CVE-2022-29934

Summary (CVE-2022-29934) : USU Oracle Optimization (pre-5.17.5) lacks Polkit authentication, enabling smartcollector users to gain root access via pkexec. This affects versions prior to 5.17.5 and is not an Oracle Corporation product. Impact (as documented) : local privilege escalation to root wi...

CVE-2022-29935

CVE-2022-29935 concerns USU Oracle Optimization before 5.17.5. Multiple sources describe an information-disclosure vulnerability where an attacker could discover quantum credentials via an agent-installer/download mechanism. Affected software: USU Oracle Optimization versions prior to 5.17.5. Roo...

CVE-2022-29935

USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download. NOTE: this is not an Oracle Corporation product...

CVE-2022-29936

CVE-2022-29936 concerns USU Oracle Optimization prior to 5.17. The vulnerability arises from Java deserialization of the file path /v2/quantum/save-data-upload-big-file, enabling remote code execution. Public descriptions specify that authenticated users (described as quantum users in some source...

CVE-2022-29936

USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation product...

CVE-2022-29937

CVE-2022-29937 affects USU Oracle Optimization before 5.17.5. Affected component: the Oracle Optimization agent. Root cause: authenticated DataCollection users can exploit command injection because some OS commands are blocked while commands like base64 decoding are not blocked, enabling shell ac...

CVE-2022-29937

USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but for example an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product...

USU Oracle Optimization 访问控制错误漏洞

USU Oracle Optimization is used to improve the performance of Oracle queries.USU Oracle Optimization versions prior to 5.17.5 have an authorization issue vulnerability that stems from a lack of Polkit authentication, which can be exploited by an attacker to achieve root user access via pkexec...

USU Oracle Optimization 操作系统命令注入漏洞

USU Oracle Optimization is used to improve the performance of Oracle queries. command injection vulnerability exists in versions of USU Oracle Optimization prior to 5.17.5. The vulnerability stems from the fact that some common OS commands are blocked, but OS commands for base64 decoding are not...

USU Oracle Optimization 代码问题漏洞

USU Oracle Optimization is used to improve Oracle query performance.A deserialization vulnerability exists in versions of USU Oracle Optimization prior to 5.17, which originates from the Java deserialization of /v2/quantum/save-data-upload-big-file, and an attacker can exploit this vulnerability ...

PT-2022-19918 · Usu · Usu Oracle Optimization

Name of the Vulnerable Software and Affected Versions: USU Oracle Optimization versions prior to 5.17.5 Description: The issue is related to a lack of Polkit authentication in USU Oracle Optimization, which allows smartcollector users to achieve root access via pkexec. This is not an Oracle...

USU Oracle Optimization 安全漏洞

USU Oracle Optimization is used to improve Oracle query performance. versions prior to USU Oracle Optimization 5.17.5 contain an information disclosure vulnerability that could be exploited by an attacker to discover quantum credentials via a proxy installer download...

PT-2022-19919 · Usu · Usu Oracle Optimization

Name of the Vulnerable Software and Affected Versions: USU Oracle Optimization versions prior to 5.17.5 Description: The issue allows attackers to discover quantum credentials via an agent-installer download. It is noted that this is not an Oracle Corporation product. Recommendations: For version...

GSD-2022-1001906 ext4: make mb_optimize_scan performance mount option work with extents

ext4: make mboptimizescan performance mount option work with extents This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

Virtuozzo Hybrid Server 7.5 Update 3 Hotfix 1 (7.5.3-396)

The Hotfix 1 for Virtuozzo Hybrid Server 7.5 Update 3 provides stability and usability bug fixes Vulnerability id: PSBM-139281 Optimized cache and memory usage while creating backups. Vulnerability id: PSBM-139170 The container backup process could hang when working with NFS backup storage...

CVE-2022-24527: Microsoft Connected Cache Local Privilege Escalation (Fixed)

On April 12, 2022, Microsoft published CVE-2022-24527, a local privilege escalation vulnerability in Microsoft Connected Cache. The vulnerability allowed a local low-privileged user to execute arbitrary Powershell as SYSTEM due to improper file permission assignment CWE-732. Product description...

CVE-2022-0969

The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfilteredhtml capability i...

CVE-2022-0969

CVE-2022-0969 affects the WordPress Optimole plugin prior to 3.3.2. The issue is that the settings for “Lazyload background images for selectors” are not properly sanitised/escaped, which could allow high-privilege users (e.g., admins) to perform Cross-Site Scripting even when unfiltered_html is ...

CVE-2022-0969 Image optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site Scripting

The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfilteredhtml capability i...

Fortinet FortiClient for Windows权限提升漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. executable file in the FortiClient installer...