GSD-2022-1005454 net/mlx5: Avoid false positive lockdep warning by adding lock_class_key

net/mlx5: Avoid false positive lockdep warning by adding lockclasskey This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.64 by commit...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-25897

The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

CVE-2022-1522

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which allows an attacker to create false logs that show the password as having been changed when it is not, complicating forensics...

Input validation

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which allows an attacker to create false logs that show the password as having been changed when it is not, complicating forensics...

CVE-2022-1522

CVE-2022-1522 affects Cognex 3D-A1000 Dimensioning System firmware 1.0.3 (3354) and earlier. The vulnerability is CWE-117: Improper Output Neutralization for Logs, enabling an attacker to forge log entries that falsely indicate a password change, complicating forensics. Connected advisories confi...

Cognex 3D-A1000 Dimensioning System

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely, low attack complexity Vendor: Cognex Equipment: 3D-A1000 Dimensioning System Vulnerabilities: Missing Authentication for Critical Function, Improper Output Neutralization for Logs, Client-side Enforcement of Server-side Security 2...

CVE-2022-1522: Improper Output Neutralization for Logs

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which allows an attacker to create false logs that show the password as having been changed when it is not, complicating forensics...

Exploit for Missing Authorization in Redis

CVE-2022-0543 Fully featured exploit for Redis RCE through Lua...

Final Thoughts on Ubiquiti

Last year, I posted a series of articles about a purported "breach" at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press. As a result of the new...

CVE-2021-43767

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's...

CVE-2021-43767

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's...

CVE-2021-43767: Insufficiently Protected Credentials

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's...

PT-2022-4447 · Unknown · Node-Opcua

Name of the Vulnerable Software and Affected Versions: node-opcua versions prior to 2.74.0 Description: The issue is related to a Denial of Service DoS condition that can be triggered by bypassing limitations for excessive memory consumption. This can be achieved by sending multiple CloseSession...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2022:2877-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2877-1 advisory. - Updated to 1.10.1 jscSLE-23879: - CVE-2022-35929: Fixed an issue where cosign verify-attestation --type...

SUSE-SU-2022:2877-1 Security update for cosign

This update for cosign fixes the following issues: - Updated to 1.10.1 jscSLE-23879: - CVE-2022-35929: Fixed an issue where cosign verify-attestation --type could report false positives when there was at least one attestation with a valid signature and there were no attestations of the type being...

CVE-2022-24298

All versions of package freeopcua/freeopcua are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

Denial of Service (DoS)

Overview node-opcua is an implementation of a OPC UA stack fully written in javascript and nodejs Affected versions of this package are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the...

Virtuozzo Hybrid Infrastructure 5.2 Hotfix 1 (5.2.0-141)

This update provides important fixes for the compute service. Vulnerability id: VSTOR-56942 If a virtual machine is connected to a VLAN-based physical network, the VM may have no network connectivity after its migration due to a missing ARP announcement. Vulnerability id: VSTOR-56792, VSTOR-56789...