Phusion Passenger information disclosure

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10, if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root...

GHSA-32W9-2QPC-5F9V Docker image code execution with Apache Mesos

A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain...

PT-2022-2959 · Mitel · Mitel 6900 Series Ip Phones

Name of the Vulnerable Software and Affected Versions: Mitel 6900 Series IP phones versions 1.8.0.12 and earlier Description: The issue is related to errors in authorization, allowing an attacker to execute arbitrary code. A successful exploit could allow access to sensitive information and code...

Konica Minolta bizhub MFP printer 安全漏洞

The Konica Minolta bizhub MFP printer is a series of color laser multifunction printers from the Japanese company Konica Minolta. A security vulnerability exists in the Konica Minolta bizhub MFP printer, which can be exploited by an attacker to expose the printer endpoint to sandbox escape with...

The vulnerability of the configuration file loader for WebUI devices of PHOENIX CONTACT RAD-ISM-900-EN-* allows a attacker to execute arbitrary code with root privileges.

The vulnerability of the configuration file loader for WebUI devices of PHOENIX CONTACT RAD-ISM-900-EN- exists due to insufficient checks on the integrity of the firmware. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

Phusion Passenger information disclosure

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10, if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root...

Konica Minolta bizhub MFP printer 安全漏洞

The Konica Minolta bizhub MFP printer is a series of color laser multifunction printers from the Japanese company Konica Minolta. A security vulnerability exists in the Konica Minolta bizhub MFP printer, which can be exploited by an attacker to expose the printer endpoint to sandbox escape with...

Konica Minolta bizhub MFP 安全漏洞

The Konica Minolta bizhub MFP printer is a series of color laser multifunction printers from the Japanese company Konica Minolta. A security vulnerability exists in the Konica Minolta bizhub MFP printer, which can be exploited by an attacker to expose the printer endpoint to sandbox escape with...

CISA Urges Organizations to Patch Actively Exploited F5 BIG-IP Vulnerability

.jpg The U.S. Cybersecurity and Infrastructure Security Agency CISA has added the recently disclosed F5 BIG-IP flaw to its Known Exploited Vulnerabilities Catalog following reports of active abuse in the wild. The flaw, assigned the identifier CVE-2022-1388 CVSS score: 9.8, concerns a critical bu...

CVE-2022-29855

Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 5.1.0.8016 and earlier, and 6.0 6.0.0.368 through 6.1 HF4 6.1.0.165, could allow a unauthenticated...

CVE-2022-29855

Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 5.1.0.8016 and earlier, and 6.0 6.0.0.368 through 6.1 HF4 6.1.0.165, could allow a unauthenticated...

Improper access control

Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 5.1.0.8016 and earlier, and 6.0 6.0.0.368 through 6.1 HF4 6.1.0.165, could allow a unauthenticated...

CVE-2022-29855

Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 5.1.0.8016 and earlier, and 6.0 6.0.0.368 through 6.1 HF4 6.1.0.165, could allow a unauthenticated...

CVE-2022-29855

Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 5.1.0.8016 and earlier, and 6.0 6.0.0.368 through 6.1 HF4 6.1.0.165, could allow a unauthenticated...

CVE-2022-29855

CVE-2022-29855 affects Mitel 6800/6900 Series SIP phones (excluding 6970) with firmware variants up to 5.1 SP8 and up to 6.1 HF4, where an undocumented test/backdoor functionality during system boot can grant an unauthenticated, physically proximate attacker root access via a boot-time check that...

CVE-2022-0024

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committ...

CVE-2022-0024

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committ...

CVE-2022-29898

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware...

CVE-2022-29897

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware...

PHOENIX CONTACT RAD-ISM-900-EN-* 安全漏洞

The PHOENIX CONTACT RAD-ISM-900-EN- is a series of wireless modular Ethernet transceivers from PHOENIX CONTACT, Germany. A security vulnerability exists in PHOENIX CONTACT's RAD-ISM-900-EN- devices, which stems from an incorrect validation of integrity check values. An attacker could exploit the...