Aggregator

用装 PC 主机的思路造车，它会是美国电车界的五菱宏光吗？

用装 PC 主机的思路造车，它会是美国电车界的五菱宏光吗？

A vulnerability was found in Softing OPC UA C++ SDK up to 6.9. It has been rated as critical. Affected by this issue is some unknown functionality of the component Browse Request Handler. The manipulation leads to use after free. This vulnerability is handled as CVE-2022-39823. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Softing OPC UA C++ SDK up to 6.9. This issue affects some unknown processing of the component Array Handler. The manipulation leads to buffer overflow. The identification of this vulnerability is CVE-2022-37453. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Rukovoditel 3.2.1. It has been rated as problematic. This issue affects some unknown processing of the file /index.php?module=global_lists/lists of the component Global Lists. The manipulation of the argument Name leads to cross site scripting. The identification of this vulnerability is CVE-2022-43164. The attack may be initiated remotely. Furthermore, there is an exploit available.

A vulnerability classified as problematic has been found in Rukovoditel 3.2.1. Affected is an unknown function of the file /index.php?module=global_vars/vars of the component Global Variables. The manipulation of the argument Value leads to cross site scripting. This vulnerability is traded as CVE-2022-43165. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

A vulnerability classified as problematic was found in Rukovoditel 3.2.1. Affected by this vulnerability is an unknown functionality of the file /index.php?module=entities/entities of the component Global Entities. The manipulation of the argument Name leads to cross site scripting. This vulnerability is known as CVE-2022-43166. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as problematic, has been found in Rukovoditel 3.2.1. Affected by this issue is some unknown functionality of the file /index.php?module=users_alerts/users_alerts of the component Users Alerts. The manipulation of the argument Title leads to cross site scripting. This vulnerability is handled as CVE-2022-43167. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Rukovoditel 3.2.1. This affects an unknown part of the file /index.php?module=users_groups/users_groups of the component Users Access Groups. The manipulation of the argument Name leads to cross site scripting. This vulnerability is uniquely identified as CVE-2022-43169. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in WebAssembly wabt 1.0.29. This issue affects the function std::allocator<wabt::Type>>::size in the library /bits/stl_vector.h. The manipulation leads to heap-based buffer overflow. The identification of this vulnerability is CVE-2022-43281. The attack can only be done within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as critical has been found in SEMCMS 1.2. Affected is an unknown function of the file SEMCMS_User.php. The manipulation leads to sql injection. This vulnerability is traded as CVE-2021-38217. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

A vulnerability classified as critical was found in Rukovoditel 3.2.1. This vulnerability affects unknown code. The manipulation of the argument reports_id leads to sql injection. This vulnerability was named CVE-2022-43168. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in WebAssembly wabt 1.0.29. Affected is the function OnReturnCallIndirectExpr->GetReturnCallDropKeepCount. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2022-43282. Access to the local network is required for this attack to succeed. There is no exploit available.

A vulnerability has been found in WebAssembly wabt 1.0.29 and classified as problematic. Affected by this vulnerability is the function CWriter::Write. The manipulation leads to denial of service. This vulnerability is known as CVE-2022-43283. The attack needs to be approached within the local network. There is no exploit available.

A vulnerability classified as problematic has been found in Newspaper Theme up to 11 on WordPress. This affects an unknown part of the component AJAX Action Handler. The manipulation of the argument a leads to cross site scripting. This vulnerability is uniquely identified as CVE-2022-2627. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Here’s a look at the most interesting products from the past week, featuring releases from ProcessUnity, Searchlight Cyber, ServiceNow, and Verosint. ServiceNow unveils AI agents to accelerate enterprise self-defense The new AI agents, available within ServiceNow’s Security and Risk solutions, are designed to improve consistency, identify insights, and reduce response times. ProcessUnity Evidence Evaluator flags discrepancies in a third-party’s controls A key component of ProcessUnity’s Third-Party Risk Management (TPRM) Platform, Evidence Evaluator automatically reviews third-party … More →

The post New infosec products of the week: May 9, 2025 appeared first on Help Net Security.

After Vendor Paid for Data-Deletion Promise, Criminals Extort Schools Directly
Students, gather round for the sad story of how PowerSchool got schooled by hackers, who stole data on students and teachers. After PowerSchool paid a ransom for a guarantee that the data would be deleted, the bad hackers failed to honor their promise.

Not Just Ransomware But Verbal Disclosure of Personal Data Common, Watchdog Finds
Two decades after California Senate Bill 1386 introduced the world to data breach notifications, organizations have collectively battened down their cybersecurity hatches and fixed the problem once and for all. Of course, I'm joking, with the results of recent data breach root cause report in hand.

Union Health System Among Many Cerner Legacy Data Clients Affected by Breach
An Indiana health system is among the first healthcare organizations notifying regulators and thousands of people affected by the Oracle hack in January. Attackers compromised legacy patient data hosted by Cerner servers that were set to migrate to Oracle's cloud environment.