golang: crypto/tls: session tickets lack random ticket_age_add

A flaw was found in the crypto/tls golang package. When session tickets are generated by crypto/tls, it is missing the ticket expiration. This issue may allow an attacker to observe the TLS handshakes to correlate successive connections during session resumption...

CVE-2022-40955 Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the...

conntrack-tools bug fix and enhancement update

An update is available for conntrack-tools. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The conntrack-tools packages enable the user to set up a High...

CVE-2022-34917 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Exampl...

Spoofing Attack

lemonldap is vulnerable to spoofing attack. The vulnerability exists in the underlying tcp/ip stack where an attacker with network access to the LAN interface of an affected device could hijack and ingoing connection or spoof a new one...

Security Bulletin: Vulnerabilities in libcurl may affect IBM Spectrum Protect Plus (CVE-2021-22946, CVE-2022-27782, CVE-2022-27774, CVE-2022-22576, CVE-2021-22947, CVE-2022-27776)

Summary Vulnerabilities in libcurl such as bypassing security restrictions, obtaining sensitive information, and man-in-the-middle attacks may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID:CVE-2021-22946 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive...

GSD-2022-1005912 coresight: Clear the connection field properly

coresight: Clear the connection field properly This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.137 by commit...

PT-2022-34170 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.137 Description: The issue is related to the coresight component, where the connection field is not properly cleared. This is an automated ID intended to aid in discovery of potential security...

PT-2022-33933 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.61 Description: The issue is related to the coresight component, where the connection field is not properly cleared. This is an automated ID intended to aid in discovery of potential security...

GSD-2022-1005103 scsi: iscsi: Fix HW conn removal use after free

scsi: iscsi: Fix HW conn removal use after free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.4 by commit...

OPENSUSE-SU-2022:10121-1 Security update for opera

This update for opera fixes the following issues: Update to 90.0.4480.84 - DNA-101690 Cherry-pick fix for CVE-2022-3075 from chromium Update to 90.0.4480.80 - DNA-99188 Tab Tooltip doesn't disappear - DNA-100664 Shopping corner widget - DNA-100843 Options to install and update VPN Pro app, when...

EulerOS 2.0 SP9 : curl (EulerOS-SA-2022-2310)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libcurl provides the CURLOPTCERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an...

The vulnerability of the amqp_handle_input function in the amqp_connection.c component of the RabbitMQ messaging broker allows a attacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the amqphandleinput function in the amqpconnection.c component of the RabbitMQ messaging broker is related to the lack of checks on the frame size. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause...

CVE-2022-35831

Windows Remote Access Connection Manager Information Disclosure Vulnerability...

CVE-2022-35831

Windows Remote Access Connection Manager Information Disclosure Vulnerability...

Information disclosure

Windows Remote Access Connection Manager Information Disclosure Vulnerability...

CVE-2022-35831 Windows Remote Access Connection Manager Information Disclosure Vulnerability

...

CVE-2022-35831

CVE-2022-35831 affects the Windows Remote Access Connection Manager and is described as an Information Disclosure vulnerability. The connected data provides technical details: affected component is the Remote Access Connection Manager; root cause is an information disclosure fault; impact is Conf...

Windows Remote Access Connection Manager Information Disclosure Vulnerability

...

KLA19245 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, cause denial of service, obtain sensitive information, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A remote cod...