Patch Where it Hurts: Effective Vulnerability Management in 2023

A recently published Security Navigator report data shows that businesses are still taking 215 days to patch a reported vulnerability. Even for critical vulnerabilities, it generally takes more than 6 months to patch. Good vulnerability management is not about being fast enough in patching all...

CVE-2023-22402 Junos OS Evolved: The kernel might restart in a BGP scenario where "bgp auto-discovery" is enabled and such a neighbor flaps

A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service DoS. In a Non Stop Routing NSR scenario, an unexpected kernel restart might be observed if "bgp auto-discovery" is enabled and if there ...

CVE-2023-22402 Junos OS Evolved: The kernel might restart in a BGP scenario where "bgp auto-discovery" is enabled and such a neighbor flaps

A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service DoS. In a Non Stop Routing NSR scenario, an unexpected kernel restart might be observed if "bgp auto-discovery" is enabled and if there ...

APT Topic Summary Report: Cisco Talos Year in Review 2022

State-sponsored or state-aligned advanced persistent threats APTs adapted to the changing geopolitical landscape in 2022. Cisco Talos observed several offensive cyber campaigns linked to several groups stemming from Russia, Iran, China, North Korea, and countries in the Indian subcontinent. These...

Security Bulletin: TADDM affected by multiple vulnerabilities due to JRuby and Hyperic HQ

Summary IBM Tivoli Application Dependency Discovery Manager is vulnerable to denial of service due to use of JRuby CVE-2011-4838 and cross site scripting due to use of Hyperic HQ CVE-2009-2907, CVE-2009-2899 Vulnerability Details CVEID:CVE-2009-2907 DESCRIPTION: Hyperic HQ is vulnerable to...

Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.9 and earlier

Summary This fix upgrades to socket.io 4.5.4, protobuf-java 3.21.9 and nodejs 14.21.1. Vulnerability Details CVEID:CVE-2022-41940 DESCRIPTION: Socket.IO Engine.IO is vulnerable to a denial of service, caused by an uncaught exception flaw. By sending a specially-crafted HTTP request, a remote...

ciadin.com Cross Site Scripting vulnerability OBB-3129138

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: TADDM affected by vulnerabilities in UnZip.

Summary UnZip.exe is used by IBM Tivoli Application Dependency Discovery Manager and is vulnerable to CVE-2021-4217, CVE-2022-0529, CVE-2022-0530 Publicly disclosed vulnerabilities Vulnerability Details CVEID:CVE-2021-4217 DESCRIPTION: Info-ZIP UnZip could allow a remote attacker to execute...

CD MP3 Terminator V2.07 Local Seh Exploit

Exploit Title: CD MP3 Terminator V2.07 Local Seh Exploit Date: 31.12.2022 Vendor Homepage: http://www.cdmp3terminator.com Software Link: https://www.softpedia.com/dyn-postdownload.php/7a9b28e4e4800cd04331f2f3df26259a/63b031ec/7084/4/2 Exploit Author: Achilles Tested Version: 2.07 Tested on: Windo...

CVE-2022-45027

perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address...

Cross site request forgery (csrf)

perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address...

CVE-2022-45027

perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address...

PT-2023-14575 · Perfsonar · Perfsonar

Name of the Vulnerable Software and Affected Versions: perfSONAR versions prior to 4.4.6 Description: The issue arises when perfSONAR performs participant discovery, incorrectly utilizing an HTTP request header value to determine a local address. Recommendations: For versions prior to 4.4.6, upda...

CVE-2022-45027

perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address...

CVE-2022-45027

The CVE-2022-45027 issue affects perfSONAR prior to version 4.4.6. During participant discovery, the software incorrectly uses an HTTP request header value to determine the local address, which can affect how the local endpoint is identified during discovery. The available documents describe this...

PT-2023-1101 · Unknown +6 · Openvswitch +6

Name of the Vulnerable Software and Affected Versions: OpenvSwitch affected versions not specified Description: The issue is related to an out-of-bounds read in Organization Specific TLV found in OpenvSwitch. It can be exploited by sending specially crafted LLDP messages to the vulnerable system,...

CVE-2022-46589

TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstatoption parameter in the toolsnetstat sub41E730 function...

The vulnerability of the Link Layer Discovery Protocol implementation in the microprogrammed software of Cisco Analog Telephone Adapter (ATA) series 190 devices allows a attacker to cause a service failure.

The vulnerability of the Link Layer Discovery Protocol LLDP implementation in the microsoftware of Cisco Analog Telephone Adapter ATA series 190 devices is related to the lack of checks for header field lengths during the processing of LLDP packets. Exploiting this vulnerability can allow a...

The vulnerability of the Cisco Discovery Protocol implementation in the microsoftware of Cisco Analog Telephone Adapter (ATA) series 190 devices allows a perpetrator to cause a service failure.

The vulnerability of the Cisco Discovery Protocol implementation in microprogrammed software for Cisco Analog Telephone Adapter ATA devices of the 190 series is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause servi...

The vulnerability of the implementation of the Cisco Discovery Protocol in the microsoftware of Cisco Analog Telephone Adapter (ATA) series 190 devices allows a perpetrator to execute arbitrary code and trigger a restart of the Cisco Discovery Protocol service.

The vulnerability of the Cisco Discovery Protocol implementation in microprogramming software for Cisco Analog Telephone Adapter ATA devices of the 190 series is related to improper cleaning or release of resources. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...