CVE-2022-31111

Frontier (Substrate’s Ethereum compatibility layer) is affected by a truncation error when converting between EVM balance type and Substrate balance type. In affected versions this can cause a discrepancy between the appeared EVM transfer value and the actual Substrate value transferred. The issu...

CLSA-2022-1656961923 Fixed CVE-2022-27782 in curl

CVE-2022-27782: add missing checks of ssl and ssh options during matching a connection for reuse...

CLSA-2022-1656961578 Fixed CVE-2022-27782 in curl

CVE-2022-27782: add missing checks of ssl and ssh options during matching a connection for reuse...

curl: TLS and SSH connection too eager reuse

A vulnerability was found in curl. This issue occurs because curl can reuse a previously created connection even when a TLS or SSH-related option is changed that should have prohibited reuse. This flaw leads to an authentication bypass, either by mistake or by a malicious actor...

The vulnerability of the Link Layer Discovery Protocol (LLDP) implementation in Cisco IOS, Cisco IOS XE, and Cisco IOS XR operating systems allows a attacker to execute arbitrary code or cause service interruptions.

The vulnerability of the Link Layer Discovery Protocol LLDP implementation in Cisco IOS, Cisco IOS XE, and Cisco IOS XR systems is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause...

CLSA-2022-1656430448 Fixed CVEs in mod_http2-3.module_el8.5.0+2060+6f259f31: CVE-2022-26377, CVE-2022-30556, CVE-2022-28615, CVE-2022-30522, CVE-2022-31813

CVE-2022-30522: modsed: limit memory usage - CVE-2022-26377: modproxyajp: fix HTTP request smuggling - CVE-2022-28615: fix possible out-of-bounds read in apstrcmpmatch - CVE-2022-30556: modlua: fix r:wsread to not return length that point past the end of the storage allocated for the buffer -...

CVE-2022-28166

In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers ssl-static-key-ciphers on ports 443 & 18082...

The vulnerability of the CLS_PK_KeyGenMT() function in the Rambus SafeZone basic crypto module allows a hacker to calculate private RSA keys from a public key of a TLS certificate.

The vulnerability of the CLSPKKeyGenMT function in the Rambus SafeZone base crypto module is related to the use of insufficiently random values. Exploiting this vulnerability could allow an attacker, operating remotely, to calculate secret RSA keys from the public key of a TLS certificate...

UBUNTU-CVE-2022-32990

An issue in gimplayerinvalidateboundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service DoS...

The vulnerability of the TLS/SSL Server software component for network management in Brocade SANnav allows attackers to enhance their privileges.

The vulnerability of the TLS/SSL Server software component for managing SAN networks in Brocade SANnav systems is related to the presence of static encryption keys on ports 443 and 18082. Exploiting this vulnerability could allow a malicious actor to increase their privileges...

Malicious Package

Overview @uc-maps/layer-select.react is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

WordPress plugin Google Tag Manager cross-site scripting vulnerability

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Google Tag Manager version 1.15 has a cross-site scripting vulnerability that stems from the fact that site searches are n...

June 23, 2022—KB5014665 (OS Build 20348.803) Preview

None None...

MAL-2022-680 Malicious code in @uc-maps/layer-select.react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e16c28c35ea063cec1fb2f23764d6be10526f72c11c42bc40879a61a2383ff0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-6794 · Unknown +3 · Simple Directmedia Layer +3

Name of the Vulnerable Software and Affected Versions: Simple DirectMedia Layer version 1.2 Description: The issue is related to a use-after-free vulnerability in the XFree function of the /src/video/x11/SDL x11yuv.c component of the Simple DirectMedia Layer library. This vulnerability can be...

PT-2022-6747 · Ericsson +6 · Erlang/Otp +6

Name of the Vulnerable Software and Affected Versions: Erlang/OTP versions prior to 23.3.4.15 Erlang/OTP versions 24.x prior to 24.3.4.2 Erlang/OTP versions 25.x prior to 25.0.2 Description: The issue is related to a Client Authentication Bypass in certain client-certification situations for SSL,...

Rundeck plaintext storage vulnerability

Rundeck is an open source automation service with a Web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. versions 4.2.0 and 4.2.1 of Rundeck contain a plaintext storage vulnerability that stems from not properly enabling the Key Storage...

CVE-2022-31044 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created...

CVE-2022-32156

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI...

Rundeck 安全漏洞

Rundeck is an open source automation service with a Web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. versions 4.2.0 and 4.2.1 of Rundeck contain a plaintext storage vulnerability that stems from not properly enabling the Key Storage...