Moderate: Red Hat Security Advisory: OpenShift Virtualization 2.6.10 RPMs security and bug fix update

Red Hat OpenShift Virtualization release 2.6.10 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which giv...

CVE-2022-24863 Denial of service in http-swagger

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down...

Fedora: Security Advisory for kernel (FEDORA-2022-5cd9d787dc)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

saffronsolution.co.in Cross Site Scripting vulnerability OBB-2505789

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-0221

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system...

CVE-2022-0221

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2022-1394)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Solution Manager Diagnostics (Root Cause Analysis) tool within the SAP Solution Manager software platform allows a perpetrator to enhance their privileges.

The vulnerability of the Solution Manager Diagnostics Root Cause Analysis tool within the SAP Solution Manager software platform is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

NGINX Shares Mitigations for Zero-Day Bug Affecting LDAP Implementation

The maintainers of the NGINX web server project have issued mitigations to address security weaknesses in its Lightweight Directory Access Protocol LDAP Reference Implementation. "NGINX Open Source and NGINX Plus are not themselves affected, and no corrective action is necessary if you do not use...

Google Play Bitten by Sharkbot Info-stealer ‘AV Solution’

Researchers have found the info-stealing Android malware Sharkbot lurking unsuspected in the depths of the Google Play store under the cover of anti-virus AV solutions. While analyzing suspicious applications on the store, the Check Point Research CPR team found what purported to be genuine AV...

Fortinet FortiEDR Trust Management Issue Vulnerability

Fortinet FortiEDR is a scratch-built endpoint security solution from Fortinet, U.S.A. Fortinet FortiEDR is vulnerable to a trust management issue that could be exploited by an unauthenticated attacker to disguise and spoof messages from other collectors...

WordPress Lucky Wheel for WooCommerce – Spin a Sale plugin <= 1.0.10 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Lucky Wheel for WooCommerce – Spin a Sale plugin versions = 1.0.10. Solution Update the WordPress Lucky Wheel for WooCommerce – Spin a Sale plugin to the latest available version at least 1.0.11...

WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas Patchstack Alliance in WordPress Chaty plugin versions = 2.8.3. Solution No patched version is available...

Fortinet FortiClient for Windows权限提升漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. executable file in the FortiClient installer...

CVE-2022-1018

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of...

Xxe

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of...

Security Bulletin: Vulnerability in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional

Summary This vulnerability was disclosed as part of the IBM Java SDK updates in October 2021 , IBM WebSphere Cast Iron Solution & App Connect Professional have addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to...

Spring Framework RCE, Mitigation Alternative

Yesterday we announced a Spring Framework RCE vulnerability CVE-2022-22965, listing Apache Tomcat as one of several preconditions. The Apache Tomcat team has since released versions 10.0.20, 9.0.62, and 8.5.78 all of which close the attack vector on Tomcats side. While the vulnerability is not in...

Qualys Multi-Vector EDR Excels in 2022 MITRE ATT&CK Evaluation

MITRE evaluated Qualys Multi-Vector EDR against competing alternatives, and the results are in. This blog reviews the basics of MITRE ATT&CK evaluation, how our EDR solution performed, and how to interpret the ratings. MITRE Engenuity has released the results of round 4 of its ATT&CK Evaluations...

IBM Cognos Controller Licensing Issue Vulnerability

IBM Cognos Controller is a business intelligence and planning solution from IBM Corporation. The product features process automation, financial audit controls, and the creation and management of financial reports.An authorization issue vulnerability exists in IBM Cognos Controller, which stems fr...