‼ CVE-2022-28859 ‼
📖 Read
via "National Vulnerability Database".
On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-install.sh and nethsm-thales-install.sh) expose the Net HSM partition password. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28708 ‼
📖 Read
via "National Vulnerability Database".
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SOCKS profile is configured on a virtual server, an undisclosed DNS response can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28707 ‼
📖 Read
via "National Vulnerability Database".
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility (also referred to as the BIG-IP TMUI) that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28530 ‼
📖 Read
via "National Vulnerability Database".
Sourcecodester Covid-19 Directory on Vaccination System 1.0 is vulnerable to SQL Injection via cmdcategory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29501 ‼
📖 Read
via "National Vulnerability Database".
SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges and code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27880 ‼
📖 Read
via "National Vulnerability Database".
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27662 ‼
📖 Read
via "National Vulnerability Database".
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute template language-specific instructions in the context of the server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29473 ‼
📖 Read
via "National Vulnerability Database".
On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an IPSec ALG profile is configured on a virtual server, undisclosed responses can cause Traffic Management Microkernel(TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29479 ‼
📖 Read
via "National Vulnerability Database".
On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, when an IPv6 self IP address is configured and the ipv6.strictcompliance database key is enabled (disabled by default) on a BIG-IP system, undisclosed packets may cause decreased performance. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated📖 Read
via "National Vulnerability Database".
🕴 Critical Cisco VM-Escape Bug Threatens Host Takeover 🕴
📖 Read
via "Dark Reading".
The vendor also disclosed two other security vulnerabilities that would allow remote, unauthenticated attackers to inject commands as root and snoop on sensitive user information.📖 Read
via "Dark Reading".
Darkreading
Critical Cisco VM-Escape Bug Threatens Host Takeover
The vendor also disclosed two other security vulnerabilities that would allow remote, unauthenticated attackers to inject commands as root and snoop on sensitive user information.
🕴 A Third of Americans Use Easy-to-Guess Pet Passwords 🕴
📖 Read
via "Dark Reading".
Far too many turn to Jingles, Mittens, or Bella for password inspiration, given that these are some of the easiest passwords to crack.📖 Read
via "Dark Reading".
Darkreading
A Third of Americans Use Easy-to-Guess Pet Passwords
Far too many turn to Jingles, Mittens, or Bella for password inspiration, given that these are some of the easiest passwords to crack.
🕴 NIST Issues Guidance for Addressing Software Supply-Chain Risk 🕴
📖 Read
via "Dark Reading".
Amid ongoing software supply-chain jitters, the US' top tech division is offering a finalized, comprehensive cybersecurity control framework for managing risk.📖 Read
via "Dark Reading".
Dark Reading
NIST Issues Guidance for Addressing Software Supply-Chain Risk
Amid ongoing software supply-chain jitters, the US' top tech division is offering a finalized, comprehensive cybersecurity control framework for managing risk.
‼ CVE-2022-27359 ‼
📖 Read
via "National Vulnerability Database".
Foxit PDF Reader v11.2.1.53537 was discovered to contain a NULL pointer dereference via the component FoxitPDFReader.exe. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PHP file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28577 ‼
📖 Read
via "National Vulnerability Database".
It is found that there is a command injection vulnerability in the delParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27360 ‼
📖 Read
via "National Vulnerability Database".
SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27411 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK N600R v5.3c.5507_B20171031 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter in the "Main" function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28582 ‼
📖 Read
via "National Vulnerability Database".
It is found that there is a command injection vulnerability in the setWiFiSignalCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28578 ‼
📖 Read
via "National Vulnerability Database".
It is found that there is a command injection vulnerability in the setOpenVpnCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27337 ‼
📖 Read
via "National Vulnerability Database".
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28581 ‼
📖 Read
via "National Vulnerability Database".
It is found that there is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28579 ‼
📖 Read
via "National Vulnerability Database".
It is found that there is a command injection vulnerability in the setParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.📖 Read
via "National Vulnerability Database".