π¨ CVE-2020-35473
An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs that have been associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This has also been called an allowlist-based side channel.
π@cveNotify
An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs that have been associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This has also been called an allowlist-based side channel.
π@cveNotify
www.sigsac.org
ACM CCS 2022
CCS2022
π¨ CVE-2022-36077
The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround.
π@cveNotify
The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround.
π@cveNotify
GitHub
Exfiltration of hashed SMB credentials on Windows via file:// redirect
### Impact
When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, ...
When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, ...
π¨ CVE-2022-39352
OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a Γ’β¬ΛfromΓ’β¬β’ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.
π@cveNotify
OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a Γ’β¬ΛfromΓ’β¬β’ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.
π@cveNotify
GitHub
OpenFGA Authorization Bypass
### Overview
During our internal security assessment, it was discovered that OpenFGA versions v0.2.4 and prior are vulnerable to authorization bypass under certain conditions.
### Am I Affected...
During our internal security assessment, it was discovered that OpenFGA versions v0.2.4 and prior are vulnerable to authorization bypass under certain conditions.
### Am I Affected...
π¨ CVE-2022-39343
Azure RTOS FileX is a FAT-compatible file system thatΓ’β¬β’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a valid log file with correct ID and checksum is detected by the `_fx_fault_tolerant_enable` function an attempt to recover the previous failed write operation is taken by call of `_fx_fault_tolerant_apply_logs`. This function iterates through the log entries and performs required recovery operations. When properly crafted a log including entries of type `FX_FAULT_TOLERANT_DIR_LOG_TYPE` may be utilized to introduce unexpected behavior. This issue has been patched in version 6.2.0. A workaround to fix line 218 in fx_fault_tolerant_apply_logs.c is documented in the GHSA.
π@cveNotify
Azure RTOS FileX is a FAT-compatible file system thatΓ’β¬β’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a valid log file with correct ID and checksum is detected by the `_fx_fault_tolerant_enable` function an attempt to recover the previous failed write operation is taken by call of `_fx_fault_tolerant_apply_logs`. This function iterates through the log entries and performs required recovery operations. When properly crafted a log including entries of type `FX_FAULT_TOLERANT_DIR_LOG_TYPE` may be utilized to introduce unexpected behavior. This issue has been patched in version 6.2.0. A workaround to fix line 218 in fx_fault_tolerant_apply_logs.c is documented in the GHSA.
π@cveNotify
GitHub
Fault Tolerant Overflow
### Impact
The Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents.
When a valid log fil...
The Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents.
