CVE-2022-3734

A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files/Redis/dbghelp.dll. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclos...

PT-2022-5320 · Microsoft +1 · Dbghelp.Dll +1

Name of the Vulnerable Software and Affected Versions: Redis affected versions not specified Description: A critical vulnerability was found in a port or fork of Redis, affecting the dbghelp.dll library. The issue is related to an uncontrolled search path, which can be exploited remotely. The...

CVE-2022-3734

CVE-2022-3734 affects a Windows port/ fork of Redis using dbghelp.dll, enabling an uncontrolled search path due to a code issue. The vulnerability appears exploitable remotely and is labeled critical; however, the official Redis release is not affected, and the real existence of this vulnerabilit...

CVE-2022-3734 Redis on Windows dbghelp.dll uncontrolled search path

A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files/Redis/dbghelp.dll. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclos...

The vulnerability of the Decoder.Skip component in the Go programming language is related to an uncontrolled recursion, which allows a hacker to trigger a service failure.

The vulnerability of the Decoder.Skip component in the Go programming language is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PT-2022-7120 · Glib +7 · Glib +7

Name of the Vulnerable Software and Affected Versions: GLib affected versions not specified Description: The issue is related to the GVariant deserialization in GLib, which fails to validate that the input conforms to the expected format. This can lead to a denial of service. The problem is also...

AlmaLinux 8 : git-lfs (ALSA-2022:7129)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:7129 advisory. - In x/text in Go 1.15.4, an index out of range panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed ...

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and oth...

The vulnerability of the Juniper GraphQL execution environment library, related to an uncontrolled recursion, allows a attacker to cause a service failure.

The vulnerability of the Juniper GraphQL execution environment library is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Important: golang-github-gorilla-mux

Issue Overview: 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling,...

Amazon Linux 2 : golang-github-gorilla-context (ALAS-2022-1859)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1859 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2 : golang-github-kr-pty (ALAS-2022-1864)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1864 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2 : golang-github-syndtr-gocapability (ALAS-2022-1865)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1865 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2 : golang-github-gorilla-mux (ALAS-2022-1860)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1860 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2 : go-rpm-macros (ALAS-2022-1863)

The version of go-rpm-macros installed on the remote host is prior to 3.0.15-23. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1863 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this...

SUSE-SU-2022:3661-1 Security update for php8

This update for php8 fixes the following issues: - php8 was updated to version 8.0.24 - php8 was updated to version 8.0.23 jscSLE-23639. - CVE-2021-21703: Fixed a local privilege escalation via PHP-FPM. bsc1192050 - CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while...

CVE-2022-43423

Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins...

Juniper Junos OS Vulnerability (JSA69876)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA69876 advisory. - In VxLAN scenarios on EX4300-MP, EX4600, QFX5000 Series devices an Uncontrolled Memory Allocation vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Jun...

Siemens APOGEE, TALON and Desigo PXC/PXM Products

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: FTP Server of Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products Vulnerabilities: Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of these...

Siemens Nucleus RTOS FTP Server

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...