CVE-2022-4337

CVE-2022-4337 describes an out-of-bounds read in Open vSwitch’s Organization Specific TLV across various Open vSwitch versions. The related documents identify Open vSwitch as the affected product with the root cause being an out-of-bounds read in TLV handling, leading to high-severity impact (con...

CVE-2022-4338

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4337

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4337

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4337

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4338

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4338

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch...

bzip2 Denial of Service (DoS)

Working with specific payloads can cause a Denial of Service DoS vector. Both Decompress and Compress implementations can enter into infinite loops given specific payloads entered that trigger it. The issue is described in great detail in the bzip2 repository issue. Thanks to bjrjk for finding an...

CVE-2022-3614

In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation...

PT-2023-1101 · Unknown +6 · Openvswitch +6

Name of the Vulnerable Software and Affected Versions: OpenvSwitch affected versions not specified Description: The issue is related to an out-of-bounds read in Organization Specific TLV found in OpenvSwitch. It can be exploited by sending specially crafted LLDP messages to the vulnerable system,...

CVE-2022-48196

Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX40 before 1.0.2.60, RAX35 before 1.0.2.60, R6400v2 before 1.0.4.122, R6700v3 before 1.0.4.122, R6900P before 1.3.3.152, R7000P before 1.3.3.152, R7000 before 1.0.11.136, R7960P before 1.4.4.9...

CVE-2022-45428

Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can obtain the debugging information...

CVE-2022-40005

Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and /boaform/formTracert URIs for ping and traceroute...

CVE-2022-26386

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in /tmp, but this behavior was changed to download them to /tmp where they could be affected by other local users. This behavior was reverted to the original, user-specific directory. This bug only...

CVE-2022-26386

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in /tmp, but this behavior was changed to download them to /tmp where they could be affected by other local users. This behavior was reverted to the original, user-specific directory. This bug only...

CVE-2022-3188

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages without authentication and download the history file from the device; the history file includes the latest actions completed by specific users...

Cybercrime (and Security) Predictions for 2023

Threat actors continue to adapt to the latest technologies, practices, and even data privacy laws—and it's up to organizations to stay one step ahead by implementing strong cybersecurity measures and programs. Here's a look at how cybercrime will evolve in 2023 and what you can do to secure and...

PT-2022-17418 · Unknown · Identity Manager

Name of the Vulnerable Software and Affected Versions: Identity Manager affected versions not specified Description: An unauthenticated user can access specific page URLs of Identity Manager's management console. However, the system does not allow the user to carry out server-side tasks without a...

Owners can delay the call to startDraw to reject the draw result

Lines of code Vulnerability details Impact Owners can call lastResortTimelockOwnerClaimNFT to reclaim NFT back if settings.recoverTimelock block.timestamp // Stop the withdraw revert RECOVERYISNOTYETPOSSIBLE; ... If an owner delays the startDraw until settings.recoverTimelock, the owner can call...

Debian dla-3239 : git - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3239 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3239-2 [email protected]...