Security Bulletin: The IBM® Engineering Lifecycle Engineering products using IBM WebSphere Application Server Liberty is vulnerable to an Information Disclosure (CVE-2022-22393)

Summary IBM WebSphere Application Server Liberty is vulnerable to an information disclosure with the adminCenter-1.0 feature enabled. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been addressed in this bulletin. Global Configuration Management GC...

Security Bulletin: The IBM® Engineering Lifecycle Engineering products using Liberty are vulnerable to denial of service due to GraphQL Java CVE-2022-37734

Summary The IBM® Engineering Lifecycle Engineering products using Liberty are vulnerable to denial of service due to GraphQL Java, affected features are mpGraphQL-1.0 or mpGraphQL-2.0 . Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products...

HCL多款产品 输入验证错误漏洞

HCL BigFix Compliance etc are products of HCL India.HCL BigFix Compliance is HCL BigFix Lifecycle is a single agent, single console technology.HCL BigFix Remediate is an application. An input validation error vulnerability exists in various HCL products.The vulnerability stems from incorrect inpu...

HCL多款产品 安全漏洞

HCL BigFix Compliance etc are products of HCL India.HCL BigFix Compliance is HCL BigFix Lifecycle is a single agent, single console technology.HCL BigFix Remediate is an application. A security vulnerability exists in several HCL products that stems from vulnerability to man-in-the-middle attacks...

SUSE-SU-2022:4594-1 Security update for supportutils

This update for supportutils fixes the following issues: Security issues fixed: - Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt bsc1203818 Bug fixes: - Added lifecycle information - Fixed KVM virtualization detection on bare metal bsc1184689 - Added logging using...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in components of IBM i Modernization Engine for Lifecycle Integration as described in the Vulnerability Details section. FasterXML jackson-databind, Keycloak, and SnakeYAML are vulnerable to a denial of service CVE-2022-25857, CVE-2022-38751,...

CVE-2022-41273

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim with a manipulated link that appears to be a legitimate SAP...

CVE-2022-41273

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim with a manipulated link that appears to be a legitimate SAP...

Input validation

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim with a manipulated link that appears to be a legitimate SAP...

PT-2022-25782 · Sap · Sap Sourcing +1

Name of the Vulnerable Software and Affected Versions: SAP Sourcing and SAP Contract Lifecycle Management version 1100 Description: The issue arises from improper input sanitization, allowing an attacker to redirect a user to a malicious website. The attack is performed by sending an email with a...

SAP Sourcing和SAP Contract Lifecycle Management 1100 输入验证错误漏洞

SAP Sourcing and SAP Contract Lifecycle Management are both products of SAP, an in-house application that provides an end-to-end solution for the procurement process. SAP Sourcing is an on-premise application that provides an end-to-end solution for the procurement process.SAP Contract Lifecycle...

Rocket Software TRUfusion 代码问题漏洞

Rocket Software TRUfusion is a simple, cost-effective solution from Rocket Software USA, Inc. It is used to ensure the secure exchange of CAD files and design data in PLM systems. A security vulnerability exists in Rocket Software TRUfusion Enterprise versions prior to 7.9.6.1. An attacker could...

SUSE-SU-2022:4278-1 Security update for supportutils

This update for supportutils fixes the following issues: Security issues fixed: - Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt bsc1203818 Bug fixes: - Added lifecycle information - Fixed KVM virtualization detection on bare metal bsc1184689 - Added logging using...

Code injection

knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...

CVE-2022-41939

CVE-2022-41939 affects knative.dev/func (client library/CLI for Knative functions). The root issue is credential exposure when using third-party function buildpacks, where a compromised buildpack could expose registry credentials or the local Docker socket to a malicious lifecycle container. The ...

PT-2022-26170 · Unknown · Knative.Dev/Func

Name of the Vulnerable Software and Affected Versions: knative.dev/func versions prior to 1.8.1 Description: The issue affects developers using malicious or compromised third-party buildpacks, potentially exposing their registry credentials or local docker socket to a malicious lifecycle containe...

CVE-2022-41939 Credential exposure when running third-party builders in knative/func

knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...

Node operators cannot withdraw their ETH when they rage quit

Lines of code Vulnerability details Node operators can opt for Rage Quit, after the BLS public key is staked. In the current configuration, they will not be able to retrieve their staked ETH: withdrawETHForKnot will revert here if the lifecycle status is not INITIALSREGISTERED. The lifecycle stat...

Users of StakingFundsVault can never redeem their LP token once staking has started

Lines of code Vulnerability details The burnLPToken of a Fees & MEV vault allow users to burn LP tokens in exchange of ETH. Quoting the documentation Every user has a right to leave the LSD network at anytime. A depositor/staker can simply sell their LP tokens to someone else or burn to redeem ET...

OESA-2022-2070 kernel security update

Security Fixes: The vulnerability is a use-after-free that happens when an iouring request is being processed on a registered file and the Unix GC runs and frees the iouring fd and all the registered fds. The order at which the Unix GC processes the inflight fds may lead to registered fds be free...