OESA-2022-1743 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

Hack Allows Drone Takeover Via ‘ExpressLRS’ Protocol

The popular protocol for radio controlled RC aircraft called ExpressLRS can be hacked in only a few steps, according to a bulletin published last week. ExpressLRS is an open-source long range radio link for RC applications, such as first-person view FPV drones. “Designed to be the best FPV Racing...

GSD-2022-1003201 ceph: flush the mdlog for filesystem sync

ceph: flush the mdlog for filesystem sync This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.47 by commit...

GSD-2022-1002532 ceph: flush the mdlog for filesystem sync

ceph: flush the mdlog for filesystem sync This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

PT-2022-31148

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.15 Description The issue is related to the ceph filesystem in the Linux Kernel, specifically with flushing the mdlog for filesystem sync. The actual impact and attack plausibility have not yet been proven...

PT-2022-31712

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.45 Description The issue is related to the use of del timer sync before freeing in hci qca. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prio...

PT-2022-31464

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.47 Description The issue is related to the ceph filesystem in the Linux Kernel. It involves flushing the mdlog for filesystem sync. The actual impact and attack plausibility have not yet been proven...

PT-2022-30795

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.4 Description The issue is related to the ceph filesystem in the Linux Kernel, specifically with flushing the mdlog for filesystem sync. The actual impact and attack plausibility have not yet been proven...

PT-2022-31443

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.13 Description The issue is related to the use of del timer sync before freeing in hci qca. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prio...

PT-2022-31921

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.120 Description The issue is related to the use of del timer sync before freeing in hci qca. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions pri...

PT-2022-31131

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.2 Description The issue is related to the use of del timer sync before freeing in hci qca. The actual impact and attack plausibility have not yet been proven. Recommendations For versions prior to v5.18.2,...

com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2022-34174 via org.jenkins-ci.main:jenkins-core (1.642.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...

Malicious Package

Overview en-conduit-sync is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

sync-sign.com Cross Site Scripting vulnerability OBB-2663200

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in secrets-sync-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ad5dd7927bcd89b1f83ce52eaf883a861ff2178c8f2fad548584c722e3b96ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5993 Malicious code in secrets-sync-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ad5dd7927bcd89b1f83ce52eaf883a861ff2178c8f2fad548584c722e3b96ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1927 Malicious code in client-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 506492c76e62a8122e2c85a6cbc0c4ca74db972b57a2b4876730316766d46673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in client-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 506492c76e62a8122e2c85a6cbc0c4ca74db972b57a2b4876730316766d46673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-colors-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7126c41016803ec276ddacf0acd45108bf2031e9fe72ea7f21cc81a62c81c4f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4880 Malicious code in node-colors-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7126c41016803ec276ddacf0acd45108bf2031e9fe72ea7f21cc81a62c81c4f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...