Do Son discovered a new privilege elevation vulnerability "Nimbuspwn" in Linux. These vulnerabilities are tracked as CVE-2022-29799 and CVE-2022-29800
Vulnerability
At present, the details of the vulnerability and proof of concept (POC) have been disclosed, and the CVE-2022-21449 risk is high.
VMware issued a security bulletin to disclose a denial-of-service (dos) vulnerability (CVE-2022-22969) in Spring Security OAuth
Atlassian issued a risk notice for Jira and Jira Service Management. The vulnerability number is CVE-2022-0540, vulnerability level is high risk
CVE-2022-21431 allows attackers send malicious requests over TCP protocol and take over Oracle Communications Billing and Revenue Management
CVE-2021-3970 is a potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models
users need to delete the 7-zip.chm file in the 7-Zip installation directory. After deletion, hackers can no longer exploit CVE-2022-29072
CVE-2022-1364 was submitted by Clément Lecigne of Google's Threat Analysis Group and the vulnerability was discovered on April 13
Apache released a risk notice for Apache Struts2, the vulnerability number is CVE-2021-31805, and the security rating is important
CISA stated that CVE-2021-45382 is a critical security vulnerability due to the end-of-life (EOL) of affected products.
An nginx Zero-Day RCE issue was identified in the nginx LDAP-auth daemon implementation, which was briefly leaked.
CVE-2022-22954 - Server-side template injection remote code execution vulnerability affecting VMware Workspace ONE Access and Identity Manager
Mickey Jin has released proof-of-concept (PoC) exploit code for a MacOS SUHelper Root Privilege Escalation (CVE-2022-22639) vulnerability
GitLab issued a security notice to fix a vulnerability (CVE-2022-1162) in the Community Edition and Enterprise Edition, with a CVSS score of 9.1
an out-of-bounds write issue (CVE-2022-22674) in the Intel Graphics Driver, that allows an application may be able to read kernel memory
Spring officially released a security bulletin, disclosing that there is a remote code execution (RCE) (CVE-2022-22965)
Spring Cloud officially released a security bulletin, disclosing that there is a SpEL expression injection vulnerability (CVE-2022-22963)
Google released a security bulletin to reveal the CVE-2022-1096 vulnerability, which is a major security threat to Type Confusion in V8.
The vulnerability number is CVE-2022-24934, and the WPS update program that contains the vulnerability is called wpsupdate.exe.
Dell recently released a security bulletin to announce CVE-2022-24415, CVE-2022-24416, CVE-2022-24419, CVE-2022-24420, and CVE-2022-24421 vulnerabilities
The OpenSSL project team released a security bulletin on March 15, 2022, to disclose the CVE-2022-0778 vulnerability
CVE-2022-0847 has been used to successfully gain root privileges on Google Pixel 6 Pro and Samsung Galaxy S22 running the latest Android version