CVE-2022-2638 Export All URLs < 4.4 - Admin+ Arbitrary System File Removal

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server...

Levels of Assurance for DoD Microelectronics

The NSA has has published criteria for evaluating levels of assurance required for DoD microelectronics. The introductory report in a DoD microelectronics series outlines the process for determining levels of hardware assurance for systems and custom microelectronic components, which include...

CVE-2022-36610

TOTOLINK A720R V4.1.5cu.532B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample...

Tenda AC18 Remote Command Execution Vulnerability

Tenda AC18 is a router from Tenda, a Chinese company. Tenda AC18 is vulnerable to remote command execution, which can be exploited by attackers to execute arbitrary commands on the system...

MAL-2022-1510 Malicious code in bfrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e31bb4e924a26f5e5608ebedab4870f55b701178306393bc91fb5f7df30c6cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the driver of the Windows Cloud Files mini-filter on the Windows operating system allows a hacker to escalate their privileges.

The vulnerability of the Windows Cloud Files mini-filter driver in the Windows operating system is related to privilege management errors. Exploiting this vulnerability can allow an attacker to increase their privileges within the system...

Google Chrome FedCM code execution vulnerability

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome that could be exploited by attackers to execute arbitrary code on a system or cause a denial of service condition...

Google Android Code Execution Vulnerability (CNVD-2022-71986)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to a code execution vulnerability caused by an out-of-bounds write due to an integer overflow in Bluetooth. An attacker could exploit this vulnerability to execute arbitrary code on the...

CVE-2022-33991

dproxy-nexgen aka dproxy nexgen forwards and caches DNS queries with the CD aka checking disabled bit set to 1. This leads to disabling of DNSSEC protection provided by upstream resolvers...

Heap-based Buffer Overflow

vim is vulnerable to a heap buffer overflow. The vulnerability exists in parsecmdaddress in function utfptr2char due to a lack of input validation which allows an attacker to inject malicious and crash the system...

Authentication flaw

Prior Dell BIOS versions contain an Improper Authentication vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability by bypassing drive security mechanisms in order to gain access to the system...

CVE-2022-34708 Windows Kernel Information Disclosure Vulnerability

...

TCL LinkHub Mesh Wi-Fi Buffer Overflow Vulnerability

TCL LinkHub Mesh Wi-Fi is a router from TCL Corporation.A buffer overflow vulnerability exists in TCL LinkHub Mesh Wi-Fi, which stems from a lack of proper validation of user-supplied data in the confsrv ucloudsetnodelocation function, and could be exploited by an attacker to execute arbitrary co...

IBM Security Verify Information Queue Information Disclosure Vulnerability (CNVD-2022-54888)

IBM Security Verify Information Queue using the acronym "ISIQ" is a cross-product integrator that uses Kafka technology and a publish/subscribe model to integrate data between IBM Security products. Security Verify Information Queue is vulnerable to information disclosure in version 10.0.2. An...

java-17-openjdk security, bug fix, and enhancement update

1:17.0.4.0.8-0.2.ea - Add rpminspect.yaml to turn off Java bytecode inspections - java-17-openjdk deliberately produces Java 17 bytecode, not the default Java 11 bytecode - Resolves: rhbz2109106 1:17.0.4.0.8-0.2.ea - Revert the following changes until copy-java-configs has adapted to relative...

PbootCMS Remote Code Execution (CVE-2022-32417)

A remote code execution vulnerability exists in PbootCMS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

java-1.8.0-openjdk security, bug fix, and enhancement update

1.8.0.342.b07-1.0.1 - Replace upstream references Orabug: 34340145 1:1.8.0.342.b07-1 - Update to shenandoah-jdk8u342-b07 - Update release notes for shenandoah-8u342-b07. - Print release file during build, which should now include a correct SOURCE value from .src-rev - Update tarball script with...

java-11-openjdk security, bug fix, and enhancement update

1:11.0.16.0.8-1.0.1 - Replace upstream references Orabug: 34340155 1:11.0.16.0.8-1 - Update to jdk-11.0.16+8 - Update release notes to 11.0.16+8 - Use same tarball naming style as java-17-openjdk and java-latest-openjdk - Drop JDK-8257794 patch now upstreamed - Print release file during build,...

CVE-2022-28877

Technical details are not provided in the supplied documents; no concrete information on affected components, root cause, or fixes is present. Monitor for updates from vendors.

Important: Red Hat Security Advisory: java-11-openjdk security and bug fix update

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...