CVE-2021-39019

IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET request to an authenticated user. IBM X-Force ID: 213728...

CVE-2022-22473

CVE-2022-22473 affects IBM WebSphere Application Server 7.0, 8.0, 8.5 and 9.0 (information disclosure due to improper handling of Administrative Console data). A remote attacker could obtain sensitive information; impact is limited to information disclosure as described. Remediation/fix: apply IB...

CVE-2022-28377

On Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 and OutDoorUnit ODU 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of th...

CVE-2021-26384: Out-of-bounds Read

A malformed SMI System Management Interface command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to out-of-bounds memory reads and writes when triggering an SMI resulting in a potential loss of resources...

WhatsApp warns users: Fake versions of WhatsApp are trying to steal your personal info

WhatsApp boss Will Cathcart is warning users of the popular messaging app to be on their guard after the WhatsApp Security Team discovered bogus apps packing a hidden punch in the form of malware. Outside the safety of the walled garden App stores do whatever they can to try and prevent bogus...

CVE-2022-33676

creationtimestamp| type| source ---|---|--- 2022-07-13 02:31:44+00:00| seen| https://t.me/cibsecurity/46135...

CVE-2022-30187

CVE-2022-30187 concerns the Microsoft Azure Storage Library (client-side encryption) where a padding-oracle/information-disclosure issue could allow a local, authenticated attacker to bypass confidentiality restrictions. Public references describe it as an Authorization/Confidentiality impact in ...

CVE-2022-21845 Windows Kernel Information Disclosure Vulnerability

...

PT-2022-3678 · Microsoft · Windows Fax Service +1

Name of the Vulnerable Software and Affected Versions: Windows Fax Service affected versions not specified Description: The issue is related to incorrect code generation management in the Windows Fax Service, which can be exploited by remote attackers to execute arbitrary code and affect the...

Novastar-VNNOX-iCare Novaicare security vulnerability

Novastar-VNNOX-iCare Novaicare is an application used to centrally monitor the status of LED screen displays by Xi'an Novaicare Technology Co. in China. A security vulnerability exists in Novastar-VNNOX-iCare Novaicare version 7.16.0, which can be exploited by an attacker to elevate privileges an...

Security Bulletin: IBM Security Verify Information Queue uses a dom4j version with improper XXE restrictions (CVE-2020-10683)

Summary The products image in IBM Security Verify Information Queue ISIQ v10.0.2 uses an older version of the dom4j library that does not properly safeguard against XML External Entity XXE attacks. ISIQ v10.0.3 has upgraded its products image to include a newer dom4j level that remediates the...

xml-security: XPath Transform abuse allows for information disclosure

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...

For Finserv Ransomware Attacks, Obtaining Customer Data Is the Focus

Welcome back to the third installment of Rapid7's Pain Points: Ransomware Data Disclosure Trends blog series, where we're distilling the key highlights of our ransomware data disclosure research paper one industry at a time. This week, we'll be focusing on the financial services industry, one of...

PT-2022-21083 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT version 6.0.2 Description: The issue allows attackers to execute arbitrary code via a crafted file, exploiting an arbitrary file upload vulnerability in the Update Branding Settings component. Recommendations: For Snipe-IT version...

Design/Logic Flaw

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can delete import information about a user's company...

CVE-2022-21770

CVE-2022-21770 concerns a vulnerability in the sound driver where a symlink following flaw can lead to local information disclosure, with System execution privileges needed. The NVD entry states an impact on confidentiality, integrity, and availability (C/I/A: Partial/Partial/Partial) and a local...

CVE-2022-21763

CVE-2022-21763 affects the telecom service component; due to a missing permission check, it can disclose local information without extra privileges. Exploitation requires no user interaction. A patch is listed (ALPS07044717/ALPS07044708) and updates are reflected in multiple sources (NVD, Red Hat...

Ignition Library info-get Unauthorized Access

The vulnerability of the info-get guestinfo.ignition.config.data configuration implementation in the Ignition library is related to insufficient protection for service data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

CVE-2022-31599

CVE-2022-31599 affects NVIDIA DGX A100 SBIOS in Ofbd. A local privileged user can cause an uninitialized pointer access, potentially enabling code execution, privilege escalation, DoS, and information disclosure, with impact potentially extending to other components. NVIDIA’s bulletin lists firmw...

PT-2025-26013

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Linux kernel's arm scpi firmware, where the scpi info is not properly handled when the scpi probe fails. This could result in a use-after-free scenario, as th...