PT-2022-21463 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.4 Description: A logic issue was addressed with improved checks, which may allow an app to gain unauthorized access to Bluetooth. Recommendations: For versions prior to 12.4, update to macOS Monterey 12.4 to resolve...

Puppet uses predictable filenames, allowing arbitrary file overwrite

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise PE Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages...

GHSA-C4MC-49HQ-Q275 Puppet uses predictable filenames, allowing arbitrary file overwrite

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise PE Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages...

Covert Timing Channel in Apache CXF

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

GHSA-F7CR-7C2C-FM8R OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

The ironic-api service in OpenStack Ironic before 4.2.5 Liberty and 5.x before 5.1.2 Mitaka allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the...

OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

The ironic-api service in OpenStack Ironic before 4.2.5 Liberty and 5.x before 5.1.2 Mitaka allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the...

Google Chrome Security Update (stable-channel-update-for-desktop_10-2022-05) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

CWA for Mac 2203: Random Session disconnects

CWA for Mac will disconnect a session at random. Auto connect-back will also fail. SSL connection error - "status 43" will be reported in Citrix Viewer logs | 03-16-2022 | 10:17:48.817 | 2724 | 5 | sslasock.c | 1359 | SSLDecryptPacket | TCTD | TTERROR | doDecryptData failed. status: 43 | 03-16-20...

Google Releases Security Updates for Chrome

Google has released Chrome version 101.0.4951.64 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. CISA encourages users and administrators to review the Chrome Release Note and apply the necessary update. Thi...

CVE-2022-29394

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the macAddress parameter in the function FUN0041b448...

CVE-2022-29394

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the macAddress parameter in the function FUN0041b448...

CVE-2022-29323

D-Link DIR-816 A2v1.10CNB04 was discovered to contain a stack overflow via the MAC parameter in /goform/editassignment...

CVE-2022-29322

D-Link DIR-816 A2v1.10CNB04 was discovered to contain a stack overflow via the IPADDR and nvmacaddr parameters in /goform/form2Dhcpip...

Stack overflow

D-Link DIR-816 A2v1.10CNB04 was discovered to contain a stack overflow via the MAC parameter in /goform/editassignment...

CVE-2022-29323

The CVE-2022-29323 entry affects D-Link DIR-816 A2_v1.10CNB04. A stack/buffer overflow is triggered by the MAC parameter in the /goform/editassignment handler. The vulnerability could allow arbitrary code execution or a system crash, as indicated by the connected records. No remediation or patch ...

CVE-2022-29323

D-Link DIR-816 A2v1.10CNB04 was discovered to contain a stack overflow via the MAC parameter in /goform/editassignment...

Local Information Disclosure Vulnerability in io.netty:netty-codec-http

Description GHSA-5mcr-gq6c-3hq2 CVE-2021-21290 contains an insufficient fix for the vulnerability identified. Impact When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This...

GHSA-269Q-HMXG-M83Q Local Information Disclosure Vulnerability in io.netty:netty-codec-http

Description GHSA-5mcr-gq6c-3hq2 CVE-2021-21290 contains an insufficient fix for the vulnerability identified. Impact When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This...

TOTOLINK N600R 缓冲区错误漏洞

TOTOLINK N600R is a wireless router from TOTOLINK, Taiwan, China. buffer overflow vulnerability exists in TOTOLINK N600R V4.3.0cu.7647B20210106, which originates from the lack of length validation of the macAddress parameter in the FUN0041b448 function . An attacker could exploit this vulnerabili...

Stable Channel Update for Desktop

The Stable channel has been updated to 101.0.4951.64 for Windows, Mac and Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by...