SalonERP 3.0.1 SQL Injection

Exploit Title: SalonERP 3.0.1 - 'sql' SQL Injection Authenticated Exploit Author: Betul Denizler Vendor Homepage: https://salonerp.sourceforge.io/ Software Link: https://sourceforge.net/projects/salonerp/files/latest/download Version: SalonERP v3.0.1 Tested on: Ubuntu Mate 20.04 Vulnerable...

In the IPv6 implementation in the Linux kernel before 5.13.3 net/ipv6/output_core.c has an information leak because of certain use of a hash table which although big doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.

...

PT-2022-12304 · Cobbler +2 · Cobbler +2

Name of the Vulnerable Software and Affected Versions: Cobbler versions prior to 3.3.1 Description: An issue was discovered where files in /etc/cobbler are world readable, exposing sensitive information to local users with non-privileged access. The users.digest file contains the sha2-512 digest ...

OPENSUSE-SU-2022:0011-1 Security update for jawn

This update for jawn fixes the following issues: CVE-2022-21653: DoS caused by a hash collision in SimpleFacade and MutableFacade boo1194358...

Description of the security update for Office Web Apps Server 2013: January 11, 2022 (KB5002122)

None None...

Description of the security update for SharePoint Foundation 2013: January 11, 2022 (KB5002129)

Description of the security update for SharePoint Foundation 2013: January 11, 2022 KB5002129 Summary This security update resolves a Microsoft Office remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2022-21840. Not...

Description of the security update for Office 2016: January 11, 2022 (KB5002052)

None None...

Description of the security update for Office Online Server: January 11, 2022 (KB5002107)

None None...

Description of the security update for SharePoint Enterprise Server 2013: January 11, 2022 (KB5002102)

None None...

Description of the security update for Excel 2016: January 11, 2022 (KB5002114)

None None...

Description of the security update for Office 2016: January 11, 2022 (KB5002115)

None None...

In the IPv4 implementation in the Linux kernel before 5.12.4 net/ipv4/route.c has an information leak because the hash table is very small.

...

CVE-2021-36414

creationtimestamp| type| source ---|---|--- 2022-01-11 02:15:07+00:00| seen| https://t.me/cibsecurity/35216...

Denial Of Service (DoS)

org.typelevel, jawn-parser is vulnerable to denial of service. The vulnerability exists through org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade which are not override objectContext, its leads to a hash collision attack and system crash...

GHSA-VC89-HCCF-RQ55 Hash collision in typelevel jawn

Impact Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: org.http...

Hash collision in typelevel jawn

Impact Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: org.http...

Incorrect hash in sha2

The v0.9.7 release of the sha2 crate introduced a new AVX2-accelerated backend which was automatically enabled for all x86/x8664 CPUs where AVX2 support was autodetected at runtime. This backend was buggy and would miscompute results for long messages i.e. messages spanning multiple SHA blocks. T...

GHSA-FC7X-2CMC-8J2G Incorrect hash in sha2

The v0.9.7 release of the sha2 crate introduced a new AVX2-accelerated backend which was automatically enabled for all x86/x8664 CPUs where AVX2 support was autodetected at runtime. This backend was buggy and would miscompute results for long messages i.e. messages spanning multiple SHA blocks. T...

EulerOS Virtualization 3.0.2.6 : openssl098e (EulerOS-SA-2021-2872)

According to the versions of the openssl098e package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length argument in some cases where t...

EulerOS Virtualization 3.0.2.6 : openssl (EulerOS-SA-2021-2874)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length argument in some cases where the...