CVE-2022-37431

A Reflected Cross-site scripting XSS issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSSPROTECTIONENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSSPROTECTIONENABLED=true in all...

[SECURITY] Fedora 36 Update: origin-3.11.2-7.fc36

OpenShift Origin is a distribution of Kubernetes optimized for enterprise app lication development and deployment. OpenShift Origin adds developer and operational c entric tools on top of Kubernetes to enable rapid application development, easy deployment and scaling, and long-term lifecycle...

The vulnerability of the sourceMapURL function in the DevTools set of web development tools for the Firefox browser allows attackers to disclose sensitive information.

The vulnerability of the sourceMapURL function in the DevTools browser extension for web development is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

CVE-2022-30550

An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect usernamefilter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead...

CVE-2022-30550

An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect usernamefilter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead...

The vulnerability of Microsoft Office packages, related to security configuration errors, allows attackers to circumvent security restrictions.

The vulnerability of Microsoft Office packages is related to security configuration errors. Exploiting this vulnerability can allow attackers to circumvent security restrictions...

The vulnerability affects the implementation of the Kerberos authentication protocol for a isolated software environment called AppContainer on Windows operating systems. This vulnerability allows a attacker to circumvent security restrictions.

The vulnerability of the Kerberos authentication protocol implementation in a isolated software environment called AppContainer on Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow an attacker to circumvent security restrictions...

The vulnerability of the Anti-Fishing function of the Yandex Browser allows a hacker to bypass existing security restrictions.

The vulnerability of the Anti-Fishing function of the Yandex Browser is related to security configuration errors. Exploiting this vulnerability can allow a remote attacker to bypass existing security restrictions...

The vulnerability of the Protect technology of the Yandex Browser allows a violator to conceal notifications of suspicious content.

The vulnerability of the Protect technology of the Yandex Browser is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to conceal notifications of suspicious content...

Design/Logic Flaw

In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the...

CVE-2022-32155

CVE-2022-32155 concerns Splunk Universal Forwarder management services. The issue described in the sources is that versions before 9.0 expose management services remotely by default, creating a potential exposure rather than a technical vulnerability. Splunk 9.0 binds the management port to local...

CVE-2022-32739

CVE-2022-32739 involves OTRS: when Secure::DisableBanner is disabled and an agent shares a calendar via a public URL, the ICS export leaks the OTRS release number. The linked documents explicitly describe the ICS file containing the OTRS release version, linking to multiple advisories and vulnera...

Login timing attack in ibexa/core

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

The vulnerability of the BitLocker data protection function of the Microsoft Windows operating system, which allows a hacker to bypass the authentication process

The vulnerability of the BitLocker data protection function in the Microsoft Windows operating system is related to security configuration errors. Exploiting this vulnerability can allow an attacker to bypass the authentication process...

Exposure of Resource to Wrong Sphere in Spring Data REST

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

Grafana Datasource Network Restriction Bypass Vulnerability (GHSA-9rrr-6fq2-4f99)

Grafana is prone to a datasource network restriction bypass vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

Microsoft Edge’s vulnerability, related to security configuration errors, allows attackers to escalate their privileges.

The vulnerability of Microsoft Edge is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

The vulnerability of the Microsoft Office software package, related to security configuration errors, allows attackers to disclose sensitive information.

The vulnerability of the Microsoft Office suite is related to security configuration errors. Exploiting this vulnerability can allow attackers to disclose sensitive information that is protected by the system’s security measures...

Microsoft Edge’s vulnerability, related to security configuration errors, allows attackers to escalate their privileges.

The vulnerability of Microsoft Edge is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

Open-Xchange: Privilege escalation possible in dovecot when similar passdbs are used

Summary --------- Privilege escalation is possible as a result of incorrect security code logic for dovecot passdb definitions. Description ------------ When two passdb configuration entries exist in the dovecot configuration which have the same driver and args settings, the incorrect...