KLA12542 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code and cause denial of service. Original advisories MFSA2022-19 Exploitation Public exploits exist for this vulnerability. Related products Mozilla-Firefox-ESR CVE...

GHSA-V2RP-9CPJ-PFW2 Salt Insecure configuration of PAM external authentication service

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient...

KLA12539 Multiple vulnerabilities in Zoom

Multiple vulnerabilities were found in Zoom. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Insufficient hostname validation vulnerability can be exploited remotely to gain...

GHSA-67RH-9P29-VRXR OpenStack Compute (Nova) allows remote attackers to bypass intended restriction

OpenStack Compute Nova before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made...

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request...

GHSA-8QQ4-8JVQ-MFW4 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request...

CVE-2022-21190

This affects the package convict before 6.2.3. This is a bypass of CVE-2022-22143. The fix introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with proto or this.constructor.prototype. To bypass this check it's...

ChakraCore Security Bypass

A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard CFG to be bypassed, aka "Scripting Engine Security Feature Bypass Vulnerability." This affects Microsoft Edge, ChakraCore...

GHSA-WG47-6CQC-Q52J ChakraCore Security Bypass

A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard CFG to be bypassed, aka "Scripting Engine Security Feature Bypass Vulnerability." This affects Microsoft Edge, ChakraCore...

GHSA-66PQ-HQV5-228G Smack allows the bypass of TLS protections

Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response...

Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

Vulnerabilities fixed in Red Hat OpenShift Logging

Red Hat has fixed vulnerabilities in OpenShift Logging. A malicious party could exploit the vulnerabilities to cause a denial-of-service, bypassing a security measure or perform an HTTP request smuggling attack. Red Hat has released updates to fix the vulnerabilities. For more information, see:...

The vulnerability of the Windows Hyper-V hardware virtualization system allows attackers to circumvent existing security restrictions.

The vulnerability of the Windows Hyper-V hardware virtualization system is related to resource release errors. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions...

KLA12537 PE vulnerability in PostgreSQL

Escalation of privilege vulnerability was found in PostgreSQL. Malicious users can exploit this vulnerability to execute arbitrary code, gain privileges. Original advisories PostgreSQL News Related products PostgreSQL CVE list CVE-2022-1552 critical Solution Update to the latest version Download...

CVE-2022-28253 Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability

Acrobat Reader DC version 22.001.2011x and earlier, 20.005.3033x and earlier and 17.012.3022x and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this...

curl 安全漏洞

curl is a tool for transferring data from or to a server. A security vulnerability exists in curl versions 7.82.0 through 7.83.0, which stems from the fact that curl's HSTS checks can be bypassed, allowing it to continue using the HTTP protocol...

Microsoft Word 2016 Security Feature Bypass Vulnerability (KB5002184)

This host is missing a critical security update according to Microsoft KB5002184 Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

Microsoft Word 2013 Service Pack 1 Security Feature Bypass Vulnerability (KB5002187)

This host is missing a critical security update according to Microsoft KB5002187 Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

Microsoft Publisher 2013 Security Feature Bypass Vulnerability (KB4484347)

This host is missing an important security update according to Microsoft KB4484347 Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Publisher 2016 Security Feature Bypass Vulnerability (KB4493152)

This host is missing an important security update according to Microsoft KB4493152 Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...