Redis 安全漏洞

Redis Labs Redis is Redis Labs, Inc. is a set of open source written in ANSI C, network-enabled, memory-based can also be persistent log-type, key-value Key-Value storage database, and provides a variety of languages API. A security vulnerability exists in Redis. An attacker could exploit this...

ORing Net IAP-420+ 安全漏洞

The ORing Net IAP-420+ is a wireless access point from China Power ORing. A security vulnerability exists in the ORing Net IAP-420+ version 2.0m, which stems from a telnet server that is enabled by default and cannot be permanently disabled, which can be used to connect to the device and obtain a...

PT-2022-23630

Name of the Vulnerable Software and Affected Versions BIG-IP versions 14.1.x through 14.1.5.0 BIG-IP versions 15.1.x through 15.1.6 BIG-IP versions 16.1.x through 16.1.3.0 BIG-IP versions 17.0.x through 17.0.0.0 Description The issue arises when an LTM TCP profile with Auto Receive Window Enabled...

CVE-2022-36795: Incorrect Calculation

In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive Window Enabled is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connectio...

PT-2022-26038 · Unknown · Markdownify

Name of the Vulnerable Software and Affected Versions: Markdownify version 1.4.1 Description: The issue allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the...

Microsoft Patch Tuesday Fixes New Windows Zero-Day; No Patch for Exchange Server Bugs

Microsoft's Patch Tuesday update for the month of October has addressed a total of 85 security vulnerabilities, including fixes for an actively exploited zero-day flaw in the wild. Of the 85 bugs, 15 are rated Critical, 69 are rated Important, and one is rated Moderate in severity. The update,...

CVE-2022-37968

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, becaus...

Microsoft Azure Kubernetes 安全漏洞

Microsoft Azure Kubernetes is a fully managed Kubernetes service from Microsoft Corporation USA. Offers serverless Kubernetes, a consolidated Continuous Integration and Continuous Delivery CI/CD experience, along with enterprise-grade security and governance. Unify development and operations team...

CVE-2022-37968: Undefined Security Weakness

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, becaus...

CVE-2022-37968

CVE-2022-37968 affects Azure Arc‑enabled Kubernetes cluster Connect. An unauthenticated attacker could elevate privileges, potentially obtaining administrative control of the Kubernetes cluster; Azure Stack Edge devices are also affected via Arc. The CVSSv3.1 score is 10.0 (Network, Low/Zero inte...

KLA20004 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Arc-enabled Kubernetes cluster Connect can be...

PT-2022-34774

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.19.6 through v5.19.12 Description The issue is related to an underflow in nft counters enabled at nf tables addchain. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-34814

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.15.64 through v5.15.70 Description The issue is related to an underflow in nft counters enabled at nf tables addchain. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kerne...

PT-2022-34841

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.146 Description The issue is related to an underflow in nft counters enabled at nf tables addchain. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

Canon Medical Vitrea View Cross-Site Scripting Vulnerability

Canon Medical Vitrea View is a DICOM network-enabled enterprise viewing solution from Canon, Japan. A cross-site scripting vulnerability exists in Canon Medical Vitrea View, which is used to visually display DICOM and multimedia images. An attacker could use this vulnerability to execute arbitrar...

CVE-2022-27810

It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode when asserts were enabled. This issue affects Hermes versions prior to v0.12.0...

CVE-2022-2986

Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk...

bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate unexpectedly

A flaw was found in the Bind package, where the resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query. By sending specific queries to the resolver, an attacker can cause named...

CVE-2022-36551

A Server Side Request Forgery SSRF in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling...

Oracle Linux 7 : kubernetes (ELSA-2022-9855)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9855 advisory. - Resolve Kubernetes CVE-2022-3172 for version 1.21 - Resolve Kubernetes CVE-2022-3172 for version 1.22 - Resolve Kubernetes CVE-2022-3172 for version 1.23 -...