CVE-2022-36438

AsusSwitch.exe on ASUS personal computers running Windows sets weak file permissions, leading to local privilege escalation this also can be used to delete files within the system arbitrarily. This affects ASUS System Control Interface 3 before 3.1.5.0, and AsusSwitch.exe before 1.0.10.0...

CVE-2022-36438

Summary: CVE-2022-36438 affects ASUS System Control Interface 3 (before 3.1.5.0) and AsusSwitch.exe (before 1.0.10.0) on Windows. The issue is weak file permissions in these components, which enables local privilege escalation and could allow arbitrary file deletion within the system. Root cause:...

SUSE-SU-2022:3602-1 Security update for libreoffice

This update for libreoffice fixes the following issues: Updated to version 7.3.6.2 jscSLE-23448: - CVE-2022-3140: Fixed macro URL arbitrary script execution bsc1203209. - CVE-2022-26305: Fixed execution of untrusted Macros due to improper certificate validation bsc1201868. - CVE-2022-26307: Fixed...

nodejs: weak randomness in WebCrypto keygen

A vulnerability was found in NodeJS due to weak randomness in the WebCrypto keygen within the SecretKeyGenTraits::DoKeyGen in src/crypto/cryptokeygen.cc. Node.js made calls to EntropySource in SecretKeyGenTraits::DoKeyGen. However, it does not check the return value and assumes the EntropySource...

RLSA-2022:6964 Important: nodejs:16 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 16. Security Fixes: nodejs: weak randomness in WebCrypto keygen CVE-2022-35255 nodej...

RLSA-2022:6963 Important: nodejs security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 16.17.1. Security Fixes: nodejs: weak randomness in WebCrypto keygen CVE-2022-35255...

nodejs security update

An update is available for nodejs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform for building fast and scalable...

RHEL 8 : nodejs:16 (RHSA-2022:6964)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6964 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

Backdoor.Win32.Redkod.d MVID-2022-0649 Hardcoded Credential

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/bb309bdd071d5733efefe940a89fcbe8.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Redkod.d Vulnerability: Weak Hardcoded Credentials Description: The malware...

Oracle Linux 9 : nodejs (ELSA-2022-6963)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6963 advisory. 16.17.1-1 - Rebase to version 16.17.1 Resolves: CVE-2022-35255 CVE-2022-35256 Tenable has extracted the preceding description block directly from the...

Exploit for Improper Authentication in Shinken-Monitoring Shinken_Monitoring

CVE-2022-37298: RCE in Shinken Monitoring Versions affecte...

Weak password vulnerability in Tianqing Hanma USG of Qixing Information Technology Group Co.

Tianqing Hanma USG is a new firewall series product officially launched by Qixing. The Tianqing Hanma USG of Qixing Information Technology Group Co., Ltd. suffers from a weak password vulnerability, which can be exploited by attackers to obtain sensitive information...

Microsoft Windows 安全漏洞

Microsoft Windows is a set of operating systems for personal devices from Microsoft Corporation USA.Microsoft Windows Web Account Manager is vulnerable to an information disclosure vulnerability that stems from inadequate protection of sensitive information on network systems or products, which...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

SAP Customer Data Cloud 加密问题漏洞

SAP Customer Data Cloud is a tool from SAP Germany that provides digital customer identity and access management. It enables companies to collect, aggregate and manage customer data across multiple touch points and applications. An encryption issue vulnerability exists in SAP Customer Data Cloud...

SAP Manufacturing Execution 路径遍历漏洞

SAP Manufacturing Execution is an integrated Manufacturing Execution System MES solution for discrete manufacturing processes from SAP. Enables MES functionality to be customized specifically for the management and control of production environments. A path traversal vulnerability exists in SAP...

PT-2022-5517 · Microsoft · Windows Dwm Core Library +1

Name of the Vulnerable Software and Affected Versions: Windows DWM Core Library affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows DWM Core Library, which can be exploited to elevate privileges. This allows an attacker to affect th...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

GHSA-PJ2C-H76W-VV6F tiny-csrf has openly visible CSRF tokens

Impact Weak encryption on CSRF so tokens can be read by malicious attackers. Patches Problems have been patched as of v1.1.0 Workarounds Upgrade to v1.1.0 References https://cheatsheetseries.owasp.org/cheatsheets/Cross-SiteRequestForgeryPreventionCheatSheet.html For more information Submit an iss...

tiny-csrf has openly visible CSRF tokens

Impact Weak encryption on CSRF so tokens can be read by malicious attackers. Patches Problems have been patched as of v1.1.0 Workarounds Upgrade to v1.1.0 References https://cheatsheetseries.owasp.org/cheatsheets/Cross-SiteRequestForgeryPreventionCheatSheet.html For more information Submit an iss...