Intel® Processors Return Stack Buffer Underflow Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing prescriptive guidance to address this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-29901 Description: Non-transparent sharing of branch predictor targets...

PT-2022-3907 · Siemens · Teamcenter Visualization +1

Name of the Vulnerable Software and Affected Versions: Siemens JT2Go versions prior to V13.3.0.5 Siemens Teamcenter Visualization versions prior to V14.0.0.2 Description: The issue is related to the APDFL.dll library in Siemens JT2Go and Teamcenter Visualization, which contains an out of bounds...

Data Distribution Service: Mitigating Risks Part 3

In the final chapter of our blog series, we discuss mitigating strategies and recommendations to keep DDS protected from malicious actors...

PT-2022-8918 · Dell · Dell Bsafe Crypto-C Micro Edition +1

Name of the Vulnerable Software and Affected Versions: Dell BSAFE Crypto-C Micro Edition versions prior to 4.1.5 Dell BSAFE Micro Edition Suite versions prior to 4.6 Description: The issue is related to an Observable Timing Discrepancy, which may allow attackers to exploit the vulnerability...

PT-2022-21154 · Node.Js +8 · Node.Js +8

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to 14.20.1 Node.js versions prior to 16.17.1 Node.js versions prior to 18.9.1 Description: The issue arises from the llhttp parser in the http module in Node.js, which does not correctly parse and validate...

PT-2022-21963 · Eqs · Eqs Integrity Line

Name of the Vulnerable Software and Affected Versions: EQS Integrity Line through 2022-07-01 Description: The issue allows a stored XSS via a crafted whistleblower entry. Recommendations: For EQS Integrity Line through 2022-07-01, consider restricting access to the whistleblower entry feature unt...

PT-2022-3607 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to the fixed version Description: The issue is related to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms. This can be exploited if the victim has specific dependencies on a Windows...

CVE-2022-31127 Improper handling of email input in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...

PT-2022-9369 · Jfrog · Jfrog Artifactory

Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions prior to 7.33.6 JFrog Artifactory versions prior to 6.23.38 Description: The issue affects JFrog Artifactory, making it vulnerable to Cross-Site Request Forgery CSRF for specific endpoints. Recommendations: For...

ICS & OT Cybersecurity Attack Trends

We explore Trend Micro’s latest research into industrial cybersecurity, including the impact of attacks, maturity of security programs, and recommendations for strengthening security...

PT-2022-3497 · Apache +2 · Apache Commons Configuration +2

Name of the Vulnerable Software and Affected Versions: Apache Commons Configuration versions 2.4 through 2.7 Description: The issue is related to the variable interpolation feature in Apache Commons Configuration, which allows properties to be dynamically evaluated and expanded. The standard form...

PT-2022-4254

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1 Oracle GraalVM Enterprise Edition versions 20.3.6, 21.3.2, 22.1.0 Description The issue is related to insufficient input validation in the Hotspot component of Oracle Java SE...

PT-2022-6220 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 9.0.0 through 9.1.0.19 Dell PowerScale OneFS version 9.2.1.12 Dell PowerScale OneFS version 9.3.0.6 Description: The issue is related to the disclosure of sensitive information through log files in the PowerScal...

PT-2022-3935 · Dahua · Dahua Asi7Xxx +2

Name of the Vulnerable Software and Affected Versions: Dahua ASI7XXX versions prior to v1.000.0000009.0.R.220620 Dahua IPC-HDBW2XXX versions prior to v2.820.0000000.48.R.220614 Dahua IPC-HX2XXX versions prior to v2.820.0000000.48.R.220614 Description: The issue is related to the authentication...

PT-2022-21880 · Debian +3 · Debian +3

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The issue is related to a security problem, but details are not provided. Recommendations: At the moment, there is no information about a newer...

PT-2022-5982 · Atlassian +1 · Jira Service Management Server +2

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Service Management Server and Data Center versions prior to 4.13.20 Atlassian Jira Service Management Server and Data Center versions 4.14.0 through 4.20.8 Atlassian Jira Service Management Server and Data Center versions 4.21....

PT-2022-15404 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, 11.1, and 11.5 Description: The issue is caused by improper privilege management when a table function is used, potentially leading to an information disclosure. Recommendations: F...

Pyramid Solutions EtherNet/IP Adapter Development Kit

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely, low attack complexity Vendor: Pyramid Solutions, Inc. Equipment: EtherNet/IP Adapter Development Kit Vulnerability: Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker with...

PT-2022-3174 · Emerson · Emerson Roc +1

Name of the Vulnerable Software and Affected Versions: Emerson ROC and FloBoss RTU product lines through 2022-05-02 Description: The issue is related to insecure filesystem operations in the Emerson ROC and FloBoss RTU product lines. These products use the ROC protocol for communications between ...

PT-2022-3096 · Omron · Omron Cs Series

Name of the Vulnerable Software and Affected Versions: Omron CS series, CJ series, and CP series PLCs through 2022-05-18 Description: The issue concerns the transmission of confidential information in cleartext, specifically passwords used for the UM Protection setting. This setting allows users ...