When a valid log fil...
π1
π¨ CVE-2021-37209
A vulnerability has been identified in RUGGEDCOM ROS M2100, RUGGEDCOM ROS M2200, RUGGEDCOM ROS M969, RUGGEDCOM ROS RMC, RUGGEDCOM ROS RMC20, RUGGEDCOM ROS RMC30, RUGGEDCOM ROS RMC30 V4.X, RUGGEDCOM ROS RMC40, RUGGEDCOM ROS RMC41, RUGGEDCOM ROS RMC8388, RUGGEDCOM ROS RMC8388 V4.X, RUGGEDCOM ROS RMC8388 V5.X, RUGGEDCOM ROS RP110, RUGGEDCOM ROS RP110 V4.X, RUGGEDCOM ROS RS1600 V4.X, RUGGEDCOM ROS RS1600F V4.X, RUGGEDCOM ROS RS1600T V4.X, RUGGEDCOM ROS RS400, RUGGEDCOM ROS RS400 V4.X, RUGGEDCOM ROS RS401, RUGGEDCOM ROS RS401 V4.X, RUGGEDCOM ROS RS416, RUGGEDCOM ROS RS416Pv2 V4.X, RUGGEDCOM ROS RS416Pv2 V5.X, RUGGEDCOM ROS RS416v2, RUGGEDCOM ROS RS416v2 V4.X, RUGGEDCOM ROS RS416v2 V5.X, RUGGEDCOM ROS RS8000, RUGGEDCOM ROS RS8000 V4.X, RUGGEDCOM ROS RS8000A, RUGGEDCOM ROS RS8000A V4.X, RUGGEDCOM ROS RS8000H, RUGGEDCOM ROS RS8000H V4.X, RUGGEDCOM ROS RS8000T, RUGGEDCOM ROS RS8000T V4.X, RUGGEDCOM ROS RS900 (32M), RUGGEDCOM ROS RS900 (32M) V4.X, RUGGEDCOM ROS RS900 (32M) V5.X, RUGGEDCOM ROS RS900 V4.X, RUGGEDCOM ROS RS900G, RUGGEDCOM ROS RS900G (32M), RUGGEDCOM ROS RS900G (32M) V4.X, RUGGEDCOM ROS RS900G (32M) V5.X, RUGGEDCOM ROS RS900G V4.X, RUGGEDCOM ROS RS900GP, RUGGEDCOM ROS RS900GP V4.X, RUGGEDCOM ROS RS900L, RUGGEDCOM ROS RS900L V4.X, RUGGEDCOM ROS RS900M V4.X, RUGGEDCOM ROS RS900W, RUGGEDCOM ROS RS900W V4.X, RUGGEDCOM ROS RS910, RUGGEDCOM ROS RS910 V4.X, RUGGEDCOM ROS RS910L, RUGGEDCOM ROS RS910L V4.X, RUGGEDCOM ROS RS910W, RUGGEDCOM ROS RS910W V4.X, RUGGEDCOM ROS RS920L, RUGGEDCOM ROS RS920L V4.X, RUGGEDCOM ROS RS920W, RUGGEDCOM ROS RS920W V4.X, RUGGEDCOM ROS RS930L, RUGGEDCOM ROS RS930L V4.X, RUGGEDCOM ROS RS930W, RUGGEDCOM ROS RS930W V4.X, RUGGEDCOM ROS RS940G, RUGGEDCOM ROS RS940G V4.X, RUGGEDCOM ROS RS969, RUGGEDCOM ROS RSG2100, RUGGEDCOM ROS RSG2100 (32M), RUGGEDCOM ROS RSG2100 (32M) V4.X, RUGGEDCOM ROS RSG2100 (32M) V5.X, RUGGEDCOM ROS RSG2100 V4.X, RUGGEDCOM ROS RSG2100P, RUGGEDCOM ROS RSG2100P V4.X, RUGGEDCOM ROS RSG2200, RUGGEDCOM ROS RSG2200 V4.X, RUGGEDCOM ROS RSG2288, RUGGEDCOM ROS RSG2288 V4.X, RUGGEDCOM ROS RSG2288 V5.X, RUGGEDCOM ROS RSG2300, RUGGEDCOM ROS RSG2300 V4.X, RUGGEDCOM ROS RSG2300 V5.X, RUGGEDCOM ROS RSG2300P, RUGGEDCOM ROS RSG2300P V4.X, RUGGEDCOM ROS RSG2300P V5.X, RUGGEDCOM ROS RSG2488, RUGGEDCOM ROS RSG2488 V4.X, RUGGEDCOM ROS RSG2488 V5.X, RUGGEDCOM ROS RSG907R, RUGGEDCOM ROS RSG907R V5.X, RUGGEDCOM ROS RSG908C, RUGGEDCOM ROS RSG908C V5.X, RUGGEDCOM ROS RSG909R, RUGGEDCOM ROS RSG909R V5.X, RUGGEDCOM ROS RSG910C, RUGGEDCOM ROS RSG910C V5.X, RUGGEDCOM ROS RSG920P, RUGGEDCOM ROS RSG920P V4.X, RUGGEDCOM ROS RSG920P V5.X, RUGGEDCOM ROS RSL910, RUGGEDCOM ROS RSL910 V5.X, RUGGEDCOM ROS RST2228, RUGGEDCOM ROS RST2228 V5.X, RUGGEDCOM ROS RST2228P, RUGGEDCOM ROS RST2228P V5.X, RUGGEDCOM ROS RST916C, RUGGEDCOM ROS RST916C V5.X, RUGGEDCOM ROS RST916P, RUGGEDCOM ROS RST916P V5.X, RUGGEDCOM ROS i800, RUGGEDCOM ROS i800 V4.X, RUGGEDCOM ROS i801, RUGGEDCOM ROS i801 V4.X, RUGGEDCOM ROS i802, RUGGEDCOM ROS i802 V4.X, RUGGEDCOM ROS i803, RUGGEDCOM ROS i803 V4.X. The SSH server on affected devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device.
