An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.

...

PT-2022-33415 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: A potential bad pointer dereference issue exists in the bpf sys bpf function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v5.14 a...

PT-2022-33375 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.19 through v5.19.3 Description: The issue is related to a potential security vulnerability in the Linux Kernel. It involves a fix for a call trace with a null VSI during VF reset. The actual impact and attack...

Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)

Summary Apache Struts is used by IBM Call Center as part of its web application framework used for creating Java EE web applications. It is vulnerable to various CVEs, listed below. We recommend upgrading to the latest supported version of Struts that was released as part of the latest FixPack 12...

D-Link DIR-2150 xupnpd Dreambox Plugin Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Dreambox plugin for the xupnpd service, which listens on TCP...

D-Link DIR-2150 xupnpd ui_upload Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044 by default. The...

D-Link DIR-2150 xupnpd_generic Plugin Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpdgeneric.lua plugin for the xupnpd service, which listens...

CVE-2022-35830

Remote Procedure Call Runtime Remote Code Execution Vulnerability...

CVE-2022-35830

Remote Procedure Call Runtime Remote Code Execution Vulnerability...

CVE-2022-35830

Remote Procedure Call Runtime Remote Code Execution Vulnerability...

CVE-2022-34725

Windows ALPC Elevation of Privilege Vulnerability...

CVE-2022-34725

Windows ALPC Elevation of Privilege Vulnerability...

Remote code execution

Remote Procedure Call Runtime Remote Code Execution Vulnerability...

CVE-2022-35830 Remote Procedure Call Runtime Remote Code Execution Vulnerability

...

CVE-2022-36104

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads t...

Design/Logic Flaw

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads t...

CVE-2022-36780

Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the system. Attacker sends crafted URL to the system:...

Design/Logic Flaw

Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the system. Attacker sends crafted URL to the system:...

CVE-2022-36780

The CVE-2022-36780 entry concerns Avdor CIS Crystal Quality Solutions (phone call recorder). The vulnerability is a credentials management flaw that allows unauthorized users to access recorded calls without authentication by sending a crafted URL to the system, for example: ip:port//V=2;Channell...

CVE-2022-36780 Avdor CIS - crystal quality Credentials Management Errors

Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the system. Attacker sends crafted URL to the system:...