OPENSUSE-SU-2022:10099-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 104.0.5112.101 boo1202509: CVE-2022-2852: Use after free in FedCM CVE-2022-2854: Use after free in SwiftShader CVE-2022-2855: Use after free in ANGLE CVE-2022-2857: Use after free in Blink CVE-2022-2858: Use after free in Sign-In Flow...

thunderbird security update

91.13.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build 91.13.0-1 - Update to 91.13.0 build1...

EulerOS 2.0 SP8 : curl (EulerOS-SA-2022-2217)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections...

Improper access control

The KUKA SystemSoftware V/KSS in versions prior to 8.6.5 is prone to improper access control as an unauthorized attacker can directly read and write robot configurations when access control is not available or not enabled default...

Medium: kernel-livepatch-4.14.276-211.499

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.276-211.499 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.276-211.499 or yum update --advisory ALAS2LIVEPATCH-2022-091 to update your system. New...

PT-2022-14855 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.7 through 15.0.4 GitLab CE/EE versions 15.1 through 15.1.3 GitLab CE/EE versions 15.2 through 15.2.0 Description: The issue is related to an improper access control check, allowing a malicious authenticated user to vi...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2022-2128)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2022-2153)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections...

CVE-2022-21505

In the linux kernel, if IMA appraisal is used with the "imaappraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "imaappraise=log" from the boot param when Secure Boot is enabled, but this does not cover case...

Design/Logic Flaw

On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "isadmin", "showConfig". Administrative Privileges which allows changing various configuration in the camera...

Cellinx NVT IP PTZ 安全漏洞

Cellinx NVT IP PTZ is a camera device from Cellinx Korea. A security vulnerability exists in Cellinx NVT IP PTZ, where an attacker can elevate web access to administrative privileges and allow changes to various camera configurations by modifying the following cookie values "isadmin", "showConfig...

ALPINE-CVE-2022-35409

An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information...

Oracle Linux 9 : curl (ELSA-2022-5245)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5245 advisory. - fix too eager reuse of TLS and SSH connections CVE-2022-27782 - fix leak of SRP credentials in redirects CVE-2022-27774 - fix credential leak on...

netty: Information disclosure via the local system temporary directory

In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the...

Exploit for Uncontrolled Resource Consumption in Quic-Go_Project Quic-Go

QUIC-attacks CVE-2022-30591 The current repository serves t...

GSD-2022-1003151 scsi: lpfc: Fix call trace observed during I/O with CMF enabled

scsi: lpfc: Fix call trace observed during I/O with CMF enabled This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

GSD-2022-1002840 scsi: lpfc: Fix call trace observed during I/O with CMF enabled

scsi: lpfc: Fix call trace observed during I/O with CMF enabled This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.3 by commit...

CVE-2022-30562

If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page...

CVE-2022-30562

If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page...

DEBIAN-CVE-2022-31085

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by...