64 matches found
CVE-2022-0167
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making i...
MAL-2022-2490 Malicious code in discord-selfbot-v14 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed07aa8287d0bcafec7011cc6b8c64c1ab4a7065b9e8dcfb84995c6915a988ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-29333
CVE-2022-29333 affects CyberLink PowerDirector v14, enabling privilege escalation via a crafted executable. The public descriptions confirm a local escalation Vector with user interaction required and partial to high impact on confidentiality, integrity, and availability per CVSS metrics, but no ...
CVE-2022-24282
A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the...
CVE-2022-24281
A vulnerability has been identified in SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. A privileged authenticated attacker could execute arbitrary commands in the local database by sending specially crafted requests to the webserver of the affected application...
Privilege escalation
A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This coul...
CVE-2022-24282
A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the...
CVE-2022-24281
CVE-2022-24281 affects Siemens SINEC NMS (prior to v1.0.3) and SINEMA Server v14. Root cause is improper neutralization of special elements in SQL commands (SQL Injection). A privileged, authenticated attacker could send crafted requests to the webserver to execute arbitrary commands in the local...
PT-2022-16582 · Siemens · Sinema Server +1
Name of the Vulnerable Software and Affected Versions: SINEC NMS versions 1.0.3 and later, prior to 2.0 SINEC NMS versions prior to 1.0.3 SINEMA Server V14 all versions Description: A security issue has been found that allows the upload of JSON objects which are then deserialized into Java object...
CVE-2022-25311
A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This coul...
CVE-2022-24282
CVE-2022-24282 affects Siemens SINEC NMS and SINEMA Server V14. The vulnerability is due to insecure deserialization of user-supplied JSON objects into Java objects, allowing a privileged attacker to execute arbitrary code on the device with root privileges. Affected versions of SINEC NMS include...
CVE-2022-25311
The CVE-2022-25311 issue is an improper privilege management flaw in Siemens SINEC NMS (versions around 1.0.3 and SINEMA Server V14) where privileges are not correctly checked between users within the same browser session, enabling a authenticated low-privilege user to escalate privileges. Connec...
January 10th 2022 Security Releases
January 10th 2022 Security Releases Update 10-Jan-2022 Security releases available Updates are now available for the v17.x, v16.x, v14.x, and v12.x Node.js release lines for the following issues. Improper handling of URI Subject Alternative Names MediumCVE-2021-44531 Accepting arbitrary Subject...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Host On-Demand
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by Host On-Demand. Host On-Demand has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK and Runtime Environment updates in July 2020. Vulnerability Details CVEID:...
Node.js -- November 2020 Security Releases
Node.js reports: Updates are now available for v12.x, v14.x and v15.x Node.js release lines for the following issues. Denial of Service through DNS request CVE-2020-8277 A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of...
Security Bulletin: Vulnerability in IBM Java Runtime affects Host On-Demand
Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 8 used by Host On-Demand. Host On-Demand has addressed the applicable CVE. The issue was disclosed as part of the IBM Java SDK and Runtime Environment updates in Oracle April 2020 Critical Patch Update. Vulnerability Detai...
Node.js -- September 2020 Security Releases
Node.js reports: Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues. HTTP Request Smuggling due to CR-to-Hyphen conversion High CVE-2020-8201 Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing...
Security Bulletin: Vulnerability in IBM Java Runtime affects Host On-Demand
Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 8 used by Host On-Demand. Host On-Demand has addressed the applicable CVE. The issue was disclosed as part of the IBM Java SDK and Runtime Environment updates in January 2020. Vulnerability Details CVEID: CVE-2019-4732...
Out-of-bounds
A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System IGSS, Version 14 and prior, which could cause a software crash when data in the mdb database is manipulated...
