The vulnerability of the Layer 2 Tunneling Protocol (L2TP) implementation in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Layer 2 Tunneling Protocol L2TP implementation in Windows operating systems is related to insufficient protection for confidential data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : NVIDIA graphics drivers vulnerabilities (USN-5547-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5547-1 advisory. Le Wu discovered that the NVIDIA graphics drivers did not properly perform input validation in some situations. A local user coul...

CVE-2022-34651

In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate...

F5 BIG-IP 代码问题漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A null pointer dereference vulnerability exists in the F5 BIG-IP TLS 1.3 iRule, which sources when a TLS 1.3 enabled LTM clie...

CVE-2022-31612

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape, where a local user with basic capabilities can cause an out-of-bounds read, which may lead to a system crash or a leak of internal kernel information...

CVE-2022-31607

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko, where a local user with basic capabilities can cause improper input validation, which may lead to denial of service, escalation of privileges, data tampering, and limited information disclosure...

golang: crypto/tls: session tickets lack random ticket_age_add

A flaw was found in the crypto/tls golang package. When session tickets are generated by crypto/tls, it is missing the ticket expiration. This issue may allow an attacker to observe the TLS handshakes to correlate successive connections during session resumption...

Start Menu not responding with User Personalization Layer enabled

Win10 20H2 start menu stops responding to mouse left click...

PT-2022-23022 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.7.2 Description: The issue affects contracts using the cross chain utilities for Arbitrum L2, specifically CrossChainEnabledArbitrumL2 or LibArbitrumL2. These contracts classify direct interactions o...

Transport Layer Security (TLS): Issues & Protocol

Although Transport layer security TLS provides enhanced security, cybercriminals have become increasingly savvy, finding ways to circumvent many of these protections. Learn how malicious actors exploit vulnerabilities within TLS to introduce new forms of malware...

SDL 资源管理错误漏洞

github SDL is a software application. Simple Directmedia Layer A security vulnerability exists in SDL v1.2, which stems from a post-release reuse condition found via the XFree function in /src/video/x11/SDLx11yuv.c. The vulnerability was discovered by using the XFree function in...

CVE-2022-30274

The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are stored after being encrypted with the Tiny Encryption Algorithm TEA in ECB mode using a hardcode...

Hardcoded credentials

The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are stored after being encrypted with the Tiny Encryption Algorithm TEA in ECB mode using a hardcode...

CVE-2022-23000

The Western Digital My Cloud Web App https://os5.mycloud.com/ uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS" or specifying stronger validation,...

Open-Xchange OX App Suite 操作系统命令注入漏洞

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. An operating system command injection vulnerability exists in Open-Xchange OX App Suite versions 7.10.6 and below, which stems from a compatibility layer of the documentconverter API that can b...

Green Alliance NF firewall has information leakage vulnerability

Green Alliance NF Firewall is an enterprise-class next-generation border security product constructed by Green Alliance Technology on the basis of the latest generation 64-bit multi-core hardware platform, combined with the application layer security protection concept and high-speed packet...

CVE-2022-22210

A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on QFX5000 Series and MX Series allows an unauthenticated adjacent attacker to cause a Denial of Service DoS. On QFX5K Series and MX Series, when the PFE receives a specific VxLAN packet the...

CVE-2022-22204

An Improper Release of Memory Before Removing Last Reference vulnerability in the Session Initiation Protocol SIP Application Layer Gateway ALG of Juniper Networks Junos OS allows unauthenticated network-based attacker to cause a partial Denial of Service DoS. On all MX and SRX platforms, if the...

The vulnerability of the Link Layer Discovery Protocol (LLDP) implementation in Cisco IOS, Cisco IOS XE, and Cisco IOS XR operating systems allows a attacker to cause service failures or execute arbitrary code.

The vulnerability of the Link Layer Discovery Protocol LLDP implementation in Cisco IOS, Cisco IOS XE, and Cisco IOS XR systems arises from operations that occur outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

CVE-2022-21562

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware component: Fabric Layer. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite...