June 23, 2022—KB5014665 (OS Build 20348.803) Preview

None None...

MAL-2022-7053 Malicious code in wbtc-address-set-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7a29f028b12bcfc56fb614b602c2a87e6aa9759e8cb9367ee05967ab3d8f696 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wbtc-address-set-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7a29f028b12bcfc56fb614b602c2a87e6aa9759e8cb9367ee05967ab3d8f696 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in renvm-address-set-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d4669c4c1e6ec4101a891fc9f75f45987efdaf0edf12f004c56a448b8a20f2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5750 Malicious code in renvm-address-set-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d4669c4c1e6ec4101a891fc9f75f45987efdaf0edf12f004c56a448b8a20f2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

dlt-daemon 资源管理错误漏洞

The dlt-daemon is the DLT communication interface for GENIVI's ECU. It collects and buffers log messages from one or more DLT users running on the ECU and makes them available to DLT clients upon request. A security vulnerability exists in dlt-daemon version v2.18.8, which stems from the fact tha...

CVE-2022-20133

In setDiscoverableTimeout of AdapterService.java, there is a possible bypass of user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

PT-2022-14372 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-12L Description: The issue is related to a missing permission check in the setDiscoverableTimeout function of AdapterService.java. This could lead to a bypass of user interaction, resulting in local...

EulerOS 2.0 SP9 : haproxy (EulerOS-SA-2022-1866)

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way HAProxy processed HTTP responses containing the 'Set-Cookie2' header. This flaw could allow an attacker to send...

Immature fCash positions should not be left behind when removing the NotionalTradeModule

Lines of code Vulnerability details function removeModule external override onlyValidAndInitializedSetISetTokenmsg.sender ISetToken setToken = ISetTokenmsg.sender; // Redeem matured positions prior to any removal action redeemMaturedPositionssetToken; // Try if unregister exists on any of the...

wfCash tokens can be locked in Set

Lines of code Vulnerability details Impact The automatic redemption of matured wfCash tokens within the NotionalTradeModule.moduleRedeemHook hook can cause wfCash tokens to be locked within the Set and prevent investors to redeem. The NotionalTradeModule.moduleRedeemHook hook is always called...

CVE-2022-31055 Improper Access Control in kctf

kCTF is a Kubernetes-based infrastructure for capture the flag CTF competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark the...

Cross site request forgery (csrf)

The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1790

The CVE-2022-1790 entry concerns the WordPress plugin “New User Email Set Up” (versions

golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString

A flaw was found in the big package of the math library in golang. The Rat.SetString could cause an overflow, and if left unhandled, it could lead to excessive memory use. This issue could allow a remote attacker to impact the availability of the system...

EulerOS 2.0 SP10 : grub2 (EulerOS-SA-2022-1819)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged...

EulerOS 2.0 SP10 : grub2 (EulerOS-SA-2022-1828)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged...

CVE-2018-25034

A vulnerability, which was classified as problematic, has been found in Thomson TCW710 ST5D.10.05. This issue affects some unknown processing of the file /goform/wlanPrimaryNetwork. The manipulation of the argument ServiceSetIdentifier with the input alert1 as part of POST Request leads to basic...

THOMSON TCW710 跨站脚本漏洞

The THOMSON TCW710 is a set-top box from THOMSON Canada. A security vulnerability exists in the THOMSON TCW710 ST5D.10.05 version, which originates from an unknown section of the file /goform/RgDhcp. A remote attacker can exploit the vulnerability to cause a stored cross-site scripting attack usi...

PT-2022-8046 · Thomson · Thomson Tcw710

Name of the Vulnerable Software and Affected Versions: Thomson TCW710 version ST5D.10.05 Description: A problematic issue has been found in the processing of the file /goform/wlanPrimaryNetwork. The manipulation of the ServiceSetIdentifier argument with the input alert1 as part of a POST Request...