π@cveNotify
A vulnerability has been identified in RUGGEDCOM ROS M2100, RUGGEDCOM ROS M2200, RUGGEDCOM ROS M969, RUGGEDCOM ROS RMC, RUGGEDCOM ROS RMC20, RUGGEDCOM ROS RMC30, RUGGEDCOM ROS RMC30 V4.X, RUGGEDCOM ROS RMC40, RUGGEDCOM ROS RMC41, RUGGEDCOM ROS RMC8388, RUGGEDCOM ROS RMC8388 V4.X, RUGGEDCOM ROS RMC8388 V5.X, RUGGEDCOM ROS RP110, RUGGEDCOM ROS RP110 V4.X, RUGGEDCOM ROS RS1600 V4.X, RUGGEDCOM ROS RS1600F V4.X, RUGGEDCOM ROS RS1600T V4.X, RUGGEDCOM ROS RS400, RUGGEDCOM ROS RS400 V4.X, RUGGEDCOM ROS RS401, RUGGEDCOM ROS RS401 V4.X, RUGGEDCOM ROS RS416, RUGGEDCOM ROS RS416Pv2 V4.X, RUGGEDCOM ROS RS416Pv2 V5.X, RUGGEDCOM ROS RS416v2, RUGGEDCOM ROS RS416v2 V4.X, RUGGEDCOM ROS RS416v2 V5.X, RUGGEDCOM ROS RS8000, RUGGEDCOM ROS RS8000 V4.X, RUGGEDCOM ROS RS8000A, RUGGEDCOM ROS RS8000A V4.X, RUGGEDCOM ROS RS8000H, RUGGEDCOM ROS RS8000H V4.X, RUGGEDCOM ROS RS8000T, RUGGEDCOM ROS RS8000T V4.X, RUGGEDCOM ROS RS900 (32M), RUGGEDCOM ROS RS900 (32M) V4.X, RUGGEDCOM ROS RS900 (32M) V5.X, RUGGEDCOM ROS RS900 V4.X, RUGGEDCOM ROS RS900G, RUGGEDCOM ROS RS900G (32M), RUGGEDCOM ROS RS900G (32M) V4.X, RUGGEDCOM ROS RS900G (32M) V5.X, RUGGEDCOM ROS RS900G V4.X, RUGGEDCOM ROS RS900GP, RUGGEDCOM ROS RS900GP V4.X, RUGGEDCOM ROS RS900L, RUGGEDCOM ROS RS900L V4.X, RUGGEDCOM ROS RS900M V4.X, RUGGEDCOM ROS RS900W, RUGGEDCOM ROS RS900W V4.X, RUGGEDCOM ROS RS910, RUGGEDCOM ROS RS910 V4.X, RUGGEDCOM ROS RS910L, RUGGEDCOM ROS RS910L V4.X, RUGGEDCOM ROS RS910W, RUGGEDCOM ROS RS910W V4.X, RUGGEDCOM ROS RS920L, RUGGEDCOM ROS RS920L V4.X, RUGGEDCOM ROS RS920W, RUGGEDCOM ROS RS920W V4.X, RUGGEDCOM ROS RS930L, RUGGEDCOM ROS RS930L V4.X, RUGGEDCOM ROS RS930W, RUGGEDCOM ROS RS930W V4.X, RUGGEDCOM ROS RS940G, RUGGEDCOM ROS RS940G V4.X, RUGGEDCOM ROS RS969, RUGGEDCOM ROS RSG2100, RUGGEDCOM ROS RSG2100 (32M), RUGGEDCOM ROS RSG2100 (32M) V4.X, RUGGEDCOM ROS RSG2100 (32M) V5.X, RUGGEDCOM ROS RSG2100 V4.X, RUGGEDCOM ROS RSG2100P, RUGGEDCOM ROS RSG2100P V4.X, RUGGEDCOM ROS RSG2200, RUGGEDCOM ROS RSG2200 V4.X, RUGGEDCOM ROS RSG2288, RUGGEDCOM ROS RSG2288 V4.X, RUGGEDCOM ROS RSG2288 V5.X, RUGGEDCOM ROS RSG2300, RUGGEDCOM ROS RSG2300 V4.X, RUGGEDCOM ROS RSG2300 V5.X, RUGGEDCOM ROS RSG2300P, RUGGEDCOM ROS RSG2300P V4.X, RUGGEDCOM ROS RSG2300P V5.X, RUGGEDCOM ROS RSG2488, RUGGEDCOM ROS RSG2488 V4.X, RUGGEDCOM ROS RSG2488 V5.X, RUGGEDCOM ROS RSG907R, RUGGEDCOM ROS RSG907R V5.X, RUGGEDCOM ROS RSG908C, RUGGEDCOM ROS RSG908C V5.X, RUGGEDCOM ROS RSG909R, RUGGEDCOM ROS RSG909R V5.X, RUGGEDCOM ROS RSG910C, RUGGEDCOM ROS RSG910C V5.X, RUGGEDCOM ROS RSG920P, RUGGEDCOM ROS RSG920P V4.X, RUGGEDCOM ROS RSG920P V5.X, RUGGEDCOM ROS RSL910, RUGGEDCOM ROS RSL910 V5.X, RUGGEDCOM ROS RST2228, RUGGEDCOM ROS RST2228 V5.X, RUGGEDCOM ROS RST2228P, RUGGEDCOM ROS RST2228P V5.X, RUGGEDCOM ROS RST916C, RUGGEDCOM ROS RST916C V5.X, RUGGEDCOM ROS RST916P, RUGGEDCOM ROS RST916P V5.X, RUGGEDCOM ROS i800, RUGGEDCOM ROS i800 V4.X, RUGGEDCOM ROS i801, RUGGEDCOM ROS i801 V4.X, RUGGEDCOM ROS i802, RUGGEDCOM ROS i802 V4.X, RUGGEDCOM ROS i803, RUGGEDCOM ROS i803 V4.X. The SSH server on affected devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device.
