Huawei EulerOS: Security Advisory for kexec-tools (EulerOS-SA-2022-2933)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-28118 · Hotcrp · Hotcrp

Name of the Vulnerable Software and Affected Versions: HotCRP affected versions not specified Description: A vulnerability was found in HotCRP, rated as problematic. It affects some unknown functionality and leads to cross-site scripting. The attack can be launched remotely. Recommendations: To f...

PrivateLoader PPI Service Found Distributing Info-Stealing RisePro Malware

The pay-per-install PPI malware downloader service known as PrivateLoader is being used to distribute a previously documented information-stealing malware dubbed RisePro. Flashpoint spotted the newly identified stealer on December 13, 2022, after it discovered "several sets of logs" exfiltrated...

CVE-2019-18177

In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint. This affects Citrix ADC and Citrix Gateway 13.0-58.30 and later releases before the CTX276688 update...

DEBIAN-CVE-2022-47942

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in setntacldacl, related to use of SMB2QUERYINFOHE after a malformed SMB2SETINFOHE command...

CVE-2022-22745

Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...

Ukraine's DELTA Military System Users Under Attack from Info Stealing Malware

The Computer Emergency Response Team of Ukraine CERT-UA this week disclosed that users of the Delta situational awareness program received phishing emails from a compromised email account belonging to the Ministry of Defense. The attacks, which have been attributed to a threat cluster dubbed...

CVE-2022-46530

Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mac parameter at /goform/GetParentControlInfo...

PT-2022-24547 · Netapp · Oncommand Insight

Name of the Vulnerable Software and Affected Versions: OnCommand Insight versions 7.3.1 through 7.3.14 Description: The issue is related to an authentication bypass vulnerability in the Data Warehouse component. Recommendations: For OnCommand Insight versions 7.3.1 through 7.3.14, consider...

Tenda F1203 security vulnerabilities

The Tenda F1203 is a wireless router from China-based Tenda. A security vulnerability exists in the Tenda F1203 firmware version V2.0.1.6, which stems from a mac parameter in its /goform/GetParentControlInfo component that allows an attacker to implement a buffer overflow...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the info method due to improper input sanitization. PoC js const smartctl = require'smartctl'; smartctl.info';touch EXPLOITED;', function; Remediation There is no fixed version for smartctl. References - Vulnerable...

PT-2025-53956

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to TCP socket handling. Specifically, the sk error queue is not properly purged during socket closure, potentially leading to memory leaks and...

PT-2022-26438 · Hcl +1 · Bigfix Platform

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logge...

Out-of-bounds

In MiscService::DoOemSetRtpPktlossThreshold of miscservice.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Information disclosure

In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the notification streaming policy of other users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User...

Information disclosure

In ppmpvalidatesecbuf of drmfw.c, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

PT-2022-14780 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds read in the sec sysmmu info function of drm fw.c due to improper input validation. This could lead to local information disclosure with no additional execution...

CVE-2022-20590

In validvasecmfccheck of drmaccesscontrol.c, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Andro...

CVE-2022-20559

CVE-2022-20559 affects Android 13, describing a side-channel disclosure in revokeOwnPermissionsOnKill within PermissionManager.java that may allow an app to be detected as installed without query permissions. The issue results in local information disclosure with no additional execution privilege...

CVE-2022-46609: Undefined Security Weakness

Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well ...