CVE-2022-38104: Undefined Security Weakness

Auth. WordPress Options Change siteurl, userscanregister, defaultrole, adminemail and newadminemail vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin versions = 2.0.3 on WordPress...

Dell SupportAssist < 3.11.4 Multiple Vulnerabilities

According to its self-reported version number, the version of Dell SupportAssist Client is affected by multiple vulnerabilities. - Dell SupportAssist for Home PCs version 3.11.4 and prior and SupportAssist for Business PCs version 3.2.0 and prior contain information disclosure vulnerability. A...

Cisco Integrated Management Controller DoS

The vulnerability of the Web interface for managing Cisco Integrated Management Controllers involves insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to trigger a service failure through a specially crafted HTTP request...

CVE-2022-37298

Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server...

SUSE SLED12: libreoffice / libreoffice-base / etc (SUSE-SU-2022:3602-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3602-1 advisory. Updated to version 7.3.6.2 jscSLE-23448: - CVE-2022-3140: Fixed macro URL arbitrary script execution bsc120320...

NIS-HAP11AC Wireless Access Point Code Execution

The vulnerability of the NIS-HAP11AC wireless access point’s microprogramming software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code through an external port using the Telnet protocol...

SuiteCRM Access Control Unauthorized Access

The vulnerability of the SuiteCRM customer relationship management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information or cause service failures using the username of the...

Brocade Fabric OS Privilege Escalation

The vulnerability of the command-line interface of the Brocade Fabric OS is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges using commands such as “supportlink”, “firmwaredownload”, “portcfgupload”, and “fosexec”...

USN-5684-1 linux-azure vulnerabilities

It was discovered that the SUNRPC RDMA protocol implementation in the Linux kernel did not properly calculate the header size of a RPC message payload. A local attacker could use this to expose sensitive information kernel memory. CVE-2022-0812 Moshe Kol, Amit Klein and Yossi Gilad discovered tha...

PT-2022-5312 · NetGear · Netgear R6220

Name of the Vulnerable Software and Affected Versions: Netgear R6220 version 1.1.0.114 1.0.1 Description: The issue is related to incorrect access control, resulting in a command injection vulnerability. It is also described as a lack of data cleaning measures at the management level, which can b...

Hitachi Energy MicroSCADA X SYS600 Maintenance Malfunction

The vulnerability of the ICCP component of the Hitachi Energy MicroSCADA X SYS600 system management software exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to perform maintenance operations remotely...

Apache Struts DoS

The vulnerability of the Apache Struts software platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to trigger service failures through specially crafted requests with very long parameter names...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

CVE-2022-38465

A vulnerability has been identified in SIMATIC Drive Controller family All versions V2.9.2, SIMATIC ET 200SP Open Controller CPU 1515SP PC incl. SIPLUS variants All versions, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 incl. SIPLUS variants All versions V21.9, SIMATIC S7-1200 CPU family incl...

SuiteCRM SMTP Server Data Compromise

The vulnerability of the SMTP server of the SuiteCRM system for managing customer relationships is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...

PT-2022-5374 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to the implementation of the Microsoft Security Support Provider Interface SSPI in the Windows operating system, which is associated with access control weaknesses...

CVE-2020-14131: Undefined Security Weakness

The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center MiSRC to jointly ensure the safe access of millions of Xiaomi users worldwide Life...

Valmet System Authentication Bypass Code Execution

The vulnerability of the Valmet System 2019 software suite Metso DNA is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute any code on the server...

CVE-2022-31008

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker link state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions...