2493 matches found
PT-2022-34586 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.11 Description: The issue is related to an off-by-one error in the unflatten dt nodes function. This error was introduced in version v4.7 and is fixed in version v5.19.11. The actual impact and attack...
PT-2022-34654 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.145 Description: The issue is related to an off-by-one error in the unflatten dt nodes function. This error was introduced in version v4.7 and fixed in version v5.10.145. The actual impact and attack...
booth: authfile directive in booth config file is completely ignored.
A flaw was found in booth in the way it handles the authfile directive in configuration files, which causes authentication to be skipped between nodes. As a result, an attacker-controlled node that does not have the correct authentication key does not prevent communication with other nodes in the...
PT-2022-33860 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.15 through v5.15.60 Description: A potential security issue exists due to an out of bounds access in the get nodes function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Lin...
Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a CRI-O security vulnerability (CVE-2022-1708)
Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kubernetes API. Vulnerability Details CVEID: CVE-2022-1708 Description: A vulnerability was found in CRI-O that causes memo...
Denial Of Service (DOS)
Indynode is vulnerable to Denial of Service DOS. An attacker can max out the connections to the ledger, resulting in Denial of Service. This vulnerability exploits the trade-off between resilience and availability, where any attacker firewall mitigation will restrict legitimate users. It is...
Hyperledger: DOS validator nodes of blockchain to block external connections
Attack was documented in the in the github repo: https://github.com/hyperledger/indy-node/security/advisories/GHSA-x996-7qh9-7ff7 Attack: The attacker sends 500 read requests to each node and opens a new one when holding 500 parallel connections. Every user is able to send read requests since it'...
DRUPAL-CONTRIB-2022-056
This module enables you to set content permissions based on taxonomy terms. The module doesn't sufficiently restrict access to translated and unpublished nodes. This vulnerability is mitigated by the fact that it only affects sites with translated content...
Ubuntu: Security Advisory (USN-124-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Important: Red Hat Security Advisory: Node Health Check Operator 0.3.1 security update
An update for node-healthcheck-operator-bundle-container and node-healthcheck-operator-container is now available for Node Healthcheck Operator 0.3 for RHEL 8. This Operator is delivered by Red Hat Workload Availability. Red Hat Product Security has rated this update as having a security impact o...
Information Disclosure
opcfoundation.netstandard.opc.ua.server is vulnerable to information disclosure. A remote unauthenticated attacker is able to gain access to sensitive user information due to the improper access controls in diagnostic nodes...
Splunk Enterprise and Universal Forwarder < 9.0 Improper Certificate Validation
In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. Splunk peer communications configured properly with valid certificates were not vulnerable...
Emerson DeltaV Distributed Control System Use of Hard-Coded Credentials (CVE-2022-29963)
The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a root shell via hardcoded credentials. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350. - The...
Malicious operators within epoch can not be manually invalidated
Lines of code Vulnerability details Impact Messages are verified and validated by a set of operators. Operators their weights and threshold are defined per epoch and stored as a hash. Transferring operatorship which means creating a new set of valid operators creates a new epoch. Operator sets th...
GSD-2022-1004799 cgroup: Use separate src/dst nodes when preloading css_sets for migration
cgroup: Use separate src/dst nodes when preloading csssets for migration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.253 by commit...
GSD-2022-1004710 cgroup: Use separate src/dst nodes when preloading css_sets for migration
cgroup: Use separate src/dst nodes when preloading csssets for migration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.207 by commit...
GSD-2022-1004585 cgroup: Use separate src/dst nodes when preloading css_sets for migration
cgroup: Use separate src/dst nodes when preloading csssets for migration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.132 by commit...
GSD-2022-1004413 cgroup: Use separate src/dst nodes when preloading css_sets for migration
cgroup: Use separate src/dst nodes when preloading csssets for migration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.56 by commit...
GSD-2022-1004197 cgroup: Use separate src/dst nodes when preloading css_sets for migration
cgroup: Use separate src/dst nodes when preloading csssets for migration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.13 by commit...