Toll fraud malware: How an Android application can drain your wallet

Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve. Compared to other subcategories of billing fraud, which...

Schneider Electric Geo SCADA Mobile Information Disclosure Vulnerability

Schneider Electric Geo SCADA Mobile is a mobile extension from Schneider Electric, a French company. It provides real-time remote access to critical SCADA data, allowing system users to monitor performance while "on the go," increasing employee productivity and improving overall system performanc...

curl security update

7.61.1-22.el86.3 - fix too eager reuse of TLS and SSH connections CVE-2022-27782 7.61.1-22.el86.2 - fix invalid type in printf argument detected by Coverity 7.61.1-22.el86.1 - fix credential leak on redirect CVE-2022-27774 - fix auth/cookie leak on redirect CVE-2022-27776 - fix OAUTH2 bearer bypa...

curl security update

7.76.1-14.el90.4 - fix too eager reuse of TLS and SSH connections CVE-2022-27782 7.76.1-14.el90.3 - fix leak of SRP credentials in redirects CVE-2022-27774 7.76.1-14.el90.2 - add missing tests to Makefile 7.76.1-14.el90.1 - fix credential leak on redirect CVE-2022-27774 - fix auth/cookie leak on...

PVS : Failed to connect to the PVS API, error : Unable to connect to the remote server

PVS : Unable to connect to the PVS API, error - Unable to connect to the remote server...

Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: buffer overflow in IPsec ESP transformation code CVE-2022-27666 kernel: out-of-bounds read in fbcongetfont function CVE-2020-28915 For more details about the security issues, including th...

ALSA-2022:5316 Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: buffer overflow in IPsec ESP transformation code CVE-2022-27666 kernel: out-of-bounds read in fbcongetfont function CVE-2020-28915 For more details about the security issues, including th...

ALSA-2022:5313 Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: OAUTH2 bearer bypass in connection re-use CVE-2022-22576 curl: credential leak on redirect CVE-2022-27774 curl:...

The vulnerability of the url.openConnection() method in Embed2 software, a service for creating drawio diagrams, allows a attacker to perform an SSRF attack.

The vulnerability of the url.openConnection method in Embed2 software, which is used for creating drawio diagrams, is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack by sending a specially crafted HTTP...

CVE-2021-3430

Assertion reachable with repeated LLCONNECTIONPARAMREQ. Zephyr versions = v1.14 contain Reachable Assertion CWE-617. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-46h3-hjcq-2jjr...

GSD-2022-1003388 Bluetooth: use hdev lock for accept_list and reject_list in conn req

Bluetooth: use hdev lock for acceptlist and rejectlist in conn req This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.46 by commit...

GSD-2022-1002762 Bluetooth: use hdev lock for accept_list and reject_list in conn req

Bluetooth: use hdev lock for acceptlist and rejectlist in conn req This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.3 by commit...

CLSA-2022-1656430292 Fixed CVEs in curl: CVE-2022-27780, CVE-2022-27782, CVE-2022-27781

CVE-2022-27782: check additional TLS or SSH connection parameters that should have prohibited connection reuse - CVE-2022-27781: add limit of certificates which can be traversed breaking possible infinite loop - CVE-2022-27780: exclude malicious characters from url to prevent incorrect address...

CLSA-2022-1656430138 Fixed CVEs in curl: CVE-2022-27780, CVE-2022-27781, CVE-2022-27782

CVE-2022-27782: check additional TLS or SSH connection parameters that should have prohibited connection reuse - CVE-2022-27781: add limit of certificates which can be traversed breaking possible infinite loop - CVE-2022-27780: exclude malicious characters from url to prevent incorrect address...

kernel security and bug fix update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

RLSA-2022:5316 Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: buffer overflow in IPsec ESP transformation code CVE-2022-27666 kernel: out-of-bounds read in fbcongetfont function CVE-2020-28915 For more details about the security issues, including th...

curl security update

An update is available for curl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...

RLSA-2022:5313 Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: OAUTH2 bearer bypass in connection re-use CVE-2022-22576 curl: credential leak on redirect CVE-2022-27774 curl:...

Zephyr 缓冲区错误漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in Zephyr version v2.5.0 and later, which stems from a stack-based buffer overflow in leecredconnreq...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS. a denial of service vulnerability exists in Zephyr v1.14 and later, which stems from an assertion that can be reached via a repeated LLCONNECTIONPARAMREQ. An attacker could exploit this vulnerability to cause a denial of service attack...