CVE-2022-45433

Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could get the traceroute results...

CVE-2022-45431

Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unauthenticated restart of remote DSS Server...

CVE-2022-45432

Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unauthenticated search for devices in range of IPs from remote DSS Serve...

CVE-2022-45431

CVE-2022-45431 affects Dahua software products. The vulnerability allows an attacker to cause an unauthenticated restart of the remote DSS Server by sending a crafted packet after bypassing firewall ACLs. Impact is high on availability; no explicit patch/version remediation is provided in the ava...

Dahua software products 授权问题漏洞

Dahua software products are a family of applications from Dahua Corporation of China. A security vulnerability exists in a number of Dahua software products, which can be exploited by an unauthenticated attacker to search for devices within an IP range using a remote DSS server by sending special...

CVE-2022-45434

Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could exploit the victim server to launch ICMP...

CVE-2022-45433

Technical details about CVE-2022-45433 are not publicly provided in the connected documents. No explicit affected products, versions, or fixes are disclosed here. Monitor the sources for updates and official advisories.

CVE-2022-45432

CVE-2022-45432 affects Dahua software products. The issue enables unauthenticated device discovery by bypassing firewall access controls and sending a crafted packet to the vulnerable interface, allowing an attacker to search for devices within an IP range from a remote DSS Server. Public details...

PT-2022-27516 · Dahua · Dahua

Name of the Vulnerable Software and Affected Versions: Dahua software products affected versions not specified Description: The issue allows for unauthenticated and un-throttled ICMP requests on a remote DSS Server. An attacker can bypass the firewall access control policy by sending a crafted...

Cloud Audit: Compliance + Automation

Setting your own standard Today’s regulatory environment is incredibly fractured and extensive. Depending on the industry—and the part of the world your business and/or security organization resides in—you may be subject to several regulatory compliance standards. Adding to the complexity, there ...

GSD-2022-1007417 drm/omap: dss: Fix refcount leak bugs

drm/omap: dss: Fix refcount leak bugs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.220 by commit 9d7af9b1624dd70b67354972d7297429e637209...

GSD-2022-1007283 drm/omap: dss: Fix refcount leak bugs

drm/omap: dss: Fix refcount leak bugs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.150 by commit...

PT-2022-35091 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to refcount leak bugs in the drm/omap dss component. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior ...

Tips for Choosing a Pentesting Company

In today's world of automated hacking systems, frequent data breaches and consumer protection regulations such as GDPR and PCI DSS, penetration testing is now an essential security requirement for organisations of all sizes. But what should you look for when choosing the right provider? The sheer...

PCI DSS Tackles Client-Side Attacks: Everything You Need to Know About Complying With PCI 6.4.3

Client-side attacks often referred to as Magecart attacks have been around since as early as 2015 and dramatically gained in popularity when the global pandemic accelerated digital transformation, by driving more people and data online. Now the fight against these attacks is stepping up a notch...

PCI DSS v4.0: Meeting Emerging Needs for Script Monitoring and Management

PCI DSS v4.0 makes Akamai Client-Side Protection & Compliance essential for any customer that processes or transmits cardholder data...

Low: Red Hat Security Advisory: RHV RHEL Host (ovirt-host) [ovirt-4.5.0] security update

Updated host packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

PCI DSS Compliance : Point-of-Sale (POS) Software Using Default Credentials

The remote host is running a point of sale application which can be accessed via default credentials. The PCI Data Security Standard requires default or vendor-shipped credentials to be changed for point-of-sale PoS devices. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

SSH SHA-1 HMAC Algorithms Enabled (PCI DSS)

The remote SSH server is configured to enable SHA-1 HMAC algorithms. Although NIST has formally deprecated use of SHA-1 for digital signatures, SHA-1 is still considered secure for HMAC as the security of HMAC does not rely on the underlying hash function being resistant to collisions. Note that...

A Bridge Over the Chasm: A Primer on the Release of PCI 4.0

The Payment Card Industry PCI Security Standards Council SSC has just released version 4.0 of the Data Security Standard DSS. Developing DSS 4.0 took almost four years and included several rounds of Request for Comments RFC from Participating Organizations and other interested parties. This new...