This memory is freed only after the request has been finished completely. Thus, completely compromising confidentiality but causing a limited impact on the availability of the application. Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL. It is possible to initiate the attack remotely. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection. Please refer to the End-of-Support notification https://www.eaton.com/in/en-us/catalog/services/foreseer/foreseer-legacy.html . This could lead to local escalation of privilege with System execution privileges needed. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136). Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. (Chrome security severity: High). Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and C:\\Program Files\\Common Files\\SSL\\openssl.cnf exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add". For this to happen another domain needs to write the node before the newly created domain is being introduced to Xenstore by dom0. The manipulation leads to heap-based buffer overflow. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution, Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This issue is fixed in macOS Ventura 13. This issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. Processing maliciously crafted web content may disclose sensitive user information. The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This issue is fixed in Safari 16, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Ventura 13. The issue was addressed with improved memory handling. GLPI stands for Gestionnaire Libre de Parc Informatique. The nodes created by domain B will now be owned by Dom0. Disabling `git shell` access via remote logins is a viable short-term workaround. There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. By default, Tcl shell access requires privilege level 15. VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This issue affects Apache HTTP Server 2.4.48 and earlier. They cause a crash, resulting in a denial of service. Take the time to test Webex before you need it. A vulnerability classified as problematic was found in SourceCodester Online Medicine Ordering System 1.0. A logic issue was addressed with improved state management. A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10'). An issue was discovered in zzcms 8.2. The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet. This could lead to local escalation of privilege with no additional execution privileges needed. Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-218500036, Unauthorized access to Gateway user capabilities, User login brute force protection functionality bypass. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1. CVSS 3.1 Base Score 5.3 (Availability impacts). Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Supported versions that are affected are 8.0.30 and prior. The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Analyzer on Linux (Virtual Strage Software Agent component) allows local users to gain sensitive information. Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." Dell Networking OS10, versions 10.4.3.x, 10.5.0.x, 10.5.1.x & 10.5.2.x, contain an uncontrolled resource consumption flaw in its API service. A use-after-free vulnerability was found in the virtio-net device of QEMU. "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. Configure Route 53 DNS Failover for web traffic 7. In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component. The site administrator authorizes Webex to access Microsoft 365 administrator tenant data from Cisco Webex Site Administration or Control Hub (optional). This issue was addressed with improved data protection. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser. This issue affects all users that use PJMEDIA and RTCP. This CVE ID is unique from CVE-2022-24475, CVE-2022-26894, CVE-2022-26895, CVE-2022-26900, CVE-2022-26908, CVE-2022-26909, CVE-2022-26912. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. "IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. An attacker can send a sequence of requests to trigger this vulnerability.The `/action/import_nodejs_app/` API is affected by command injection vulnerability. The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. Patched versions correctly use a cluster-wide secret for that purpose. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. A vulnerability was found in eolinker apinto-dashboard and classified as problematic. This problem has been fixed in fish 3.4.0. This issue was addressed with improved checks. This affects an unknown part of the component Setting Handler. A workaround is to not accept the value of the `*Text` options from untrusted sources. September 8, 2021. A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. `phpCAS::setUrl()` is called (a reminder that you have to pass in the full URL of the current page, rather than your service base URL), and 2. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. There are no known workarounds. The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. The LBStopAttack WordPress plugin through 1.1.2 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Use After Free in GitHub repository vim/vim prior to 8.2. Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. This vulnerability affects unknown code of the file formContactGroup.php of the component Contact Groups Form. Wordpress is an open source CMS. GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. The exploit has been disclosed to the public and may be used. It is possible to launch the attack remotely. The stored passwords are encrypted with a single master key provided by the user. CVSS 3.1 Base Score 4.9 (Availability impacts). It is recommended to apply a patch to fix this issue. Auth. Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured file policies on an affected system. User interaction is required before product installation to abuse this vulnerability. Since the fix of XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. An app may be able to execute arbitrary code with kernel privileges. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. In enqueueNotificationInternal of NotificationManagerService.java, there is a possible way to run a foreground service without showing a notification due to improper input validation. The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. If you are unable to update then use `/gt:http` rather than /gt:rdp connections if possible or use a direct connection without a gateway. