PT-2022-19452

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.9.0 TensorFlow versions prior to 2.8.1 TensorFlow versions prior to 2.7.2 TensorFlow versions prior to 2.6.4 Description The implementation of tf.raw ops.LSTMBlockCell does not fully validate the input arguments,...

PT-2022-2704 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.4.0 through 2.1.14 Argo CD versions 2.2.0 through 2.2.8 Argo CD versions 2.3.0 through 2.3.3 Description: A critical issue has been discovered in Argo CD that allows unauthenticated users to impersonate as any Argo CD user ...

PT-2022-16185 · Aruba · Aruba Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.4 and below Aruba ClearPass Policy Manager versions 6.9.9 and below Aruba ClearPass Policy Manager versions 6.8.9-HF2 and below Aruba ClearPass Policy Manager versions 6.7.x and below Description: ...

PT-2022-21549 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.4 macOS Big Sur versions prior to 11.6.6 Description: The issue allows an app to bypass Privacy preferences. It was addressed with improved checks. Recommendations: For macOS versions prior to 12.4, update to macOS...

PT-2022-7005

Name of the Vulnerable Software and Affected Versions Apple tvOS versions prior to 15.5 Apple iOS versions prior to 15.5 Apple iPadOS versions prior to 15.5 Apple watchOS versions prior to 8.6 Apple macOS Big Sur versions prior to 11.6.6 Apple macOS Monterey versions prior to 12.4 Apple macOS...

PT-2022-18066 · Apple · Macos Monterey +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.4 macOS Big Sur versions prior to 11.6.6 Description: The issue allows a malicious application to bypass Privacy preferences. This was addressed with additional permissions checks. Recommendations: For macOS version...

PT-2022-19223 · Sap · Sap Host Agent

Name of the Vulnerable Software and Affected Versions: SAP Host Agent affected versions not specified Description: The issue concerns the SAP Host Agent logfile, which under certain conditions, displays information that would otherwise be restricted. Recommendations: At the moment, there is no...

malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

PT-2022-2476

Active Directory Domain Services and Certificate Services affected versions not specified Description: This issue involves an elevation of privilege vulnerability affecting Active Directory Domain Services and Certificate Services. Successful exploitation allows attackers to impact the system and...

AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Equipment: AVEVA InTouch Access Anywhere and AVEVA Plant SCADA Access Anywhere Vulnerability: Exposure of Resource to Wrong Sphere 2. RISK EVALUATION Successful exploitation of this vulnerability...

Intel® XTU Advisory

Summary: A potential security vulnerability in the Intel® Extreme Tuning Utility XTU software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-22139 Description: Uncontrolled search path in the...

PT-2022-16215 · Hewlett Packard · Hpe Nimble Storage All Flash Arrays +2

Name of the Vulnerable Software and Affected Versions: HPE Nimble Storage Hybrid Flash Arrays versions prior to 5.0.10.100 HPE Nimble Storage All Flash Arrays versions prior to 5.0.10.100 HPE Nimble Storage Secondary Flash Arrays versions prior to 5.0.10.100 HPE Nimble Storage Hybrid Flash Arrays...

PT-2022-2443

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.x, 12.1.x, 13.1.x prior to 13.1.5, 14.1.x prior to 14.1.4.6, 15.1.x prior to 15.1.5.1, and 16.1.x prior to 16.1.2.2 Description The vulnerability resides in the iControl REST API authentication mechanism of F5 BIG-IP...

Johnson Controls Metasys

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls, Inc. Equipment: Metasys ADS/ADX/OAS Servers Vulnerability: Unverified Password Change 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated user...

Early Depositor can DOS Deposits

Lines of code Vulnerability details Impact A malicious, but generous, early depositor can DOS all future deposits. This is accomplished by directly sending aTokens to the AaveV3YieldSource.sol contract after making their first deposit. The amount of aTokens sent to the contract will manipulate th...

Ukraine government and pro-Ukrainian sites hit by DDoS attacks

The Computer Emergency Response Team in Ukraine CERT-UA has announced that Ukraine government web portals and pro-Ukraine sites are subjected to ongoing DDoS distributed denial of service attacks. They dont currently know who is behind these attacks. The attack involves injecting a malicious...

Platform Update: Build the Future on Akamai

Today, technology is infused into nearly everything we do. The data behind personalized recommendations, connected devices, and wearables has changed how we engage with the world around us — whether we’re driving to a new destination, purchasing from a new retailer, or monitoring our health...

PT-2022-3554 · Unknown +5 · Cifs-Utils +5

Name of the Vulnerable Software and Affected Versions: cifs-utils versions through 6.14 Description: The issue is related to a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument, which could allow local attackers to gain root privileges. This is a result of a buffer...

CVE-2022-24706 Remote Code Execution Vulnerability in Packaging

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front o...

Johnson Controls Metasys SCT Pro

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls, Inc. Equipment: Metasys Vulnerability: Server-side Request Forgery 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to...