593 matches found
CVE-2022-30272
The ACE1000 RTU (Motorola Solutions) is affected by CVE-2022-30272. Firmware updates performed via ACE1000 Easy Configurator (Web UI) or via SSH for the FEP module lack authentication and rely on insecure checksums for integrity checks, enabling potential manipulation of firmware images. This cou...
Honeywell Safety Manager
1. EXECUTIVE SUMMARY CVSS v3 7.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: Safety Manager 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow for configuration and firmware manipulation or remote code execution. 3. TECHNICAL...
Emerson DeltaV Distributed Control System 数据伪造问题漏洞
Emerson DeltaV Distributed Control System is an automated distributed control system from Emerson. The system includes features such as network security management, alarm management, batch control, and change management. The Emerson DeltaV Distributed Control System is vulnerable to a data forger...
PT-2022-3097 · Motorola · Motorola Ace1000 Rtu
Name of the Vulnerable Software and Affected Versions: Motorola ACE1000 RTU through 2022-05-02 Description: The issue concerns the mishandling of firmware integrity in the Motorola ACE1000 RTU. Firmware updates can be performed using either the STS software suite or the ACE1000 Easy Configurator...
PT-2022-3168 · Emerson · Emerson Controlwave 'Next Generation' Rtus
Name of the Vulnerable Software and Affected Versions: Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 Description: The issue is related to insufficient authentication of data, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denia...
Security Bulletin: AIX is vulnerable to a denial of service due to OpenSSL (CVE-2022-0778)
Summary A vulnerability in OpenSSL could allow a remote attacker to cause a denial of service CVE-2022-0778. OpenSSL is used by AIX as part of AIX's secure network communications. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw...
CVE-2022-29218
RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems with platforms ending in numbers, like arm64-darwin-21 to be temporarily replaced in the CDN cache by a malicious package. The bug has...
Design/Logic Flaw
RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems with platforms ending in numbers, like arm64-darwin-21 to be temporarily replaced in the CDN cache by a malicious package. The bug has...
CVE-2022-29218 Unauthorized takeover for new versions of some platform-specific gems
RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems with platforms ending in numbers, like arm64-darwin-21 to be temporarily replaced in the CDN cache by a malicious package. The bug has...
CVE-2022-29218
CVE-2022-29218 affects RubyGems, the Ruby package registry. An ordering mistake in the gem-upload code allowed some gems (platforms ending with numbers, e.g., arm64-darwin-21) to be temporarily replaced in the CDN cache by a malicious package. The issue has been patched, and a broad review of log...
[SECURITY] Fedora 36 Update: zchunk-1.2.2-1.fc36
zchunk is a compressed file format that splits the file into independent chunks. This allows you to only download the differences when downloading a new version of the file, and also makes zchunk files efficient over rsync. zchunk files are protected with strong checksums to verify that the file...
Fedora: Security Advisory for zchunk (FEDORA-2022-fef374d46f)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
HUAWEI HarmonyOS 缓冲区错误漏洞
HUAWEI HarmonyOS is an operating system from the Chinese company Huawei HUAWEI. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in the HUAWEI HarmonyOS kernel, which stems from insufficient checksums of parameters passed in the...
DEBIAN-CVE-2022-28487
Tcpreplay version 4.4.1 contains a memory leakage flaw in fixipv6checksums function. The highest threat from this vulnerability is to data confidentiality...
Appneta Tcpreplay 安全漏洞
Appneta Tcpreplay is a suite of open source utilities for editing and replaying network traffic on UNIX-based operating systems from Appneta, Inc. A security vulnerability exists in Appneta Tcpreplay version 4.4.1, which stems from a memory leak in the fixipv6checksums function that affects data...
PT-2022-19055 · Tcpreplay +4 · Tcpreplay +4
Name of the Vulnerable Software and Affected Versions: Tcpreplay version 4.4.1 Description: The issue is a memory leakage flaw in the fix ipv6 checksums function. This flaw poses the highest threat to data confidentiality. Recommendations: For Tcpreplay version 4.4.1, consider disabling the fix...
[SECURITY] Fedora 35 Update: zchunk-1.2.2-1.fc35
zchunk is a compressed file format that splits the file into independent chunks. This allows you to only download the differences when downloading a new version of the file, and also makes zchunk files efficient over rsync. zchunk files are protected with strong checksums to verify that the file...
Security Bulletin: Vulnerability in the AIX smbcd daemon (CVE-2021-38993)
Summary There is a vulnerability in the AIX smbcd daemon. Vulnerability Details CVEID: CVE-2021-38993 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in the smbcd daemon to cause a denial of service. CVSS Base score: 6.2 CVSS Temporal Score: See:...
USN-5230-1: App::cpanminus vulnerability
It was discovered that App::cpanminus did not properly verify CHECKSUMS files. An attacker could possibly use this issue to bypass signature verification, gaining access to sensitive data or possibly executing unauthorized code...