π@cveNotify
π¨ CVE-2022-23219
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
π@cveNotify
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
π@cveNotify
π¨ CVE-2022-23218
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
π@cveNotify
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
π@cveNotify
π¨ CVE-2022-39209
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
π@cveNotify
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
π@cveNotify
GitHub
Unbounded resource exhaustion may lead to denial of service
### Impact
A polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service.
### Patches
This vulnerabili...
A polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service.
### Patches
This vulnerabili...
π¨ CVE-2022-43566
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged userβs permissions to bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards in the Analytics Workspace. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
π@cveNotify
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged userβs permissions to bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards in the Analytics Workspace. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
π@cveNotify
Splunk Vulnerability Disclosure
Risky command safeguards bypass via Search ID query in Analytics Workspace in Splunk Enterprise
π¨ CVE-2022-21944
A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.
π@cveNotify
A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.
π@cveNotify
π¨ CVE-2022-43565
In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the βtstats command handles Javascript Object Notation (JSON) lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser.
π@cveNotify
In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the βtstats command handles Javascript Object Notation (JSON) lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser.
π@cveNotify
Splunk Vulnerability Disclosure
Risky command safeguards bypass via βtstatsβ command JSON in Splunk Enterprise
π¨ CVE-2020-26932
debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode 4750 (for access by the sympa group)
π@cveNotify
debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode 4750 (for access by the sympa group)
π@cveNotify
GitLab
Restrict access to sympa_newaliases-wrapper (setuid root) to group sympa (!1) Β· Merge requests Β· Debian Sympa Team / sympa Β· GitLab
Following https://security-tracker.debian.org/tracker/CVE-2020-10936 and upcoming issues from https://github.com/sympa-community/sympa/issues/943 , I suggest removing 'other' access to sympa_newaliases-wrapper which is setuid...
π¨ CVE-2020-10714
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
π@cveNotify
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
π@cveNotify
π¨ CVE-2022-44732
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
π@cveNotify
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
π@cveNotify
Acronis
Acronis Advisory Database - Acronis
Acronis Advisory Database. Find information about the latest security advisories and updates for Acronis products.
π¨ CVE-2002-20001
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
π@cveNotify
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
π@cveNotify
GitHub
GitHub - c0r0n3r/dheater: D(HE)ater is a proof of concept implementation of the D(HE)at attack (CVE-2002-20001) through whichβ¦
D(HE)ater is a proof of concept implementation of the D(HE)at attack (CVE-2002-20001) through which denial-of-service can be performed by enforcing the Diffie-Hellman key exchange. (read-only clon...
π¨ CVE-2021-42550
In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
π@cveNotify
In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
π@cveNotify
GitHub
GitHub - cn-panda/logbackRceDemo: The project is a simple vulnerability Demo environment written by SpringBoot. Here, I deliberatelyβ¦
The project is a simple vulnerability Demo environment written by SpringBoot. Here, I deliberately wrote a vulnerability environment where there are arbitrary file uploads, and then use the `scan` ...
π¨ CVE-2022-37894
An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
π@cveNotify
An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
π@cveNotify
π¨ CVE-2022-37895
An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
π@cveNotify
An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
π@cveNotify
π¨ CVE-2022-37885
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.
π@cveNotify
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.
π@cveNotify
π¨ CVE-2022-37892
A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victimβs browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address this security vulnerability.
π@cveNotify
A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victimβs browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address this security vulnerability.
π@cveNotify
π¨ CVE-2022-37896
A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victimβs browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
π@cveNotify
A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victimβs browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
π@cveNotify