Insufficient input sanitization on Windows nodes leads to privilege escalation

CVSS Rating: CVSS:3.1/av:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH 8.8 A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Am...

Cisco NX-OS Software DHCP Options Command Injection (CVE-2015-0658)

The DHCP implementation in the PowerOn Auto Provisioning POAP feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589. This...

The vulnerability of the Security and Provisioning component of the Oracle Essbase database management system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Security and Provisioning component of the Oracle Essbase database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through HTTP requests...

SUSE-SU-2023:2916-1 Security update for grafana

This update fixes the following issues: grafana: - Update to version 9.5.5: CVE-2023-3128: Fix authentication bypass using Azure AD OAuth bsc1212641, jscPED-3694 Bug fixes: Auth: Show invite button if disable login form is set to false. Azure: Fix Kusto auto-completion for Azure datasources. RBAC...

Oracle Essbase (July 2023 CPU)

The version of Oracle Essbase installed on the remote host is missing a security patch from the July 2023 Critical Patch Update CPU. It is, therefore, affected by an information disclosure vulnerability in the Security and Provisioning component. This is a difficult to exploit vulnerability that...

CVE-2023-22010

Vulnerability in Oracle Essbase component: Security and Provisioning. The supported version that is affected is 21.4.3.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can...

CVE-2023-22010

The CVE-2023-22010 vulnerability affects Oracle Essbase Security and Provisioning in version 21.4.3.0.0. It is described as a difficult-to-exploit information-disclosure issue that can let a high-privileged attacker with network access over HTTP read a subset of data. Multiple connected sources c...

Hewlett Packard Enterprise Intelligent Provisioning 安全漏洞

Hewlett Packard Enterprise Intelligent Provisioning is a server configuration aid from Hewlett Packard Enterprise. A security vulnerability exists in Hewlett Packard Enterprise Intelligent Provisioning that stems from a local privilege escalation vulnerability...

Oracle Essbase 安全漏洞

Oracle Essbase is an application from Oracle Corporation Oracle. It enables organizations to quickly generate insights from multidimensional data sets using what-if analysis and data visualization tools. A security vulnerability exists in Oracle Essbase that originates in the Security and...

Extreme Networks IQ Engine 安全漏洞

Extreme Networks IQ Engine is an engine from Extreme Networks, Inc. A security vulnerability exists in Extreme Networks IQ Engine versions prior to 10.6r1, which stems from a buffer overflow vulnerability in the execution of the CAPWAP protocol. The vulnerability can be exploited by an attacker t...

kubernetes security update

kubernetes 1.25.11-1 - Added Oracle specific build files for Kubernetes olcne 1.6.2-1 - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11 - Add all modules to registry-image-helper - update yq to 4.x 1.6.1-9 - Updated the CVE ID's in Istio-1.16.4 changelog entry 1.6.1-8 - Update Istio...

CVE-2022-48335

Widevine Trusted Application TA 5.0.0 through 7.1.1 has a PRDiagVerifyProvisioning integer overflow and resultant buffer overflow...

Code injection

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

PT-2023-13273 · Qualcomm · 315 5G Iot Modem Firmware +234

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue is related to memory corruption in a modem caused by a stack-based buffer overflow. This occurs while parsing an OTASP Key Generation Request Message. Recommendations: At...

HPESBHF04484 rev.1 - HPE Smart Storage Administrator (SSA) Offline, Local Arbitrary Code Execution

Potential Security Impact: Local: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Smart Storage Administrator -All Offline versions CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2020-7205 |...

kernel: dm thin: Use last transaction's pmd->root when commit failed

A metadata handling flaw was found in the Linux kernel device-mapper thin provisioning driver. After a failed metadata commit, the in-memory root pointer could reference a mixed set of fresh and stale tree nodes. Subsequent lookups may loop or stall. A local user could use this flaw to cause the...

kernel: dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata

An ABBA deadlock flaw was found in the Linux kernel's device-mapper thin provisioning subsystem between the memory reclaim path and metadata abort handling. A local user can trigger this issue by initiating cache drop operations while dm-thin operations are active, causing process P1 to hold...

The vulnerability of the Security and Provisioning component of the Oracle Essbase database management system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Security and Provisioning component of the Oracle Essbase database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2023-22483 · Genesys · Genesys Cic Polycom Phone Provisioning Tftp Server

Name of the Vulnerable Software and Affected Versions: Genesys CIC Polycom phone provisioning TFTP Server affected versions not specified Description: An issue was found that allows a remote attacker to execute arbitrary code via the login credentials to the TFTP server configuration page...

Genesys CIC Polycom phone provisioning TFTP Server 代码问题漏洞

The Genesys CIC Polycom phone provisioning TFTP Server is a server from Genesys Corporation, USA. A security vulnerability exists in the Genesys CIC Polycom phone provisioning TFTP Server that originates from a vulnerability that could allow a remote attacker to execute arbitrary code via login...