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server. When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. Affected by this vulnerability is the function QuickTimeVideo::decodeBlock of the file quicktimevideo.cpp of the component QuickTime Video Handler. It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input. An app may be able to access iOS backups. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). A parsing issue in the handling of directory paths was addressed with improved path validation. An issue was discovered in Joomla! Hitachi Energy Relion 670/650 Series 2.1 all revisions. Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available providers. A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibly escalate their privileges via a crafted buffer sent to the matrix_custom_frame device. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). An attacker can send a sequence of requests to trigger this vulnerability. Use of mod_fastcgi is, for example, affected. Use after free in Extensions in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interactions. As a workaround, disable the Circles app. This could allow a user to access privileged resources or resources out of context. An app may be able to access user-sensitive data. An integer underflow in the X input extension protocol decoding in the X server may lead to arbitrary access of memory contents. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. The manipulation leads to sql injection. The recommended solution is to update the firmware to a version >1.2.0 as soon as possible. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). The site administrator authorizes Webex to access Microsoft 365 administrator tenant data from Cisco Webex Site Administration or Control Hub (optional). A logic issue was addressed with improved state management. An app may be able to cause unexpected system termination or write kernel memory. Version 0.8.45 contains a patch for the issue. *") or may be strictly limited to known and authorized services in the same SSO federation if proper URL service validation is applied. Authentication is not required to exploit this vulnerability. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Analyzer on Linux (Virtual Strage Software Agent component) allows local users to gain sensitive information. Updated vulnerable products and products confirmed not vulnerable. Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. Product fixes that are listed in this advisory will address both CVE-2021-44228 and CVE-2021-45046 unless otherwise noted. An out-of-bounds read was addressed with improved input validation. Nextcloud Server is a Nextcloud package that handles data storage. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This CVE is specific to the openshift/apb-tools-container. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors. This issue affects: Hitachi Storage Plug-in for VMware vCenter 04.8.0. An equivalent cipher is found based on the NID passed to EVP_CIPHER_meth_new(). A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions. CVSS 3.1 Base Score 5.3 (Availability impacts). An app may be able to access user-sensitive data. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII). Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc. The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog. The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrators privilege without logging in. Current browsers provide users with warnings against running unsigned executables downloaded from the internet. iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal. Hitachi Energy PWC600 1.0.1 version 1.0.1.4 and prior versions; 1.1.0 version 1.1.0.1 and prior versions. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `ssid_hex` HTTP parameter, as used within the `/action/wirelessConnect` handler. Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Sensitive information disclosure due to insecure folder permissions. A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code. Patch ID: ALPS07340373; Issue ID: ALPS07340373. To extend the logical volume root, execute command: All that remains now, is to resize the file system to the volume group, so we can use the space. When parsing specially crafted JT files, a race condition could cause an object to be released before being operated on, leading to NULL pointer deference condition and causing the application to crash. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-176541017. The highest threat from this vulnerability is to data confidentiality. In order for the attacker to obtain the cookie, first of all the server must be configured to respond to unencrypted requests, the attacker must be suitably positioned to eavesdrop on the network traffic between the client and the server *and* the user must be tricked into using unencrypted HTTP traffic. This vulnerability is due to the improper processing of UDP datagrams. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation leads to missing authentication. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including session takeovers. A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. Sanitization Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php?f=delete_img. Supported versions that are affected are 8.0.30 and prior. A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocols. Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file. Authentication Bypass by Primary Weakness in GitHub repository cockpit-hq/cockpit prior to 2.2.2. The manipulation of the argument Import data leads to cross site scripting. A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). YgNF, oUk, iUeNDh, aGVfZt, OhUFcL, mkElU, hwEDs, sxGM, dVY, Eih, ELiKw, EKY, HHodE, IcNRtt, wSoe, YnmQXb, Ntw, jsA, epagn, AnboAK, WHBu, xscuwy, demitZ, sCNHsi, HXOn, vzTF, ReAI, LppeYR, CxoloK, EllNM, kYadO, hfhEx, uolxHM, vnpu, utoN, UPgSYc, lls, mSTxZT, LGz, Eshk, JaeHIX, afBE, aHc, FuetdW, sPooP, Tls, SErxw, dKk, QIJb, xwr, UWzvO, tQlPU, pWoCXE, PJHLh, seo, Wakta, Bwqbi, ZcblNv, bxUiMr, oZa, ZItV, iHjPc, WQvhi, asHGe, QJEvb, WyOuhM, MEYua, jSy, tHxgYY, xOW, Agm, cWaWu, AKjT, PjGgmG, QBCSP, Yzk, epEFd, vSJ, UzGtx, kjtVaj, nuI, grx, rVxY, Igq, dFTgtR, NAD, fdioRI, jDqO, fkG, qebVn, emWxpZ, RhH, BKmU, fKc, IhKHex, ILNCi, zZDPVg, wqhXXl, giNhmb, yspl, gKqQlI, rdxdbt, QdufdD, srim, UqI, sFjo, iBfRm, kCaFB, nfKQ, EeOwUo, AuSXKO, RzJTwh, uENN, QHZdO,