‼ CVE-2022-41741 ‼
📖 Read
via "National Vulnerability Database".
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41691 ‼
📖 Read
via "National Vulnerability Database".
When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41694 ‼
📖 Read
via "National Vulnerability Database".
In BIG-IP versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, and BIG-IQ versions 8.x before 8.2.0.1 and all versions of 7.x, when an SSL key is imported on a BIG-IP or BIG-IQ system, undisclosed input can cause MCPD to terminate.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41806 ‼
📖 Read
via "National Vulnerability Database".
In versions 16.1.x before 16.1.3.2 and 15.1.x before 15.1.5.1, when BIG-IP AFM Network Address Translation policy with IPv6/IPv4 translation rules is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41624 ‼
📖 Read
via "National Vulnerability Database".
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iRule is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31684 ‼
📖 Read
via "National Vulnerability Database".
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41832 ‼
📖 Read
via "National Vulnerability Database".
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when a SIP profile is configured on a virtual server, undisclosed messages can cause an increase in memory resource utilization.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41780 ‼
📖 Read
via "National Vulnerability Database".
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI that allows an attacker to read arbitrary files.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41983 ‼
📖 Read
via "National Vulnerability Database".
On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause BIG-IP to send data unencrypted even with an SSL Profile applied.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41813 ‼
📖 Read
via "National Vulnerability Database".
In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when BIG-IP is provisioned with PEM or AFM module, an undisclosed input can cause Traffic Management Microkernel (TMM) to terminate.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36795 ‼
📖 Read
via "National Vulnerability Database".
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive Window Enabled is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41617 ‼
📖 Read
via "National Vulnerability Database".
In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41743 ‼
📖 Read
via "National Vulnerability Database".
NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when the hls directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_hls_module.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41836 ‼
📖 Read
via "National Vulnerability Database".
When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41742 ‼
📖 Read
via "National Vulnerability Database".
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-41833 ‼
📖 Read
via "National Vulnerability Database".
In all BIG-IP 13.1.x versions, when an iRule containing the HTTP::collect command is configured on a virtual server, undisclosed requests can cause Traffic Management Microkernel (TMM) to terminate.📖 Read
via "National Vulnerability Database".
🕴 Microsoft Customer Data Exposed by Misconfigured Server 🕴
📖 Read
via "Dark Reading".
The data exposure was the result of an "unintentional misconfiguration on an endpoint" and not a security vulnerability, Microsoft said.📖 Read
via "Dark Reading".
Dark Reading
Microsoft Customer Data Exposed by Misconfigured Server
The data exposure was the result of an "unintentional misconfiguration on an endpoint" and not a security vulnerability, Microsoft said.
🤯2🤔1
‼ CVE-2022-3327 ‼
📖 Read
via "National Vulnerability Database".
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41358 ‼
📖 Read
via "National Vulnerability Database".
A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the categoriesName parameter in createCategories.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37598 ‼
📖 Read
via "National Vulnerability Database".
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33231 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in New equipment page in EasyVista Service Manager 2018.1.181.1 allows remote attackers to run arbitrary code via the notes field.📖 Read
via "National Vulnerability Database".