PT-2022-32663

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.56 Description A data-race issue exists around sysctl fib sync mem in the ipv4 component. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior ...

io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45), org.jenkins-ci.plugins:github-oauth (>=0.25, <=0.33) +1 more potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (3.0.0)

org.jenkins-ci.plugins:git MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =y, =0.25, =0.33 - org.jenkins-ci.plugins:stash-pullrequest-build...

io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45), org.jenkins-ci.plugins:github-oauth (>=0.25, <=0.33) +1 more potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (3.0.0)

org.jenkins-ci.plugins:git MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =y, =0.25, =0.33 - org.jenkins-ci.plugins:stash-pullrequest-build...

io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45), org.jenkins-ci.plugins:git (3.0.0) +3 more potentially affected by CVE-2022-36881 via org.jenkins-ci.plugins:git-client (2.0.0)

org.jenkins-ci.plugins:git-client MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =y, =0.25, =0.5, =0.6 Source cves: CVE-2022-36881...

io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45), org.jenkins-ci.plugins:github-oauth (>=0.25, <=0.33) +1 more potentially affected by CVE-2022-36883 via org.jenkins-ci.plugins:git (3.0.0)

org.jenkins-ci.plugins:git MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =y, =0.25, =0.33 - org.jenkins-ci.plugins:stash-pullrequest-build...

Cannot activate Microsoft Pinyin IME in Windows server 2016/2019/2022

Cannot activate Microsoft Pinyin IME in Windows server 2016/2019/2022 VDA if client keyboard layout set “sync only once” mode Following are the details of the error, 1. VDA OS is a Windows server 2016/2019/2022 English version. 2. CWA Windows set the keyboard layout to “Sync only once – when the...

Memory corruption

A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated network based attacker to cause a Denial of Service DoS. On all Junos platforms, the Kernel Routing Table KRT queue can get stuck due to a memory leak triggered ...

WAVLINK WN535K2 and WN535K3 have operating system command injection vulnerabilities

The WAVLINK WN535K2 and WAVLINK WN535K3 are both wireless routers from the Chinese company WAVLINK. A security vulnerability exists in the WAVLINK WN535K2 and WN535K3 versions, which stems from certain unknown processing in /cgi-bin/touchlistsync.cgi, where manipulation of IP parameters may resul...

CVE-2022-24688

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload and consequently Remote Code Execution via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order...

CVE-2022-24688

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload and consequently Remote Code Execution via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order...

PT-2022-16802

Name of the Vulnerable Software and Affected Versions DSK DSKNet versions 2.16.136.0 through 2.17.136.5 Description An issue allows unrestricted file upload, leading to Remote Code Execution, via PDF upload with PHP content and a .php extension in the Touch settings. The attacker must have...

kernel security, bug fix, and enhancement update

4.18.0-372.16.1.0.16.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32...

About CMDB Sync Integration with Qualys CyberSecurity Asset Management

Welcome to the first in a new series of blog posts about Qualys integrations. This first blog in the series covers our integrations as they relate to CMDB Sync, which is a part of Qualys CyberSecurity Asset Management CSAM and has two versions. One version is for basic ServiceNow customers who ha...

Exploit for OS Command Injection in Mailcow Mailcow\:_Dockerized

Mailcow CVE-2022-31138 RCE and Domain Admin privilege escalat...

CVE-2022-31536

The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31536

The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31536

The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

Path traversal

The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31536

CVE-2022-31536 affects the repository by jaygarza1982/ytdl-sync up to 2021-01-02, where an unsafe use of Flask’s send_file enables absolute path traversal. Documented impact includes partial confidentiality/partial availability (CVSS v3.1 base score 9.3; network attack, no privileges, no user int...

PT-2022-20807

Name of the Vulnerable Software and Affected Versions jaygarza1982/ytdl-sync repository through 2021-01-02 Description The issue allows absolute path traversal due to the unsafe use of the Flask send file function. Recommendations For versions through 2021-01-02, consider restricting access to th...