‼ CVE-2022-0851 ‼
📖 Read
via "National Vulnerability Database".
There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line via e.g. htop or ps. The specific impact varies upon the subscription, but generally this would allow an attacker to register systems purchased by the victim until discovered; a form of fraud. This could occur regardless of how the activation key is supplied to convert2rhel because it involves how convert2rhel provides it to subscription-manager.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0480 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1043 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to corrupt system memory, crash the system or escalate privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2961 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31677 ‼
📖 Read
via "National Vulnerability Database".
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0852 ‼
📖 Read
via "National Vulnerability Database".
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0358 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35020 ‼
📖 Read
via "National Vulnerability Database".
Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component __interceptor_memcpy at /sanitizer_common/sanitizer_common_interceptors.inc.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36686 ‼
📖 Read
via "National Vulnerability Database".
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=reports/stockin&month=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36690 ‼
📖 Read
via "National Vulnerability Database".
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_user&id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36688 ‼
📖 Read
via "National Vulnerability Database".
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=reports/stockout&month=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36689 ‼
📖 Read
via "National Vulnerability Database".
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=reports/waste&month=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35018 ‼
📖 Read
via "National Vulnerability Database".
Advancecomp v2.3 was discovered to contain a segmentation fault.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35017 ‼
📖 Read
via "National Vulnerability Database".
Advancecomp v2.3 was discovered to contain a heap buffer overflow.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1199 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0400 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0367 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.📖 Read
via "National Vulnerability Database".
⚠ Firefox 104 is out – no critical bugs, but update anyway ⚠
📖 Read
via "Naked Security".
Two trust-spoofing bugs were the main culprits this month - but neither one was a zero-day.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ LastPass source code breach – do we still recommend password managers? ⚠
📖 Read
via "Naked Security".
What does the recent LastPass breach mean for password managers? Just a bump in the road, or a reason to ditch them entirely?📖 Read
via "Naked Security".
Naked Security
LastPass source code breach – do we still recommend password managers?
What does the recent LastPass breach mean for password managers? Just a bump in the road, or a reason to ditch them entirely?
🕴 3 Ways No-Code Developers Can Shoot Themselves in the Foot 🕴
📖 Read
via "Dark Reading".
Low/no-code tools allow citizen developers to design creative solutions to address immediate problems, but without sufficient training and oversight, the technology can make it easy to make security mistakes.📖 Read
via "Dark Reading".
Dark Reading
3 Ways No-Code Developers Can Shoot Themselves in the Foot
Low/no-code tools allow citizen developers to design creative solutions to address immediate problems, but without sufficient training and oversight, the technology can make it easy to make security mistakes.
‼ CVE-2022-27547 ‼
📖 Read
via "National Vulnerability Database".
HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.📖 Read
via "National Vulnerability Database".