Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of FasterXML Jackson (CVE-2022-42003)

Summary IBM Cloud Pak for Multicloud Management Monitoring has patched its use of FasterXML Jackson due to vulnerabilities of resource exhaustion. Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check i...

CVE-2022-42970

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows...

CVE-2022-42971

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to...

CVE-2022-42971

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to...

Hardcoded credentials

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA, APC...

CVE-2022-42972

Schneider Electric APC Easy UPS Online Monitoring Software and Schneider Electric Easy UPS Online Monitoring Software (Safe to say the affected products are APC Easy UPS Online Monitoring Software and Schneider Electric Easy UPS Online Monitoring Software) are impacted by CVE-2022-42972, which is...

CVE-2022-42972

A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 -...

CVE-2022-42973

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA, APC...

Schneider Electric Easy UPS Online Monitoring Software 安全漏洞

Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from Schneider Electric, a French company. A security vulnerability exists in Schneider Electric Easy UPS Online Monitoring Software, which stems from a Critical Resource Privilege Assignment Incorrect...

CVE-2022-42973

Schneider Electric APC Easy UPS Online Monitoring Software (and APC Easy UPS Online Monitoring Software) versions prior to V2.5-GA, V2.5-GA-01-22261, V2.5-GS, or GS-01-22261 are affected by CVE-2022-42973 (CWE-798): use of hard-coded credentials in the database, enabling local privilege escalatio...

Schneider Electric Easy UPS Online Monitoring Software 信任管理问题漏洞

Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from Schneider Electric France. Schneider Electric Easy UPS Online Monitoring Software suffers from a trust management issue vulnerability that stems from a use of hard-coded credentials vulnerability that could...

CVE-2022-42970

Schneider Electric APC Easy UPS Online Monitoring Software (Schneider Electric/APC Easy UPS Online Monitoring Software) versions prior to V2.5-GA (Windows 7/10/11 and Windows Server 2016/2019/2022) and prior to V2.5-GA-01-22261 (Windows 11/Server 2019/2022) are affected by CVE-2022-42970 due to m...

CVE-2022-42971

The CVE-2022-42971 issue is a real, concrete vulnerability in Schneider Electric APC Easy UPS Online Monitoring Software (and related Schneider Electric variants) where UpLoadAction.execute allows Unrestricted Upload of File with Dangerous Type. An unauthenticated attacker can upload a malicious ...

Schneider Electric Easy UPS Online Monitoring Software 访问控制错误漏洞

Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from the French company Schneider Electric. Schneider Electric Easy UPS Online Monitoring Software suffers from an Access Control Error vulnerability that stems from a lack of authentication for critical functio...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of Golang Go (CVE-2022-24921, CVE-2022-28327, CVE-2022-24675)

Summary IBM Cloud Pak for Multicloud Management Monitoring has patched its use of Golang Go due to vulnerabilities with that runtime. Vulnerability Details CVEID:CVE-2022-24921 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validation. By using a...

[SECURITY] Fedora 36 Update: rust-resctl-bench-2.1.2-8.fc36

resctl-bench is a collection of whole-system benchmarks to evaluate resource control and hardware behaviors using realistic simulated workloads. Comprehensive resource control involves the whole system. Furthermore, testing resource control end-to-end requires scenarios involving realistic...

Malicious code in taxi-monitoring (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b9208a01f674d2b8b5f755ebf94aacd6c957f9dc6718f2d801e852745c6cdc5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-831 Malicious code in taxi-monitoring (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b9208a01f674d2b8b5f755ebf94aacd6c957f9dc6718f2d801e852745c6cdc5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Unauthorized Access Vulnerability in Beixingyuan Network Breach Monitoring and Alerting Platform

Beijing Beixinyuan Software Co., Ltd. is a comprehensive solution provider committed to becoming a smart security provider in the 5G era. There is an unauthorized access vulnerability in Beixinyuan's network violation monitoring and alerting platform, which can be exploited by attackers to obtain...

File Upload Vulnerability in Dahua DSS In-Vehicle Surveillance Platform

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. A file upload vulnerability exists in the Dahua DSS in-vehicle surveillance platform, which can be exploited by an attacker to upload arbitrary files...