CVE-2022-42327

x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode. Access to this shared page bypasses the expected isolation that should exist...

ASB-A-237540408

In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2022-36783

AlgoSec – FireFlow Reflected Cross-Site-Scripting RXSS A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user victim. JavaScript code is executed on...

CISA Upgrades to Version 2.0 of Traffic Light Protocol in One Week – Join Us!

On Nov. 1, 2022, CISA will upgrade from Traffic Light Protocol TLP 1.0 to TLP 2.0 in accordance with the recommendation by the Forum of Incident Response Security Teams FIRST that organizations move to 2.0 by the end of 2022. TLP Version 2.0 brings the following key updates: TLP:CLEAR replaces...

Healthcare site leaks personal health information via Google and Meta tracking pixels

Advocate Aurora Health has disclosed that by visiting its websites users may have shared personal information, and possibly protected health information PHI, with Google and Meta Facebook. Advocate Aurora Health is the 11th largest not-for-profit, integrated health system in the US and provides...

CVE-2022-1786

creationtimestamp| type| source ---|---|--- 2022-10-22 13:07:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/7027 2022-10-29 15:13:03+00:00| seen| https://t.me/linkersec/194 2023-07-08 18:44:30+00:00| published-proof-of-concept| https://t.me/cKure/11246 2025-08-26...

USN-5695-1 linux-gcp vulnerabilities

It was discovered that the SUNRPC RDMA protocol implementation in the Linux kernel did not properly calculate the header size of a RPC message payload. A local attacker could use this to expose sensitive information kernel memory. CVE-2022-0812 Moshe Kol, Amit Klein and Yossi Gilad discovered tha...

Gas, a positive social network for teens (no, really)

A new social network is currently in the news, billed as a positive space for teens to enjoy themselves. Im all for positive spaces online, but what is it, and will teens really be happier there than say Instagram, or even just hanging out in WhatsApp groups? Pump the gas Launched in August of th...

Nextcloud: Insecure randomness for default password in file sharing when password policy app is disabled

The password generation function used for protecting shared links in Nextcloud was using an insecure random number generator, which could allow an attacker to access the shared files without knowledge of the password...

Malicious code in @nexthink/content-sharing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49bb7df501231c08b51dd6be1a8222f5b5646daee9e118aeee5c15a620f99596 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-461 Malicious code in @nexthink/content-sharing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49bb7df501231c08b51dd6be1a8222f5b5646daee9e118aeee5c15a620f99596 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

USN-5687-1 linux-azure-4.15 vulnerabilities

It was discovered that the SUNRPC RDMA protocol implementation in the Linux kernel did not properly calculate the header size of a RPC message payload. A local attacker could use this to expose sensitive information kernel memory. CVE-2022-0812 Moshe Kol, Amit Klein and Yossi Gilad discovered tha...

Emerging best practices for securing cloud-native environments

Globally, IT experts recognise security as the most significant barrier to cloud adoption, in part because many of the ways of securing traditional IT environments are not always applicable to cloud-native infrastructure. As a result, security teams may find themselves behind the curve and...

OESA-2022-1978 uboot-tools security update

This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fwprintenv and fwsetenv programs to read and modify U-Boot's environment. Security Fixes: nfslookupreply in net/nfs.c in Das U-Boot through 2022.04 and through 2022.07-rc2 has an...

USN-5678-1 linux-aws, linux-gcp-4.15 vulnerabilities

It was discovered that the SUNRPC RDMA protocol implementation in the Linux kernel did not properly calculate the header size of a RPC message payload. A local attacker could use this to expose sensitive information kernel memory. CVE-2022-0812 Moshe Kol, Amit Klein and Yossi Gilad discovered tha...

The vulnerability of the file-sharing software for disconnected desktops, Warpinator, arises from an improper definition of the link before accessing files. This allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the file-sharing software between remote desktops in Warpinator relates to the improper handling of links before accessing files. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Altair HyperView Player 安全漏洞

Altair HyperView Player is a standalone 3D viewer from Altair Japan. It is used to share CAE models and simulation results. A security vulnerability exists in Altair HyperView Player that originates from uninitialized memory...

MISP 信息泄露漏洞

MISP is an open source software solution. It is used to collect, store, distribute, and share network security metrics, and has features such as threat network security event analysis and malware analysis. information leakage vulnerability exists in versions of MISP prior to 2.4.164, which stems...

Warpinator 后置链接漏洞

Warpinator is an open source file sharing library for Linux Mint that shares files across a LAN. Files are sent and received over the local network. A security vulnerability exists in Warpinator that stems from allowing access to directories other than those intended, such as symbolic directory...

IBM Robotic Process Automation Access Control Error Vulnerability (CNVD-2022-68277)

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. An Access Control Error vulnerability exists in IBM Robotic Process Automation...