14890 matches found
CVE-2021-4209
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances. Mitigation Mitigation for this issue is eithe...
PT-2022-2554 · Amazon · Amazon Aws Client Vpn
Name of the Vulnerable Software and Affected Versions: Amazon AWS VPN Client version 2.0.0 Description: The issue is related to the Amazon AWS VPN Client, where it is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for parameters such as auth-user-pass...
PT-2022-2555 · Amazon · Amazon Aws Client Vpn
Name of the Vulnerable Software and Affected Versions: Amazon AWS VPN Client version 2.0.0 Description: An issue exists in the Amazon AWS VPN Client, allowing parameters outside of the allow list to be injected into the configuration file. This can lead to an arbitrary file write as SYSTEM with...
in helloxz/onenav
Description During the comparisons of different variables, PHP will automatically convert the data into a common, comparable type. This makes it possible to compare the number 12 to the string '12' or check whether or not a string is empty by using a comparison like $string == True. This, however...
Information Disclosure
github.com/aws/aws-sdk-go is vulnerable to information disclosure. The vulnerability exists due to the unencrypted md5 plaintext hash in the library's metadata, allowing an attacker who has read access to the encrypted S3 bucket to recover the plaintext without accessing the encryption key...
GHSA-76WF-9VGP-PJ7W Duplicate Advisory: Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6jvc-q2x7-pchv. This link is maintained to preserve external references. Original Description Summary The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker...
Duplicate Advisory: Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6jvc-q2x7-pchv. This link is maintained to preserve external references. Original Description Summary The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker...
PT-2022-17545 · Amazon Web Services · Aws S3 Crypto Sdk
Name of the Vulnerable Software and Affected Versions: AWS S3 Crypto SDK affected versions not specified Description: The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is...
CVE-2021-40360
A vulnerability has been identified in SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions, SIMATIC PCS 7 V9.1 All versions V9.1 SP1, SIMATIC WinCC V15 and earlier All versions V15 SP1 Update 7, SIMATIC WinCC V16 All versions V16 Update 5, SIMATIC WinCC V17 All versions V17 Update 2,...
CVE-2021-40360
A vulnerability has been identified in SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions, SIMATIC PCS 7 V9.1 All versions V9.1 SP1, SIMATIC WinCC V15 and earlier All versions V15 SP1 Update 7, SIMATIC WinCC V16 All versions V16 Update 5, SIMATIC WinCC V17 All versions V17 Update 2,...
CVE-2021-40360
A vulnerability has been identified in SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions, SIMATIC PCS 7 V9.1 All versions V9.1 SP1, SIMATIC WinCC V15 and earlier All versions V15 SP1 Update 7, SIMATIC WinCC V16 All versions V16 Update 5, SIMATIC WinCC V17 All versions V17 Update 2,...
CVE-2021-40360
A vulnerability has been identified in SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions, SIMATIC PCS 7 V9.1 All versions V9.1 SP1, SIMATIC WinCC V15 and earlier All versions V15 SP1 Update 7, SIMATIC WinCC V16 All versions V16 Update 5, SIMATIC WinCC V17 All versions V17 Update 2,...
CVE-2021-40360
Siemens SIMATIC PCS 7 and SIMATIC WinCC contain a vulnerability (CVE-2021-40360) where the password hash of a local account on a remote server can be exposed via a public API, enabling an authenticated attacker to brute‑force and log in. Affected: PCS 7 v8.2–v9.1; WinCC v7.4–v7.5 and v15–v17 (wit...
PT-2022-4092 · Siemens · Simatic Pcs 7 +1
Name of the Vulnerable Software and Affected Versions: SIMATIC PCS 7 versions V8.2 through V9.1 SIMATIC PCS 7 version V9.1 prior to V9.1 SP1 SIMATIC WinCC versions V7.4 through V7.4 prior to V7.4 SP1 Update 19 SIMATIC WinCC versions V7.5 through V7.5 prior to V7.5 SP2 Update 6 SIMATIC WinCC...
CVE-2021-40360: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability has been identified in SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions, SIMATIC PCS 7 V9.1 All versions V9.1 SP1, SIMATIC WinCC V15 and earlier All versions V15 SP1 Update 7, SIMATIC WinCC V16 All versions V16 Update 5, SIMATIC WinCC V17 All versions V17 Update 2,...
AlmaLinux 8 : openssl (ALSA-2021:4424)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4424 advisory. - Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length argument in some cases where the input length is close to...
Description of the security update for Office 2013: February 8, 2022 (KB5002146)
Description of the security update for Office 2013: February 8, 2022 KB5002146 Summary This security update resolves a Microsoft Office graphics remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2022-22003. Note: To...
Description of the security update for SharePoint Server Subscription Edition: February 8, 2022 (KB5002145)
None None...