KLA20032 SB vulnerability in Apache Tomcat

Security vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories Apache Tomcat 9.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2022-42252 critical Solution Update to the latest version Tomcat 9.0...

KLA19264 Multiple vulnerabilities in Microsoft Server Software

Multiple vulnerabilities were found in Microsoft Server Software. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Microsoft Exchange Server can be exploited...

Malicious users can provide liquidity on behalf of others to keep others in the liquidity cooldown

Lines of code Vulnerability details Impact In the AlgebraPool contract, when the user provides liquidity via the mint function, the lastLiquidityAddTimestamp is updated to the current time. position.liquidity, position.lastLiquidityAddTimestamp = liquidityNext, liquidityNext 0 ? liquidityDelta 0 ...

KLA19255 SUI vulnerability in Microsoft System Center

A spoofing vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2022-37972 Related products Microsoft-Endpoint-Configuration-Manager CVE list CVE-2022-37972 critical KB list Solution Install necessary...

Harbor fails to validate the user permissions when viewing Webhook policies

Impact Harbor fails to validate the user permissions to view Webhook policies including relevant credentials configured in different projects the user doesn’t have access to, resulting in malicious users being able to read Webhook policies of other users/projects. API call is GET...

GHSA-JF8P-3VJH-PQ94 Harbor fails to validate the user permissions when viewing Webhook policies

Impact Harbor fails to validate the user permissions to view Webhook policies including relevant credentials configured in different projects the user doesn’t have access to, resulting in malicious users being able to read Webhook policies of other users/projects. API call is GET...

KLA19244 PE vulnerability in Microsoft Azure

An elevation of privilege vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2022-38007 Related products Microsoft-Azure CVE list CVE-2022-38007 critical KB list Solution Install necessary updates from the KB...

KLA15728 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, obtain sensitive information, spoof user interface, cause denial of service. Below is a complete list of vulnerabilities: 1. Memor...

KLA12607 PE vulnerability in Microsoft System Center

An elevation of privilege vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2022-33640 Related products Microsoft-System-Center-Operations-Manager CVE list CVE-2022-33640 critical KB list Solution Install...

Remote Code Execution

unbound is vulnerable to remote code execution. Malicious users is able to trigger continued resolvability of malicious domain names, even after their revocation from the parent zone, via a novel type of the ghost domain names attack that targets child-centric DNS resolvers...

KLA12591 OSI vulnerability in Microsoft Azure

An information disclosure vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2022-35798 Related products Microsoft-Azure CVE list CVE-2022-35798 warning KB list Solution Install necessary updates from...

CVE-2022-31107 Grafana account takeover via OAuth vulnerability

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of...

KLA12585 OSI vulnerability in Microsoft Dynamics

An information disclosure vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2022-30187 Related products Microsoft-Azure CVE list CVE-2022-30187 warning KB list Solution Install necessary updates...

KLA12583 SUI vulnerability in Microsoft System Center

A tampering vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2022-33637 Related products Microsoft-Defender-for-Endpoint-for-Windows CVE list CVE-2022-33637 high KB list Solution Install necessary...

Design/Logic Flaw

Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the reques...

KLA12562 RCE vulnerability in Microsoft SQL Server

A remote code execution vulnerability was found in Microsoft SQL Server. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2022-29143 Related products Microsoft-SQL-Server Microsoft-Azure CVE list CVE-2022-29143 unknown KB list 5014354 5014353 50153...

KLA12567 RCE vulnerability in Zoom

Remote code execution vulnerability was found in Zoom. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories Zoom Security Bulletin CVE list CVE-2022-22788 unknown Solution Update to the latest version Download Zoom Impacts ACE Arbitrary code execution...

Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfilteredhtml is disallowed for example in multisite setup PoC Put the following payload in the...

KLA12550 RCE vulnerability in Microsoft Products (ESU)

A remote code execution vulnerability was found in Microsoft Products Extended Security Update. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2022-30190 Exploitation Public exploits exist for this vulnerability. Malware exists for this...

CVE-2022-30584

Archer Platform 6.3 before 6.11 6.11.0.0 contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited by malicious users to compromise the affected system. 6.10 P3 6.10.0.3 and 6.9 SP3 P4 6.9.3.4 are also fixed releases...