PT-2022-22135 · Ibm · Ibm Power

Name of the Vulnerable Software and Affected Versions: IBM Power versions FW950 through FW1010 Description: The issue arises after a sequence of maintenance operations on Power FW950 and FW1010, leading to an improper configuration of a SRIOV network adapter. This results in the desired VEPA...

PT-2022-24400 · Ibm · Ibm Cloud Pak For Security

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Security CP4S versions 1.10.0.0 through 1.10.2.0 Description: The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Recommendations: For versions...

Tauri 安全漏洞

Tauri is Tauri open source to build smaller, faster and more secure desktop applications using a Web front end. Tauri versions prior to 1.0.7 and 1.1.2 have a security vulnerability , the vulnerability stems from its file dialog box and drag-and-drop functionality to select the path of special...

CVE-2022-33321

Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric...

kernel: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap all roots when unmapping gfn range in TDP MMU Zap both valid and invalid roots when zapping/unmapping a gfn range, as KVM must ensure it holds no references to the freed page after returning from the unmap...

AZL-11385 CVE-2022-44792 affecting package net-snmp for versions less than 5.9.4-1

handleipDefaultTTL in agent/mibgroup/ip-mib/ipscalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker who has write access to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service...

PT-2022-5703 · D Link · D-Link Dir-882

Name of the Vulnerable Software and Affected Versions: D-Link DIR-882 versions 1.10B02 through 1.20B06 Description: The issue is related to buffer overflow errors in the D-Link DIR-882 wireless router's firmware. Exploitation of this issue may allow a remote attacker to cause a denial of service...

PT-2022-5707 · D Link · D-Link Dir-882

Name of the Vulnerable Software and Affected Versions: D-Link DIR-882 versions 1.10B02 through 1.20B06 Description: The issue is related to a buffer overflow error in the webGetVarString function of the D-Link DIR-882 wireless router's firmware. This can be exploited by a remote attacker to execu...

PT-2022-36749 · Git +1 · Oniguruma

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions gbNUMBER mbc enc len, match at, and search in range. No informati...

PT-2022-18672 · Osisoft · Osisoft-Pi-Web-Connector

Name of the Vulnerable Software and Affected Versions: osisoft-pi-web-connector versions 0.15.0 through 0.43.0 Description: The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests. Recommendations: For osisoft-pi-web-connector...

CVE-2022-44622

In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive...

Denial of Service (DoS)

Overview vapor/vapor is an a server-side Swift HTTP web framework. Affected versions of this package are vulnerable to Denial of Service DoS in Vapor's HTTP Range Request, when FileMiddleware is enabled. Details Denial of Service DoS describes a family of attacks, all aimed at making a system...

PT-2022-25297 · Ibm · Ibm Mq Appliance

Name of the Vulnerable Software and Affected Versions: IBM MQ Appliance versions 9.2 CD through 9.3 LTS Description: The issue allows an authenticated user to impersonate another user on the system because it does not invalidate the session after logout. Recommendations: For IBM MQ Appliance...

GO-2022-1083 Panic on malformed messages in github.com/free5gc/aper

A malformed message can crash the free5gc/amf and free5gc/ngap decoders via an index-out-of-range panic in aper.GetBitString...

ansible-freeipa bug fix and enhancement update

An update is available for ansible-freeipa. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The ansible-freeipa package provides Ansible roles and playbooks to...

PT-2022-24940 · Fluentd · Fluentd

Name of the Vulnerable Software and Affected Versions: Fluentd versions 1.13.2 through 1.15.2 Description: A remote code execution vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue...

Sudo 缓冲区错误漏洞

Sudo is a program used on Unix-like systems that allows users to execute commands in a secure manner with special privileges. A buffer error vulnerability exists in Sudo versions 1.8.0 through 1.9.12, which stems from the presence of an array out-of-bounds error that could result in a heap-based...

CVE-2022-43995

Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer...

CVE-2022-41974

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege...

CVE-2022-2475

Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into registers outside of the authorized accessible range. This could allow a user to access privileged resources or resources out ...