3146 matches found
CVE-2022-3312: Missing Authentication for Critical Function
Insufficient validation of untrusted input in VPN in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a local attacker to bypass managed device restrictions via physical access to the device. Chromium security severity: Medium...
CVE-2022-3312
Insufficient validation of untrusted input in VPN in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a local attacker to bypass managed device restrictions via physical access to the device. Chromium security severity: Medium...
CVE-2022-3312
CVE-2022-3312 affects Google Chrome on ChromeOS, where VPN input handling had insufficient validation of untrusted input before version 106.0.5249.62. The underlying issue is in VPN-related code, enabling a local attacker with physical access to bypass managed device restrictions. The evidence co...
Secure your endpoints with Transparity and Microsoft
This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Endpoint protection platforms EPPs are dead and no longer sufficient to protect your organization, right? Wrong. When it comes to cybersecurity, the ability to normalize and correlat...
CVE-2022-31122 Wire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creation
Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attacker has certain details of SAML IdP metadata, and configures their own SAML on the same backend, the attacker can delete all SAML...
AlmaLinux 8 : pcs (ALSA-2022:6314)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:6314 advisory. - A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons...
CVE-2022-20844
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control SD-AVC on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists...
Design/Logic Flaw
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control SD-AVC on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists...
CVE-2022-20844 Cisco Software-Defined Application Visibility and Control on Cisco vManage Static Username and Password Vulnerability
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control SD-AVC on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists...
Cisco Software-Defined Application Visibility and Control on Cisco vManage Static Username and Password (cisco-sa-sdavc-ZA5fpXX2)
According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control SD-AVC on Cisco vManage could allow an unauthenticated, remote attacker to access the GU...
Cisco vManage 访问控制错误漏洞
Cisco vManage is a highly customizable dashboard from Cisco, Inc. that simplifies and automates the deployment, configuration, management, and operation of Cisco SD-WAN. Cisco vManage suffers from an Access Control Error vulnerability that stems from the GUI being accessible on a self-managed clo...
Delete Passwords: Passwordless Connections for Spring Boot Apps to Azure Services
Using username/password credentials to access one application from another presents a huge security risk for many reasons. Today, we are announcing the preview of passwordless connections for Java applications to Azure database and eventing services, letting you finally shift away from using...
PT-2022-5091
Name of the Vulnerable Software and Affected Versions Google Chrome on ChromeOS versions prior to 106.0.5249.62 Description The issue is related to insufficient validation of untrusted input in the VPN extension of Google Chrome, which could allow a remote attacker to disclose protected informati...
Security Bulletin: IBM InfoSphere Guardium Database Activity Monitoring is affected by vulnerabilities in OpenSSL (CVE-2014-0076, CVE-2014-0160)
Abstract Security vulnerabilities have been discovered in OpenSSL that affect a 3rd party Component used by IBM InfoSphere Guardium. Content VULNERABILITY DETAILS: CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the...
Security Bulletin: A security vulnerability in Nodejs follow-redirects affects IBM Cloud Pak for Multicloud Management Managed Services
Summary A security vulnerability in Nodejs follow-redirects affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2022-0536 DESCRIPTION: Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused b...
Security Bulletin: A security vulnerability in Nodejs uglify-js affects IBM Cloud Pak for Multicloud Management Managed Services
Summary A security vulnerability in Nodejs uglify-js affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details IBM X-Force ID: 218243 DESCRIPTION: The Node.js uglify-js module is vulnerable to a denial of service, caused by an error in the stringtemplate and the...
EDR vs MDR vs XDR – What’s the Difference?
Cyberattacks are rapidly evolving, leaving businesses and their IT security teams to handle immense workloads. Keeping up with todays cyberthreats not only involves staying up to date in an ever-changing threat landscape, it also involves managing complex security infrastructure and technologies...
CVE-2022-3225
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20...