PT-2022-3850 · Microsoft · Azure Site Recovery

Name of the Vulnerable Software and Affected Versions: Azure Site Recovery affected versions not specified Description: The issue is related to insufficient access controls in Azure Site Recovery, specifically in the context of VMWare to Azure recovery. It may allow a remote attacker to disclose...

CVE-2021-46741: Undefined Security Weakness

The basic framework and setting module have defects, which were introduced during the design. Successful exploitation of this vulnerability may affect system integrity...

Cisco Unified Communications Manager Operational Data Access

The vulnerabilities of the Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME systems, as well as the integrated messaging system Cisco Unity Connection, are related to insufficient protection of operational data. Exploiting these...

Weak Password Change Mechanism

Description When setting a new user password it does not require knowledge of the original password Current password not required Proof of Concept 1. Log in as a regular user 2. Navigate: https://book.dansmonorage.blue/preferences/password 3. Enter any password string...

IBM Security Access Manager Appliance encryption vulnerability

IBM Security Access Manager Appliance ISAM Appliance is a network appliance-based security solution from IBM, USA. The product is mainly used for access control and Web-based threat protection, providing system performance monitoring, log analysis and diagnosis. A security vulnerability exists in...

QTS OS Command Injection

The vulnerability of the QTS operating system is related to the lack of measures taken to neutralize special elements used in the OS commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Nomad Application Privilege Escalation

The vulnerability of the Nomad application’s go-getter orchestrator library is related to deficiencies in access control when using the artifact stanza structure. Exploiting this vulnerability could allow an attacker to enhance their privileges remotely...

Slurm Resource Manager Auth Bypass

The vulnerability of the Slurm resource manager is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions from a remote location...

ColdFusio administrator.cfc Bypass Code Execution

The vulnerability of the administrator.cfc component in the ColdFusion software interface is related to insufficient protection of sensitive data. Exploiting this vulnerability allows an attacker to bypass security restrictions or execute arbitrary code...

Scripting Component Java Runtime Environment Java Development Kit

The vulnerability of the Scripting component of the Java Runtime Environment and the Java Development Kit application development tools is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to influence the integrity, accessibility, and...

Matrikon OPC Server Code Execution

The vulnerability of the IPersistFile interface implementation in the Matrikon OPC Server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Weak Password Policy

Description This application commafeed is using a weak password policy. Acunetix was able to guess the credentials required to access this page. A weak password is short, common, a system default, or something that could be rapidly guessed by executing a brute force attack using a subset of all...

Mutation Stored XSS at homepage

Description bookwyrm HTML input sanitizer is vulnerable to Mutation XSS. The payload could be stored and displayed on the homepage of the website path /feed or /discovery making it widely affects all users and the main website. Proof of Concept Edit a book description: // PoC Access to the /feed...

Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak CVE-2022-1012 kernel: race condition in perfeventopen leads to privilege escalation...

ServiceDesk Plus REST API Bypass

The vulnerability of the REST API interface implementation for the Zoho ManageEngine ServiceDesk Plus technical support service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions from a...

Android startLegacyVpnPrivileged Privilege Escalation

The vulnerability of the startLegacyVpnPrivileged component in Android operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

Enterprise Management Server OMI Privilege Escalation

The vulnerability of the enterprise management server through the Internet-based Open Management Infrastructure OMI extensions for managing virtual machines in Azure is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

Authenticated Code Module Intel system BIOS Privilege Escalation

The vulnerability of the Authenticated Code Module ACM in Intel microprogramming system BIOS is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow attackers to enhance their privileges...

Siemens SICAM P850/P855 Authentication Deficiency Log Deletion

The vulnerability of Siemens SICAM P850 and Siemens SICAM P855 multi-functional measuring devices is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to remotely delete security log files...

CVE-2022-31230

Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access...