Vulnerability of the kcm_tx_work() function (net/kcm/kcmsock.c) in Linux operating system kernels, allowing a hacker to execute arbitrary code

The vulnerability of the kcmtxwork function net/kcm/kcmsock.c in Linux operating systems arises due to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the XFRM subsystem in the Linux operating system allows a hacker to execute arbitrary code, cause a service failure, or otherwise affect the system.

The vulnerability of the XFRM subsystem in the Linux operating system arises due to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to execute arbitrary code, cause service failures, or have other adverse effects on the system...

CVE-2022-40958

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and...

How to build a secure foundation for identity and access

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Christina Richmond, a...

The vulnerability of the Windows Error Reporting error reporting service on Windows operating systems allows a perpetrator to escalate their privileges.

The vulnerability of the Windows Error Reporting registration service in Windows operating systems is related to synchronization errors when using a shared resource “Race Conditions”. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2021-35252

Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext...

SolarWinds Serv-U FTP Server 授权问题漏洞

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the U.S. company SolarWinds. SolarWinds Serv-U FTP Server suffers from an authorization issue vulnerability that stems from the deployment of a common encryption key across all of its instances resulting in an...

The vulnerability of the DirectX Graphics Kernel Driver (DXGKRNL) on Microsoft Windows operating systems, which allows attackers to exploit their privileges.

The vulnerability of the DirectX Graphics Kernel Driver DXGKRNL on Microsoft Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the Secure Socket Tunneling Protocol (SSTP) implementation in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Secure Socket Tunneling Protocol SSTP implementation in Windows operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially crafted requests...

PT-2022-10455 · Rhinosoft · Serv-U Ftp Server

Name of the Vulnerable Software and Affected Versions: Serv-U FTP Server affected versions not specified Description: A common encryption key is used across all deployed instances of the software. This allows an attacker to recover an encrypted value to plaintext if it is exposed. Recommendations...

PT-2022-14790 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to improper input validation in the page number of shared mem.c, which could lead to code execution in the secure world. This may result in local escalation of privilege without requiring...

hw: cpu: incomplete clean-up of multi-core shared buffers (aka SBDR)

A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel® Processors may allow an authenticated user to enable information disclosure via local access...

hw: cpu: incomplete clean-up of multi-core shared buffers (aka SBDR)

A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel® Processors may allow an authenticated user to enable information disclosure via local access...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

PT-2022-5885 · Microsoft · Windows Error Reporting +1

Name of the Vulnerable Software and Affected Versions: Windows Error Reporting affected versions not specified Description: The issue is related to synchronization errors when using a shared resource, specifically a "race condition" situation, in the Windows Error Reporting service of Windows...

PT-2022-5869 · Microsoft · Directx Graphics Kernel +1

Name of the Vulnerable Software and Affected Versions: DirectX Graphics Kernel versions affected versions not specified Description: The issue is related to synchronization errors when using a shared resource in the DirectX Graphics Kernel driver of Microsoft Windows operating systems. This can...

Amazon Linux 2022 : maven-shared-utils (ALAS2022-2022-242)

The version of maven-shared-utils installed on the remote host is prior to 3.3.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-242 advisory. - In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings...