CVE-2022-27656

The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager ICM does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Design/Logic Flaw

Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious code with higher privileges. This issue affects: ESET, spol. s r.o. ESET NOD32 Antivirus 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o...

Internet Bug Bounty: CVE-2022-30115: HSTS bypass via trailing dot

Advisory: https://curl.se/docs/CVE-2022-30115.html Original Report: https://hackerone.com/reports/1557449 Impact HSTS bypass...

Internet Bug Bounty: CVE-2022-27780: percent-encoded path separator in URL host

Advisory: https://curl.se/docs/CVE-2022-27780.html Original Report: https://hackerone.com/reports/1553841 Impact URL filter bypasses...

Internet Bug Bounty: CVE-2022-27779: cookie for trailing dot TLD

Published Advisory: https://curl.se/docs/CVE-2022-27779.html Original Report: https://hackerone.com/reports/1553301 Impact This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain. ie. conduct session fixation attacks...

Cisco RV340 SSL VPN Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco RV340 SSL VPN Unauthenticated Remote Code Execution', 'Description' = %q This module exploits a stack buffer overflow in the Cisco RV serie...

CVE-2022-22774

The DOM XML parser and SAX XML parser components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server, and TIBCO Managed File Transfer Internet Server contains an easily exploitable vulnerabili...

kernel: information leak in the IPv6 implementation

An information leak flaw was found in the Linux kernel’s IPv6 implementation in the ipv6selectident in net/ipv6/outputcore.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information...

kernel: information leak in the IPv6 implementation

An information leak flaw was found in the Linux kernel’s IPv6 implementation in the ipv6selectident in net/ipv6/outputcore.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information...

kernel: IPv6: panic in fib6_rule_suppress when fib6_rule_lookup fails

A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6rulelookup, sometimes holding rt6info and other times fib6info. This was not accounted for in other parts of the code where rt6info was expected unconditionally, potentially leading to a kerne...

“Chemical attack” email warnings deliver Jester Stealer malware

Jester Stealer, a malicious file capable of large amounts of data theft, is on the prowl again. The Ukrainian Computer Emergency Response Team CERT-UA has warned of a large distribution campaign abusing a "chemical attack" theme. Receiving an email like this in the invasion-affected regions of...

ALSA-2022:2092 Moderate: bind security, bug fix, and enhancement update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. The following...

portal.stretchinternet.com Cross Site Scripting vulnerability OBB-2613650

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

多款TIBCO Software产品代码问题漏洞

TIBCO Software Managed File Transfer Command Center and TIBCO Software Managed File Transfer Internet Server are both products of TIBCO Software, Inc.TIBCO Software Managed File Transfer Command Center is an enterprise file transfer management solution. TIBCO Software Managed File Transfer Comman...

Fedora: Security Advisory for seamonkey (FEDORA-2022-7c0f2c2d67)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 7 / 8 : olcne / istio / istio (ELSA-2022-9362)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9362 advisory. - Addresses CVE-2022-24726, CVE-2022-24921 istio Tenable has extracted the preceding description block directly from the Oracle Linux security...

多款ESET产品安全漏洞

ESET Smart Security Premium and others are products of ESET Slovakia.Smart Security Premium is a suite of antivirus programs.Internet Security is a suite of antivirus programs for Internet security.Eset Endpoint Antivirus and others are products of Eset Slovakia.Eset Endpoint Antivirus is an...

How to remove Google from your life

Swearing off a company used to be easier. Rude customer service, an unfortunate bout of food poisoning, even standing up for workers’ rights against the alleged involvement of a private company to order a country’s military to brutally quash a strike—almost every facet of an individual boycott...

CVE-2021-37851

Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious code with higher privileges. This issue affects: ESET, spol. s r.o. ESET NOD32 Antivirus 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o...

A week in security (May 2 – 8)

Last week on Malwarebytes Labs: Google, Apple, and Microsoft step hand in hand into a passwordless future OpenSea warns of Discord channel compromise Avoid these Instagram “Get rich with Bitcoin” scams Steer clear of fake premium mobile app unlockers How Instagram scammers talk users out of their...