Vulnerability Updates
National Cyber Awareness System's Weekly Bulletins For The Month
- VU#142546: SMA Technologies OpCon UNIX agent adds the same SSH key to all installations:
Overview
SMA Technologies OpCon UNIX agent adds the same SSH key on every installation and subsequent updates. An attacker with access to the private key can gain root …
- VU#473698: uClibc, uClibc-ng libraries have monotonically increasing DNS transaction ID:
Overview
The uClibc and uClibc-ng libraries, prior to uClibc-ng 1.0.41, are vulnerable to DNS cache poisoning due to the use of predicatble DNS transaction IDs when making …
- VU#730007: Tychon is vulnerable to privilege escalation due to OPENSSLDIR location:
Overview
Tychon contains a privilege escalation vulnerability due to the use of an
OPENSSLDIR
variable that specifies a location where an unprivileged Windows … - VU#411271: Qt allows for privilege escalation due to hard-coding of qt_prfxpath value:
Overview
Prior to version 5.14, Qt hard-codes the
qt_prfxpath
value to a fixed value, which may lead to privilege escalation vulnerabilities in Windows software … - VU#970766: Spring Framework insecurely handles PropertyDescriptor objects with data binding:
Overview
The Spring Framework insecurely handles PropertyDescriptor objects, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable …
National Vulnerability Database
- CVE-2021-40597: The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password.
- CVE-2022-30467: Joy ebike Wolf Manufacturing year 2022 is vulnerable to Denial of service, which allows remote attackers to jam the key fob request via RF.
- CVE-2022-33061: Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_service.
- CVE-2022-33060: Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_schedule.
- CVE-2022-33057: Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reservation.
Packet Storm’s Apple Vulnerability List
- Apple Security Advisory 2022-05-16-8: Apple Security Advisory 2022-05-16-8 – Xcode 13.4 addresses a logic issue and a privilege escalation issue.
- Apple Security Advisory 2022-05-16-7: Apple Security Advisory 2022-05-16-7 – Safari 15.5 addresses code execution and use-after-free vulnerabilities.
- Apple Security Advisory 2022-05-16-6: Apple Security Advisory 2022-05-16-6 – tvOS 15.5 addresses bypass, code execution, integer overflow, out of bounds access, out of bounds write, and use-after-free vulnerabilities.
- Apple Security Advisory 2022-05-16-5: Apple Security Advisory 2022-05-16-5 – watchOS 8.6 addresses bypass, code execution, integer overflow, out of bounds access, out of bounds write, and use-after-free vulnerabilities.
- Apple Security Advisory 2022-05-16-4: Apple Security Advisory 2022-05-16-4 – Security Update 2022-004 Catalina addresses bypass, code execution, denial of service, integer overflow, out of bounds access, out of bounds read, out of bounds …
Packet Storm’s Windows Vulnerability List
- MIMEDefang Email Scanner 3.0: MIMEDefang is a flexible MIME email scanner designed to protect Windows clients from viruses. Includes the ability to do many other kinds of mail processing, such as replacing parts of messages with …
- Backdoor.Win32.InfecDoor.17.c MVID-2022-0614 Insecure Permissions: Backdoor.Win32.InfecDoor.17.c malware suffers from an insecure permissions vulnerability.
- Trojan-Mailfinder.Win32.VB.p MVID-2022-0616 Insecure Permissions: Trojan-Mailfinder.Win32.VB.p malware suffers from an insecure permissions vulnerability.
- Backdoor.Win32.Shark.btu MVID-2022-0615 Insecure Permissions: Backdoor.Win32.Shark.btu malware suffers from an insecure permissions vulnerability.
- Verbatim Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 Insufficient Verification: When analyzing the Verbatim Executive Fingerprint Secure SSD, Matthias Deeg found out that the content of the emulated CD-ROM drive containing the Windows and macOS client software can be …
Vulnerability News Resources
- National Cyber Awareness System (US-CERT)
- Vulnerability Notes Database (Software Engineering Institute)
- Common Vulnerabilities and Exposures – CVE (MITRE Corp.)
- CVE Details Vulnerabilities Database
- Symantec Vulnerabilities List
- Security Focus Vulnerabilities List (Symantec Corp.)
- McAfee Threat Activity List
- Trend Micro Vulnerabilities List
- Microsoft Security Bulletin
- Packet Storm’s RSS Feeds
- Offensive Security Exploit Database Archive