Security feature bypass

Windows Mark of the Web Security Feature Bypass Vulnerability...

CVE-2022-41104

Microsoft Excel Security Feature Bypass Vulnerability...

Security feature bypass

BitLocker Security Feature Bypass Vulnerability...

CVE-2022-41099

BitLocker Security Feature Bypass Vulnerability...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with multiple known vulnerabilities. These components have been updated in the latest release and the vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2022-24407 DESCRIPTION: Cyrus SASL is vulnerable to SQL injection. A...

CVE-2022-41049 Windows Mark of the Web Security Feature Bypass Vulnerability

...

Microsoft Windows Multiple Vulnerabilities (KB5019970)

This host is missing an important security update according to Microsoft KB5019970 SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

CVE-2022-20448

In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in several components of Windows. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights Access to sensitive dat...

Theme-Demo-Importer < 1.1.1 - Admin+ Arbitrary File Upload

The plugin does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files such as PHP even when FILEMODS and FILEEDIT are disallowed. PoC 1. Navigate to: Appearance Import Demo Content Theme Demo Importer Manually upload the demo files 2. Use the XML...

Vulnerabilities fixed in Microsoft Office

Vulnerabilities have been fixed in the Microsoft Office. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Bypassing authentication Bypassing security measure Remote code execution User rights Accessing sensitive data The vulnerabili...

PT-2022-5440

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to a security feature bypass vulnerability in the Windows Mark of the Web mechanism, which is associated with errors in security settings. This vulnerability can be...

KLA20044 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, bypass security restrictions, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution...

The vulnerability of Google Chrome and Microsoft Edge web browsers allows attackers to circumvent security restrictions.

The vulnerability of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created HTML page...

CVE-2022-43563

In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phis...

GHSA-M7GV-V8XX-V47W XWiki OIDC Authenticator vulnerable to bypassing OpenID login by providing a custom provider

Impact Even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider by providing its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the...

CVE-2022-39344

Azure RTOS USBX before 6.1.12 is affected. The vulnerability lies in the DFU UPLOAD handling in ux_device_class_dfu_control_request, where a buffer overflow can overwrite memory contents when the device is in UX_SYSTEM_DFU_STATE_DFU_IDLE. This may allow bypassing security features or executing ar...

PT-2022-24914 · Microsoft · Azure Rtos Usbx

Name of the Vulnerable Software and Affected Versions: Azure RTOS USBX versions prior to 6.1.12 Description: The USB DFU UPLOAD functionality in Azure RTOS USBX may be utilized to introduce a buffer overflow, resulting in the overwrite of memory contents. In particular cases, this may allow an...

CVE-2022-3675

CVE-2022-3675 affects Fedora CoreOS where a misconfiguration in GRUB password handling allows booting non-default OSTree deployments without entering a password, potentially reverting security fixes. Affected behavior: GRUB password protects access to GRUB CLI and kernel cmdline modifications, bu...

The vulnerability of the microprogramming software used in industrial LTE modems of the Moxa OnCell G3150A-LTE, OnCell G3470A-LTE, and WDR-3124A series, as well as the microprogramming software used in wireless access points for industrial systems of the Moxa AWK-3131A, AWK-4131A, AWK-1131A, and AWK-1137C models, is related to the unencrypted storage of critical information. This vulnerability allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the microprogramming software used in industrial LTE modems of the Moxa OnCell G3150A-LTE, OnCell G3470A-LTE, and WDR-3124A series, as well as the microprogramming software used in wireless access points for industrial systems of the Moxa AWK-3131A, AWK-4131A, AWK-1131A, and...