RLSA-2022:5313 Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: OAUTH2 bearer bypass in connection re-use CVE-2022-22576 curl: credential leak on redirect CVE-2022-27774 curl:...

Zephyr 缓冲区错误漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in Zephyr version v2.5.0 and later, which stems from a stack-based buffer overflow in leecredconnreq...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS. a denial of service vulnerability exists in Zephyr v1.14 and later, which stems from an assertion that can be reached via a repeated LLCONNECTIONPARAMREQ. An attacker could exploit this vulnerability to cause a denial of service attack...

CVE-2022-31098 Weave GitOps leaked cluster credentials into logs on connection errors

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of...

Design/Logic Flaw

A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection option or the wrong control request when a mobile device has been compromised by a malicious application. Affected Product: Geo SCADA Mobile...

CVE-2022-31803

In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users or clients from establishing a new connection to the CODESYS Gateway Server V2. Existing connectio...

Weave GitOps leaked cluster credentials into logs on connection errors

Impact A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of registered Kubernetes clusters, including the service account tokens in plain text from Weave GitOps's pod logs on the management cluster...

GHSA-XGGC-QPRG-X6MW Weave GitOps leaked cluster credentials into logs on connection errors

Impact A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of registered Kubernetes clusters, including the service account tokens in plain text from Weave GitOps's pod logs on the management cluster...

CVE-2022-34209

A cross-site request forgery CSRF vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL...

Malicious Package

Overview generator-connection is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Unable to connect to the server. Contact ... with the following error (no error text available)

1: Via Third party proxy, Workspace report error when launching ICA file "Unable to connect to the server. Contact your systemadministator with the following error no error text available". 2: By PassThird party proxy,Workspace launching ICA file is successful...

Jenkins Plugin Beaker 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker could use this vulnerability to connect to a specified URL by...

CLSA-2022-1655819051 Fixed CVE-2022-22576 in curl

CVE-2022-22576: check additional SASL parameters for connection reuse...

PT-2022-3301

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.0.0 through 3.0.3 OpenSSL versions 1.1.1 through 1.1.1o OpenSSL versions 1.0.2 through 1.0.2ze Description The issue is related to improper encryption and potential buffer overflow, allowing a remote attacker to obtain...

Malicious code in jetpack-connection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80ccf01e2a373a2de8badfc143620e55dd5cd5d206f90ccb4055dc32df4883fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4025 Malicious code in jetpack-connection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80ccf01e2a373a2de8badfc143620e55dd5cd5d206f90ccb4055dc32df4883fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in generator-connection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b345a8a1a86ee085f16d78670da372a22461e5135ffd1e0f252cb45ca2985bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3331 Malicious code in generator-connection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b345a8a1a86ee085f16d78670da372a22461e5135ffd1e0f252cb45ca2985bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PVS Wizard fails to connect to Cloud

In the process of using a PVS Wizard, after entering your credentials to connect to Citrix Cloud, you might see this error: "Cannot connect to the Citrix Virtual Desktops Controller at : Citrix Virtual Desktops FullAdmin or MachineAdmin permission required." Following the below steps 1. If Remote...

EulerOS 2.0 SP5 : 389-ds-base (EulerOS-SA-2022-1881)

According to the versions of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to...