus

Summary There are multiple vulnerabilities due to OpenSSL and Node js which affect IBM App Connect Enterprise and IBM Integration Bus CVE-2022-32223, CVE-2022-32213, CVE-2022-32212, CVE-2022-2097,CVE-2022-32214, CVE-2022-32215. The resolving fix includes node js 14.20.0 and openSSL 1.1.1q...

Insyde InsydeH2O 安全漏洞

Insyde InsydeH2O is a C source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O IdeBusDxe, which arises from the vulnerability of...

PT-2022-35339 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue is related to the drm/msm/dpu component, specifically with the index dpu kms-hw vbif using vbif idx. The actual impact and attack plausibility have not yet been proven...

PT-2022-21897 · Insyde · Ahcibusdxe

Name of the Vulnerable Software and Affected Versions: AhciBusDxe driver versions prior to kernel 5.2: 05.27.23 AhciBusDxe driver versions prior to kernel 5.3: 05.36.23 AhciBusDxe driver versions prior to kernel 5.4: 05.44.23 AhciBusDxe driver versions prior to kernel 5.5: 05.52.23 Description: T...

PT-2022-34875 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.7 Description: A memory leak issue was discovered in the nsim bus dev new function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2022-5610 · Freerdp +9 · Freerdp +9

Name of the Vulnerable Software and Affected Versions: FreeRDP versions prior to 2.9.0 Description: The issue is related to missing input length validation in the urbdrc channel of the FreeRDP library. A malicious server can exploit this to trick a FreeRDP-based client into reading out-of-bound...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an incorrect read request flaw found in the Infrared Transceiver USB driver, which can be exploited by an...

OESA-2022-2047 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a...

[SECURITY] Fedora 37 Update: dbus-1.14.4-1.fc37

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

CVE-2021-34577

In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device...

Hardcoded credentials

In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device...

CVE-2021-34577

CVE-2021-34577 affects the Kaden PICOFLUX AiR water meter. The vulnerability allows an adjacent attacker to read sensor values via wireless M-Bus mode 5 using a hardcoded shared key. Affected component is the radio interface handling M-Bus mode 5 communications; root cause is the use of a hardcod...

CVE-2021-34577 Hardcoded credentials in Kaden PICOFLUX AiR

In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device...

CVE-2021-34577 Hardcoded credentials in Kaden PICOFLUX AiR

In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device...

PT-2022-10357 · Kaden · Kaden Picoflux Air

Name of the Vulnerable Software and Affected Versions: Kaden PICOFLUX AiR water meter affected versions not specified Description: The issue allows an adversary to read values from the device through wireless M-Bus mode 5, utilizing a hardcoded shared key, provided they are adjacent to the device...

Kaden Vodomery Kaden PICOFLUX AiR 信任管理问题漏洞

Kaden Vodomery Kaden PICOFLUX AiR is an electronic cold water meter from the Czech company Kaden Vodomery. Measurement data is transmitted via radio and readings are taken online. The Kaden Vodomery Kaden PICOFLUX AiR suffers from a trust management issue vulnerability that stems from the fact th...

kernel: igc: Reinstate IGC_REMOVED logic and implement it properly

In the Linux kernel, the following vulnerability has been resolved: igc: Reinstate IGCREMOVED logic and implement it properly The initially merged version of the igc driver code via commit 146740f9abc4, "igc: Add support for PF" contained the following IGCREMOVED checks in the igcrd32/wr32 MMIO...

kernel: Drivers: hv: vmbus: Fix potential crash on module unload

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix potential crash on module unload The vmbus driver relies on the panic notifier infrastructure to perform some operations when a panic event is detected. Since vmbus can be built as module, it is required...

kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c

A double-free flaw was found in the Linux kernel in the emsusbstartxmit function. This flaw allows an attacker to create a memory leak and corrupt the underlying data structure by calling free more than once...