SUSE SLES12 Security Update : multipath-tools (SUSE-SU-2022:3713-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3713-1 advisory. - CVE-2022-41974: Fixed an authorization bypass issue in multipathd. bsc1202739 - Avoid linking to libreadline to avoid licensing issue...

CVE-2022-36453

A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to control another extension number...

SUSE SLED15: kpartx / libdmmp-devel / libdmmp0_2_0 / libmpath0 / multipath-tools / etc (SUSE-SU-2022:3711-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3711-1 advisory. - CVE-2022-41973: Fixed a symlink attack in multipathd. bsc1202739 - CVE-2022-41974: Fixed an...

SUSE SLES15: kpartx / libdmmp-devel / libdmmp0_2_0 / multipath-tools / etc (SUSE-SU-2022:3709-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3709-1 advisory. - CVE-2022-41973: Fixed a symlink attack in multipathd. bsc1202739 - CVE-2022-41974: Fixed an authorization bypass issue in...

CVE-2022-41974

A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...

CVE-2022-41974

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege...

Cisco TelePresence CE Multiple Vulnerabilities (cisco-sa-roomos-trav-beFvCcyu)

According to its self-reported version, Cisco TelePresence Collaboration Endpoint Software is affected by multiple vulnerabilities: - A vulnerability in Cisco TelePresence CE could allow an authenticated, local attacker to view sensitive information on an affected device. This vulnerability exist...

Securing Applications in a Multicloud World

Widespread adoption of multicloud architecture presents challenges in securing applications. Learn about the benefits of deploying security controls on the edge...

ByteDance Lemon8 安全漏洞

ByteDance Lemon8 is a lifestyle messaging application for young people from China's ByteDance. A security vulnerability exists in ByteDance Lemon8 versions prior to 3.3.5. The vulnerability stems from the fact that it does not have reasonably restricted access privileges, which could allow a remo...

PT-2022-22456 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System version 1.0 Description: A critical issue was found in the Admin Panel component, specifically in the file employeeadd.php, leading to improper access controls. This issue can be exploited...

CVE-2022-3496

CVE-2022-3496 concerns a vulnerability in SourceCodester Human Resource Management System 1.0, affecting the Admin Panel’s file employeeadd.php . The issue is described as an improper access control flaw that can be exploited remotely, with the attack vector labeled as network and low privileges ...

PT-2022-5495 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Group Policy service, allowing a remote attacker to elevate their privileges. Recommendations: At the moment, there i...

PT-2022-5401 · Microsoft · Windows Workstation Service +1

Name of the Vulnerable Software and Affected Versions: Windows Workstation Service affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Workstation Service, allowing a remote attacker to elevate their privileges. This can affect the...

Johnson Controls Metasys ADX Server Licensing Issue Vulnerability

Johnson Controls Metasys ADX Server is a data server from Johnson Controls, Inc. An authorization issue vulnerability exists in Johnson Controls Metasys ADX Server version 12.0, which stems from improper access controls in the application and could be exploited by an attacker to cause an AD user ...

PT-2022-5517 · Microsoft · Windows Dwm Core Library +1

Name of the Vulnerable Software and Affected Versions: Windows DWM Core Library affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows DWM Core Library, which can be exploited to elevate privileges. This allows an attacker to affect th...

PT-2022-5660 · Microsoft · Windows Mixed Reality Developer Tools +1

Name of the Vulnerable Software and Affected Versions: Windows Mixed Reality Developer Tools affected versions not specified Description: The issue is related to insufficient access controls in the system, allowing an attacker to gain unauthorized access to protected information. This can be...

Sensormatic Electronics C-CURE 9000

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc. Equipment: C-CURE 9000 Vulnerability: Observable Response Discrepancy 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

Security Bulletin: Vulnerability in Hibernate Validator affects Liberty for Java for IBM Cloud (CVE-2020-10693)

Summary There is a vulnerability in the Hibernate Validator library used by WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2020-10693 DESCRIPTION: Hibernate Hibernate Validator could allow a remote attacker to bypass security restrictions, caused by a flaw in the message...

Microsoft publishes new report on holistic insider risk management

The risk landscape for organizations has changed significantly in the past few years. The amount of data captured, copied, and consumed is expected to grow to more than 180 zettabytes through 2025.1 Traditional ways of identifying and mitigating risks don’t always work. Historically, organization...

Microsoft publishes new report on holistic insider risk management

The risk landscape for organizations has changed significantly in the past few years. The amount of data captured, copied, and consumed is expected to grow to more than 180 zettabytes through 2025.1 Traditional ways of identifying and mitigating risks don’t always work. Historically, organization...