5828 matches found
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
A vulnerability was found in SSSD, in the libssscertmap functionality. PKINIT enables a client to authenticate to the KDC using an X.509 certificate and the corresponding private key, rather than a passphrase or keytab. FreeIPA uses mapping rules to map a certificate presented during a PKINIT...
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
A vulnerability was found in SSSD, in the libssscertmap functionality. PKINIT enables a client to authenticate to the KDC using an X.509 certificate and the corresponding private key, rather than a passphrase or keytab. FreeIPA uses mapping rules to map a certificate presented during a PKINIT...
Deletion on mapping containing a structure
Lines of code Vulnerability details Impact A deletion in a structure containing a mapping will not delete the mapping. The remaining data may be used to compromise the contract. Proof of Concept BasketHandler.sol: 219: delete config.targetAmtsconfig.erc20si; 220: delete...
CISA Updates Best Practices for Mapping to MITRE ATT&CK®
Today, CISA updated Best Practices for MITRE ATT&CK® Mapping. The MITRE ATT&CK® framework is a lens through which network defenders can analyze adversary behavior and, as CISA Executive Assistant Director Eric Goldstein noted in his June 2021 blog post on the framework, it directly supports...
Reuse of signature to get KYCd after it has been removed
Lines of code Vulnerability details Impact There is no time limit on the validity off KYC digests and users with a removed KYC are not saved. If a issuer of such a digest is either compromised or if they by mistake issue a digest with a deadline far into the future a user could reuse the same...
tigervnc bug fix and enhancement update
An update is available for tigervnc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Virtual Network Computing VNC is a remote display system which allows users ...
virt-who bug fix and enhancement update
An update is available for virt-who. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The virt-who service collects information about the connection between the...
CVE-2021-26396
Insufficient validation of address mapping to IO in ASP AMD Secure Processor may result in a loss of memory integrity in the SNP guest...
Input validation
Insufficient validation of address mapping to IO in ASP AMD Secure Processor may result in a loss of memory integrity in the SNP guest...
AMD Secure Encrypted Virtualization 安全漏洞
AMD Secure Encrypted Virtualization is a software application from UltraMicroelectronics AMD. Hardware-accelerated memory encryption to protect data in use. AMD Secure Encrypted Virtualization suffers from a security vulnerability that stems from insufficient boundary checking. An attacker exploi...
CVE-2021-26396
The CVE-2021-26396 issue affects the AMD Secure Processor (ASP) where insufficient validation of address mapping to IO can lead to loss of memory integrity in the SNP guest. The entry is supported by multiple sources (NVD/NCSC AMD SB) detailing the vulnerability and its scope across AMD EPYC gene...
CVE-2021-26396
Insufficient validation of address mapping to IO in ASP AMD Secure Processor may result in a loss of memory integrity in the SNP guest...
AMD Server Vulnerabilities – January 2023
Bulletin ID: AMD-SB-1032 Potential Impact: Varies by CVE, see descriptions below Severity: Varies by CVE, see descriptions below Summary During security reviews in collaboration with Google, Microsoft, and Oracle, potential vulnerabilities in the AMD Secure Processor ASP, AMD System Management Un...
CVE-2022-43972
A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware = 4.30.18.006. A null pointer dereference in the soapaction function within the upnp binary can be triggered by an unauthenticated attacker via a malicious POST request invoking the...
CVE-2022-25746
Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping...
Memory corruption
Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping...
PT-2023-14414 · Linksys · Linksys Wrt54Gl Wireless-G Broadband Router
Name of the Vulnerable Software and Affected Versions: Linksys WRT54GL Wireless-G Broadband Router versions = 4.30.18.006 Description: A null pointer dereference issue exists in the soap action function within the upnp binary. This can be triggered by an unauthenticated attacker via a malicious...
nlgis2 SQL注入漏洞
nlgis2 is an open source mapping feature project for Dutch cities by Social History Services. nlgis2 suffers from a SQL injection vulnerability. An attacker exploits this vulnerability to perform a sql injection attack...
CVE-2022-25746
CVE-2022-25746 concerns a kernel memory corruption issue tied to the memextent mapping. The root cause, as reported in multiple sources, is missing checks when updating the access rights of a memextent mapping, which enables memory corruption. Documented impact indicates high-severity effects wit...
