CVE-2022-24688

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload and consequently Remote Code Execution via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order...

kernel security, bug fix, and enhancement update

4.18.0-372.16.1.0.16.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32...

About CMDB Sync Integration with Qualys CyberSecurity Asset Management

Welcome to the first in a new series of blog posts about Qualys integrations. This first blog in the series covers our integrations as they relate to CMDB Sync, which is a part of Qualys CyberSecurity Asset Management CSAM and has two versions. One version is for basic ServiceNow customers who ha...

Exploit for OS Command Injection in Mailcow Mailcow\:_Dockerized

Mailcow CVE-2022-31138 RCE and Domain Admin privilege escalat...

CVE-2022-31536

The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31536

The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31536

The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

Path traversal

The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31536

CVE-2022-31536 affects the repository by jaygarza1982/ytdl-sync up to 2021-01-02, where an unsafe use of Flask’s send_file enables absolute path traversal. Documented impact includes partial confidentiality/partial availability (CVSS v3.1 base score 9.3; network attack, no privileges, no user int...

ytdl-sync 路径遍历漏洞

The ytdl-sync repository is a web interface for YTDL by Jake Garza, an individual developer in the United States. A security vulnerability exists in ytdl version 2021-01-02 and earlier, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

Malicious code in sync-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fefcdbe4a5390f1020ae074005addef32fd13333ceb9103df14daa268f805ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6390 Malicious code in sync-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fefcdbe4a5390f1020ae074005addef32fd13333ceb9103df14daa268f805ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2022-1743 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

Hack Allows Drone Takeover Via ‘ExpressLRS’ Protocol

The popular protocol for radio controlled RC aircraft called ExpressLRS can be hacked in only a few steps, according to a bulletin published last week. ExpressLRS is an open-source long range radio link for RC applications, such as first-person view FPV drones. “Designed to be the best FPV Racing...

GSD-2022-1003201 ceph: flush the mdlog for filesystem sync

ceph: flush the mdlog for filesystem sync This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.47 by commit...

GSD-2022-1002532 ceph: flush the mdlog for filesystem sync

ceph: flush the mdlog for filesystem sync This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

Malicious Package

Overview en-conduit-sync is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

sync-sign.com Cross Site Scripting vulnerability OBB-2663200

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in secrets-sync-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ad5dd7927bcd89b1f83ce52eaf883a861ff2178c8f2fad548584c722e3b96ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5993 Malicious code in secrets-sync-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ad5dd7927bcd89b1f83ce52eaf883a861ff2178c8f2fad548584c722e3b96ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...