CVE-2022-1155: Undefined Security Weakness

Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...

PT-2022-12294

Name of the Vulnerable Software and Affected Versions MEPSAN's USC+ versions prior to 3.0 Description A weakness in the login function of the affected software allows attackers to generate high-privileged account passwords. Recommendations For versions prior to 3.0, update to version 3.0 or later...

MySQL InnoDB Data Compromise

The vulnerability of the InnoDB component of the MySQL Database Server exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise data integrity and cause service failures...

Security Advisory 0073

Security Advisory 0073 . CSAF PDF Date: March 29th, 2022 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | March 29th, 2022 | Initial Release The CVE-ID tracking this issue: CVE-2021-28505 CVSSv3.1 Base Score: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Common Weakness Enumeration:...

APC Smart-UPS Power Supply Authentication Bypass

The vulnerability of microprogrammed power supply systems from APC Smart-UPS models series SMT, SMC, SCL, SMX, SRT, and SRTL is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to arbitrarily alter the behavior of the U...

CVE-2021-27428

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without...

Code injection

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without...

WinSock Driver Privilege Escalation

The vulnerability of the WinSock driver in the Microsoft Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

Weak Deserializer

org.apache.dubbo:dubbo and com.alibaba:dubbo are using weak deserializers. An attacker is able to provoke the library to use a weak deserializer to be used by tampering with the byte preamble flags, not following the server's instruction...

Win32k Privilege Escalation

The vulnerability of the Win32k component of the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2021-39716: Undefined Security Weakness

Product: AndroidVersions: Android kernelAndroid ID: A-206977562References: N/A...

CVE-2021-39723: Undefined Security Weakness

Product: AndroidVersions: Android kernelAndroid ID: A-209014813References: N/A...

CVE-2021-39737: Undefined Security Weakness

Product: AndroidVersions: Android kernelAndroid ID: A-208229524References: N/A...

CVE-2021-39720: Undefined Security Weakness

Product: AndroidVersions: Android kernelAndroid ID: A-207433926References: N/A...

CVE-2021-39710: Undefined Security Weakness

Product: AndroidVersions: Android kernelAndroid ID: A-202160245References: N/A...

Vulnerabilities fixed in APC UPS systems

Vulnerabilities have been fixed in Uninterruptible Power Supply UPS systems from APC. APC is part of Schneider Electric. These UPS systems are widely used in situations where up-time is very important. The vulnerabilities with reference CVE-2022-22805 and CVE-2022-22806 allow a remote malicious...

NETGEAR Router Service Information Disclosure

The vulnerability of the embedded software of NETGEAR routers such as EX6100v2, EX6150v2, EX6250, EX6400, EX6400v2, EX6410, EX6420, EX7300, EX7300v2, EX7320, EX7700, LBR1020, LBR20, RBK352, RBK50, RBR350, RBR50, and RBS350 lies in the lack of protection for service data. Exploiting this...

Microsoft Azure 'AutoWarp' Bug Could Have Let Attackers Access Customers' Accounts

Details have been disclosed about a now-addressed critical vulnerability in Microsoft's Azure Automation service that could have permitted unauthorized access to other Azure customer accounts and take over control. "This attack could mean full control over resources and data belonging to the...

CVE-2021-36171

The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame...

Fortinet FortiPortal security feature vulnerability

Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for use by MSPs. versions, a security feature issue vulnerability exists that stems from the use o...