CLSA-2022-1660761947 Fixed CVE-2022-29154 in rsync

CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server MITM attack - Add '%check unset DISPLAY ' section but disable broken 'daemon' and 'hardlinks' tests...

PT-2022-4239 · Ge Digital · Proficy Machine Edition

Name of the Vulnerable Software and Affected Versions: Proficy Machine Edition versions 9.80 and prior Description: The issue is related to a Path Traversal vulnerability, also known as a ZipSlip attack, which allows attackers to implant a malicious .BLZ file on the PLC through an upload procedur...

CVE-2022-33991

dproxy-nexgen aka dproxy nexgen forwards and caches DNS queries with the CD aka checking disabled bit set to 1. This leads to disabling of DNSSEC protection provided by upstream resolvers...

CVE-2022-33992

DNRD aka Domain Name Relay Daemon 2.20.3 forwards and caches DNS queries with the CD aka checking disabled bit set to 1. This leads to disabling of DNSSEC protection provided by upstream resolvers...

CVE-2022-33992

DNRD aka Domain Name Relay Daemon 2.20.3 forwards and caches DNS queries with the CD aka checking disabled bit set to 1. This leads to disabling of DNSSEC protection provided by upstream resolvers...

Domain Name Relay Daemon 安全漏洞

Domain Name Relay Daemon DNRD is an open source caching and forwarding DNS proxy server from Sourceforge. A security vulnerability exists in DNRD Domain Name Relay Daemon version 2.20.3, which stems from setting the CD aka Check Disabled bit to 1, resulting in the DNSSEC protection provided by th...

dproxy 安全漏洞

dproxy is an intelligent caching DNS proxy by Matthew Pratt, a personal developer. A security vulnerability exists in dproxy that stems from setting the CD aka Check Disabled bit to 1, which causes the DNSSEC protection provided by the upstream resolver to be disabled...

CVE-2022-2372

The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Plugin YaySMTPr 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

GHSA-Q2GP-GPH3-88X9 Keycloak allows arbitrary Javascript to be uploaded for SAML protocol mapper even if UPLOAD_SCRIPTS feature disabled

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wf7g-7h6h-678v. This link is maintained to preserve external references. Original Description An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even...

UBUNTU-CVE-2021-41556

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read in the core interpreter that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all...

UBUNTU-CVE-2018-25045

Django REST framework aka django-rest-framework before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping...

CVE-2022-26138

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit...

CVE-2022-21505

In the linux kernel, if IMA appraisal is used with the "imaappraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "imaappraise=log" from the boot param when Secure Boot is enabled, but this does not cover case...

CVE-2022-2169

The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

LemonLDAP::NG 信任管理问题漏洞

LemonLDAP::NG is a web single sign-on and access management software. A security vulnerability exists in LemonLDAP::NG version 2.0.8, which stems from a default failure to check the validity of X.509 certificates when connecting to a remote LDAP backend, due to the use of the default configuratio...

Citrix ADC MPX/SDX Fortville NIC Err-Disabled when LLDP Is enabled on Peer Switch/Router

If Citrix ADC is connected to a switch/router via Fortville NIC For example 10G port on MPX 8900, interface will show UP for a moment then go to Err-Disabled state. Running "show interface" command on ADC, you can find ADC Fortville NIC is in Err-Disabled State, along with TX Stall andHang counts...

CVE-2022-29271

In Nagios XI through 5.8.5, a read-only Nagios user due to an incorrect permission check is able to schedule downtime for any host/services. This allows an attacker to permanently disable all monitoring checks...

PT-2022-19513 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions 5.8.5 and earlier Description: The issue allows a read-only Nagios user to schedule downtime for any host or services due to an incorrect permission check. This enables an attacker to permanently disable all monitoring...

GSD-2022-1002830 drm/amdgpu/pm: fix the null pointer while the smu is disabled

drm/amdgpu/pm: fix the null pointer while the smu is disabled This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.3 by commit...