PT-2022-19972

Name of the Vulnerable Software and Affected Versions Rescue Dispatch Management System version 1.0 Description The issue is related to Incorrect Access Control. It can be exploited via the API endpoint "http://localhost/rdms/admin/?page=system info". Recommendations For Rescue Dispatch Managemen...

CVE-2022-0303

No description is available for this CVE...

Information Disclosure

thunderbird is vulnerable to information disclosure. The parent process does not properly check whether the speech synthesis feature is enabled when receiving instructions from a child process...

PT-2022-38124

Уязвимость функции bond ethtool get ts info модуля drivers/net/bonding/bond main.c драйвера поддержки сетевых устройств ядра операционной системы Linux связана с переполнением буфера на основе стека. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

OESA-2022-1660 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: Insufficient control flow management for the IntelR 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.CVE-2021-33061 A use after free in the Linux...

CVE-2022-24823

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled. Mitigation As a workaround, speci...

iPhones Vulnerable to Attack Even When Turned Off

Attackers can target iPhones even when they are turned off due to how Apple implements standalone wireless features Bluetooth, Near Field Communication NFC and Ultra-wideband UWB technologies in the device, researchers have found. These features—which have access to the iPhone’s Secure Element SE...

new packages: shared-mime-info

An update is available for shared-mime-info. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

new packages: container-tools

An update is available for container-tools. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

GHSA-2CH8-F849-PJG3 Eugene Pankov Ajenti Cross-site scripting Vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in the responderror function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 resources.js or 2 resources.css in ajenti:static/, related to the traceback page...

Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

GHSA-6P8H-36QP-8H72 Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the Static Info Tables staticinfotables extension before 2.3.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the Static Info Tables staticinfotables extension before 2.3.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2022-19147 · Apport +2 · Apport +2

Name of the Vulnerable Software and Affected Versions: Apport affected versions not specified Description: The issue is related to Apport not disabling the python crash handler before entering chroot. This could potentially lead to unintended consequences, although specific details about the impa...

CVE-2022-23670

A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...

Zyxel Firewall ZTP Unauthenticated Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zyxel Firewall ZTP Unauthenticated Command Injection', 'Description' = %q This module exploits CVE-2022-30525, an unauthenticated remote command...

GHSA-89C9-3758-737W keycloak-httpd-client-install Insecure Secrets

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users...

CVE-2021-33013

The CVE-2021-33013 vulnerability affects mySCADA myPRO prior to version 8.20.0, where an improper access control allows unauthenticated read access to sensitive system information. This is documented across multiple sources (NVD entry and ICSA briefing) with CVSS v3 base score up to 8.2 (HIGH) an...

CVE-2021-33083

CVE-2021-33083 : Improper authentication in firmware for Intel® SSD and Intel® Optane™ SSD/SSD DC products may allow a privileged user to disclose information via local access. Intel’s advisory (Intel® Optane™ SSD Firmware Advisory, CVE-2021-33083) confirms the root cause in firmware authenticati...

Everything We Learned From the LAPSUS$ Attacks

In recent months, a cybercriminal gang known as LAPSUS$ has claimed responsibility for a number of high-profile attacks against technology companies, including: T-Mobile April 23, 2022 Globant Okta Ubisoft Samsung Nvidia Microsoft Vodafone In addition to these attacks, LAPSUS$ was also able to...