Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with Asset and Service Management

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Aviation, Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation,...

PT-2022-33832 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.61 Description: The issue concerns an optimization in clearing the pending PMI and removal of a WARN ON for PMI check in power pmu disable. The actual impact and attack plausibility have not yet been prove...

Dell Client BIOS Multiple Vulnerabilities (DSA-2022-224)

The Dell BIOS on the remote device is missing a security patch and is, there, is affected by multiple vulnerabilities. - Dell BIOS versions contain a stack-based buffer overflow vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI to bypass security...

An arbitrary file reading vulnerability exists in SANGFOR Internet Optimization Management System of Deep Impact Technology Co.

SANGFOR Internet optimization management system is a security product that integrates Internet behavior management, network access, device access and business access behavior analysis. Core advantages: multiple authentication methods, comprehensive audit capability, support for multiple applicati...

Enhancing Cloud Security by Reducing Container Images Through Distroless Techniques

We analyzed the Distroless technique for reducing the size of container images and explored its capabilities to address security concerns. We provide an alternative approach to Distroless that reduces the attack surface for malicious actors targeting cloud-native applications while optimizing clo...

CVE-2022-26861

Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM...

Design/Logic Flaw

Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM...

CVE-2022-26861

Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM...

CVE-2022-26861

Dell BIOS firmware contains an Insecure Automated Optimization vulnerability (CVE-2022-26861) that allows a locally authenticated attacker to trigger arbitrary code execution during System Management Mode (SMM) by sending malicious input via SMI. The issue is tied to the BIOS/SMM trust boundary, ...

CVE-2022-26861

Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM...

PT-2022-18111 · Dell · Dell Bios

Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is related to an Insecure Automated Optimization vulnerability in Dell BIOS. A local authenticated malicious user could exploit this vulnerability by sending malicious input via...

CVE-2020-35537

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2022-8940 · Gnu · Gcc

Name of the Vulnerable Software and Affected Versions: gcc affected versions not specified Description: A crafted input source file could cause g++ to crash during compilation when provided certain optimization flags. The issue is related to the ipcp store vr results function in gcc/ipa-cp.c...

CVE-2020-35537

In gcc, a crafted input source file could cause g++ to crash during compilation when provided certain optimization flags. The problem resides in the ipcpstorevrresults function in gcc/ipa-cp.c...

Pushing Open-Source Security Forward: Insights From Black Hat 2022

Open-source security has been a hot topic in recent years, and it's proven to be something of a double-edged sword. On the one hand, there's an understanding of the potential that open-source tools hold for democratizing security, making industry best practices accessible to more organizations an...

PT-2022-37184 · Git +1 · Lcms

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read crash. Technical details include the crash type being Heap-buffer-overflow READ 8, and the crash stat...

lcms:cms_transform_all_fuzzer: Heap-buffer-overflow in _cmsMAT3per

Project: https://github.com/mm2/Little-CMS.git Detailed Report: https://oss-fuzz.com/testcase?key=6317156677058560 Project: lcms Fuzzing Engine: libFuzzer Fuzz Target: cmstransformallfuzzer Job Type: libfuzzerasani386lcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

Foxit PDF Editor JavaScript Optimization Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within JavaScript...

CVE-2022-26861

Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM...

Security Bulletin: A Remote Attack Vulnerability in Apache Log4j affects IBM Engineering Lifecycle Optimization - Publishing

Summary There is a Vulnerability in Apache Log4j CVE-2021-44228 which is used by "IBM Engineering Lifecycle Optimization - Publishing PUB" and "Rational Publishing Engine RPE." Vulnerability Details CVEID:CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary...