SUSE-SU-2022:1164-1 Security update for go1.16

This update for go1.16 fixes the following issues: Update to version 1.16.15 bsc1182345: - CVE-2022-24921: Fixed a potential denial of service via large regular expressions bsc1196732. Non-security fixes: - Fixed an issue with v2 modules go51331. - Fixed an issue when building source in riscv64...

EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers

EvilSelenium is a new project that weaponizes Selenium to abuse Chromium-based browsers. The current features right now are: Steal stored credentials via autofill Steal cookies Take screenshots of websites Dump Gmail/O365 emails Dump WhatsApp messages Download & exfiltrate files Add SSH keys to...

PT-2022-18188

Name of the Vulnerable Software and Affected Versions OpenSIS Classic version 8.0 Description The issue is due to a lack of protection, allowing the student id parameter in the "/modules/eligibility/Student.php" endpoint to be used for injecting SQL queries, which can extract information from...

CVE-2022-27041: Improper Neutralization of Special Elements used in an SQL Command

Due to lack of protection, parameter studentid in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to the lack of protective measures for the structure of web pages, allows attackers to compromise data integrity.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to the disclosure of information in erroneous data areas, allows attackers to gain access to confidential data.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the disclosure of information in the erroneous data area. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

tildearrow Furnace 安全漏洞

The tildearrow Furnace is a multi-system chip tuning tracker compatible with DefleMask modules. A security vulnerability exists in tildearrow Furnace that stems from an incomplete fix for CVE-2022-1211, resulting in a denial of service vulnerability...

CVE-2022-24822 Denial of Service in @podium/layout and @podium/proxy

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74,...

CVE-2021-32984

All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can connect to the PLC and read the project...

CVE-2021-32986

After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is interrupted, the PLC remains unlocked. All subsequent programming connections are allowed without...

CVE-2021-32980

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

CVE-2021-32978

The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00...

CVE-2021-32980

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

Authorization

All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can connect to the PLC and read the project...

Design/Logic Flaw

The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00...

Buffer overflow

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange...

Authentication flaw

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

CVE-2021-32986 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel

After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is interrupted, the PLC remains unlocked. All subsequent programming connections are allowed without...

CVE-2021-32986

The CVE affects Automation Direct CLICK PLC CPU Modules (C0-1x CPUs) with firmware prior to v3.00. The vulnerability is an authentication bypass where, once an authorized user unlocks the PLC, the unlocked state does not timeout and remains usable if the programming software is interrupted; all s...

CVE-2021-32978

The CVE-2021-32978 entry describes a vulnerability in Automation Direct CLICK PLC CPU Modules (C0-1x) with firmware prior to v3.00 where a previously entered password and lock state can be read from the programming protocol, effectively exposing credentials and enabling unlocks if the password wa...