Code injection

A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow local unauthorized data injection. HPE has made the following software updates to resolve the vulnerability in HPE Superdome Flex firmware...

CVE-2022-37933

HPE Superdome Flex and Superdome Flex 280 servers are affected by CVE-2022-37933. Affects: HPE Superdome Flex firmware 3.60.50 and below; HPE Superdome Flex 280 firmware 1.40.60 and below. Issue causes local unauthorized data injection. Remediation: upgrade to firmware versions above 3.60.50 (for...

PT-2023-13558 · Hewlett Packard · Hpe Superdome Flex +1

Name of the Vulnerable Software and Affected Versions: HPE Superdome Flex versions 3.60.50 and below HPE Superdome Flex 280 servers versions 1.40.60 and below Description: A potential security issue has been identified in HPE Superdome Flex and Superdome Flex 280 servers, which could allow local...

Design/Logic Flaw

Out-of-bounds read was discovered in YDB server. An attacker could construct a query with insert statement that would allow him to read sensitive information from other memory locations or cause a crash...

CVE-2022-44565

An improper access validation vulnerability exists in airMAX AC 8.7.11, airFiber 60/LR 2.6.2, airFiber 60 XG/HD v1.0.0 and airFiber GBE 1.4.1 that allows a malicious actor to retrieve status and usage data from the UISP device...

The vulnerability of the endpoint protection module of the Anti-Ransomware analysis tool for network traffic, network detection, and response of the Cortex XDR Agent on Windows operating systems allows attackers to gain unauthorized access to protected information.

The vulnerability of the endpoint protection module of the Anti-Ransomware analysis tool for network traffic, network detection, and response of the Cortex XDR Agent on Windows operating systems is related to insufficient protection of operational data. Exploiting this vulnerability can allow...

PT-2022-6071 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 19.5 GA Description: The issue is related to a post-auth read-only SQL injection vulnerability in the User Portal component of Sophos Firewall. This vulnerability can be exploited by a remote attacker to gain...

PT-2023-2665

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u361, 8u361-perf, 11.0.18, 17.0.6, 20 Oracle GraalVM Enterprise Edition versions 20.3.9, 21.3.5, 22.3.1 Description The issue allows an unauthenticated attacker with network access via multiple protocols to compromise...

PT-2022-25876 · Unknown · Record Management System +1

Name of the Vulnerable Software and Affected Versions: Record Management System using CodeIgniter version 1.0 Description: The issue allows attackers to access and modify user data due to an access control problem in the /Admin/dashboard.php endpoint. Recommendations: For Record Management System...

The vulnerability of the Indirect Branch Prediction Barrier (IBPB) implementation in AMD microprogramming software allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Indirect Branch Prediction Barrier IBPB implementation in AMD microprocessors is related to improper cleaning of the RAS stack. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a secondary channel...

The vulnerability of the vector graphics editor CorelDRAW Graphics Suite (formerly CorelDRAW) lies in the ability to read data beyond the buffer boundaries in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the CorelDRAW Graphics Suite formerly CorelDRAW graphic editor relates to reading data beyond the buffer boundaries in memory during the syntactic parsing of BMP files. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information by...

CVE-2022-3780

Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. This issue affects : Remote Desktop Manager 2022.3.7 and prior versions...

Vulnerability of the Installer component: The general installer for MySQL allows a perpetrator to gain access to read, modify, add, or delete data, or to trigger a crash.

Vulnerability of the Installer component: The MySQL Installer component is vulnerable due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to gain access to read, modify, add, or delete data, or cause the installation process to terminate abnormally...

The vulnerability of the J-Web interface in Juniper Networks Junos OS allows a perpetrator to gain unauthorized access to protected information or execute arbitrary commands.

The vulnerability of the J-Web interface in Juniper Networks Junos OS operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information or execute arbitrary commands ...

mysql: Server: DDL unspecified vulnerability (CPU Oct 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2022)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

The vulnerability of the kernel-level driver nvlddmkm.sys from NVIDIA’s graphics processing units, including GeForce, Quadro, NVS, and Tesla, for Windows operating systems, allows attackers to cause system failures or gain unauthorized access to protected information.

The vulnerability of the kernel mode driver nvlddmkm.sys of NVIDIA’s graphics processing unit software products such as GeForce, Quadro, NVS, and Tesla for Windows operating systems is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to caus...

CVE-2022-21630

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime SEC. Supported versions that are affected are 9.2.6.4 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...

CVE-2022-21639

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search Integration. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...