Dear CREODIAS users,

In the Security section customers will find information about latest and most critical security vulnerabilities, published in the last month by the SANS Institute (www.sans.org). Security vulnerabilities in software and hardware are very often used by cybercriminals to attack IT infrastructure and steal or destroy company's data, that is why companies are advised to fix those vulnerabilities as soon as possible.
 
ID: CVE-2022-27255
Title: Buffer overflow vulnerability in the Realtek AP-Router SDK
Description: In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to remotely execute code without authentication via a crafted SIP packet that contains malicious SDP data.
 
ID: CVE-2022-36728
Title: SQL injection vulnerability in Library Management System v1.0
Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /staff/delstu.php.
 
ID: CVE-2022-34819
Title: Heap-based Buffer Overflow vulnerability in SINEMA Remote Connect Server (SRCS) VPN
Description: SINEMA Remote Connect allows end users to remotely access plants and machines and leverages VPN connections between the control center, service engineers and installed plants, according to Siemens. The application lacks proper validation of user-supplied data when parsing specific messages. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of device.


ID: CVE-2022-34820
Title: Command Injection vulnerability in Siemens products
Description: The application does not correctly escape some user provided fields during the authentication process. This could allow an attacker to inject custom commands and execute arbitrary code with elevated privileges.


ID: CVE-2022-34821
Title: Code Injection vulnerability in Siemens SIMATIC CP 1242-7 V2 Open VPN
Description: By injecting code to specific configuration options for OpenVPN, an attacker could execute arbitrary
code with elevated privileges.


ID: CVE-2022-20229
Title: Out of bound write vulnerability in Google Android 10.0/11.0/12.0
Description: In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-224536184
 
ID: CVE-2022-20238
Title: Memory corruption vulnerability in Google Android kernel
Description: remap_pfn_range here may map out of size kernel memory (for example, may map the kernel area), and because the vma->vm_page_prot can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to be exploited.
Product: AndroidVersions: Android SoCAndroid ID: A-233154555