Loco Translate WordPress plugin does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.Affected Versions:Loco Translate Plugin versions prior to 2.6.1QID Detection Logic(Unauthenticated):This unauthenticated detection depends on the BlindElephant engine to detect the vulnerable version of the Events Manager plugin.ConsequenceSuccessful exploitation of this vulnerability may allow an authenticated attacker with the ability to create posts can execute JavaScript code in a victim's browser.SolutionCustomers are advised to install Loco translate 2.6.1 or later version to remediate this vulnerability.Patches Loco Translate Release NotesCVE-2019-3886QID: 672574EulerOS Security Update for libvirt (EulerOS-SA-2023-1348)SeveritySerious3In DevelopmentQualys ID672574Vendor ReferenceEulerOS-SA-2023-1348CVE ReferenceCVE-2019-3886CVSS ScoresBase 5.4 / Temporal 4.7DescriptionEulerOS has released a security update(s) for libvirt to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to EulerOS security advisory EulerOS-SA-2023-1348 for updates and patch information.Patches EulerOS 2\\.0 SP8 EulerOS-SA-2023-1348CVE-2022-23552QID: 150644Grafana Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2022-23552)SeveritySerious3In DevelopmentQualys ID150644Vendor ReferenceGithubCVE ReferenceCVE-2022-23552CVSS ScoresBase 5.4 / Temporal 4.7DescriptionGrafana is a multi-platform open source analytics and interactive visualization web application. It provides charts, graphs, and alerts for the web when connected to supported data sources.Affected version of Grafana is vulnerable to stored XSS vulnerability in the GeoMap core plugin. The vulnerability, occurs because SVG files are not properly sanitized, allowing arbitrary JavaScript to be executed by the authorized user of the Grafana instance.To exploit this vulnerability, an attacker must have the Editor role and either change a panel to include an external URL to a malicious SVG file or use the data: scheme to load an inline SVG file. This opens the possibility for vertical privilege escalation, where an Editor user can obtain a known password for an Admin user if the Admin user views a dashboard containing the malicious JavaScript.Affected Versions:Grafana versions from 8.1.0 to 8.5.16Grafana versions from 9.0.0 to 9.2.10Grafana versions from 9.3.0 to 9.3.4QID Detection Logic :This QID sends an HTTP GET request and retrieves a vulnerable version of a Grafana running on the target application.ConsequenceSuccessful exploitation could allow an attacker to execute arbitrary JavaScript code in the context of the interface or allow the attacker to access sensitive, browser-based information.SolutionCustomers are advised to upgrade to Grafana to later version to remediate this vulnerability. For more information regarding this vulnerability please refer Github Advisory. Patches GithubCVE-2022-21626+QID: 672597EulerOS Security Update for java-1.8.0-openjdk (EulerOS-SA-2023-1319)SeveritySerious3In DevelopmentQualys ID672597Vendor ReferenceEulerOS-SA-2023-1319CVE ReferenceCVE-2022-21626, CVE-2022-21628, CVE-2022-21624, CVE-2022-21619CVSS ScoresBase 5.3 / Temporal 4.6DescriptionEulerOS has released a security update(s) for java-1.8.0-openjdk to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to EulerOS security advisory EulerOS-SA-2023-1319 for updates and patch information.Patches EulerOS 2\\.0 SP8 EulerOS-SA-2023-1319CVE-2023-0286+QID: 181546Debian Security Update for Open Secure Sockets Layer (OpenSSL) (DSA 5343-1)SeveritySerious3Recently PublishedQualys ID181546Date PublishedFebruary 8, 2023Vendor ReferenceDSA 5343-1CVE ReferenceCVE-2023-0286, CVE-2022-2097, CVE-2022-4304, CVE-2022-4450, CVE-2023-0215CVSS ScoresBase 5.3 / Temporal 4.6DescriptionDebian has released a security update for openssl to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to Debian security advisory DSA 5343-1 for updates and patch information.Patches Debian DSA 5343-1CVE-2020-0093QID: 672613EulerOS Security Update for libexif (EulerOS-SA-2023-1323)SeveritySerious3In DevelopmentQualys ID672613Vendor ReferenceEulerOS-SA-2023-1323CVE ReferenceCVE-2020-0093CVSS ScoresBase 5 / Temporal 4.4DescriptionEulerOS has released a security update(s) for libexif to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to EulerOS security advisory EulerOS-SA-2023-1323 for updates and patch information.Patches EulerOS 2\\.0 SP8 EulerOS-SA-2023-1323CVE-2022-39324QID: 150645Grafana Spoofing originalUrl of snapshots Vulnerability (CVE-2022-39324)SeveritySerious3In DevelopmentQualys ID150645Vendor ReferenceGrafanaCVE ReferenceCVE-2022-39324CVSS ScoresBase 3.5 / Temporal 3.1DescriptionGrafana is a multi-platform open source analytics and interactive visualization web application. It provides charts, graphs, and alerts for the web when connected to supported data sources.In installed version of Grafana, a malicious user could exploit this vulnerability by creating a snapshot and editing the query to choose the originalUrl parameter. As a result, when another user opens the snapshot URL, they are presented with the Grafana server's regular web interface, but the Open original dashboard button points to an attacker-injected URL, instead of the real original dashboard.Affected Versions:Grafana prior to versions 8.5.16 and 9.2.8QID Detection Logic :This QID sends an HTTP GET request and retrieves a vulnerable version of a Grafana running on the target application.ConsequenceSuccessful exploitation could allow an attacker to execute arbitrary JavaScript code in the context of the interface or allow the attacker to access sensitive, browser-based information.SolutionCustomers are advised to upgrade to Grafana to later version to remediate this vulnerability. For more information regarding this vulnerability please refer Github Advisory. Patches GrafanaCVE-2021-3521QID: 672573EulerOS Security Update for rpm (EulerOS-SA-2023-1335)SeverityMedium2In DevelopmentQualys ID672573Vendor ReferenceEulerOS-SA-2023-1335CVE ReferenceCVE-2021-3521CVSS ScoresBase 4.7 / Temporal 4.1DescriptionEulerOS has released a security update(s) for rpm to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to EulerOS security advisory EulerOS-SA-2023-1335 for updates and patch information.Patches EulerOS 2\\.0 SP8 EulerOS-SA-2023-1335CVE-2022-20411+QID: 610464Google Android January 2023 Security Patch Missing for Huawei EMUISeverityUrgent5In DevelopmentQualys ID610464Vendor ReferenceJanuary 2023CVE ReferenceCVE-2022-20411, CVE-2022-20472, CVE-2022-20473, CVE-2022-20498, CVE-2021-0934, CVE-2022-20124, CVE-2022-20449, CVE-2022-20466, CVE-2022-20469, CVE-2022-20470, CVE-2022-20474, CVE-2022-20476, CVE-2022-20478, CVE-2022-20479, CVE-2022-20480, CVE-2022-20483, CVE-2022-20484, CVE-2022-20485, CVE-2022-20486, CVE-2022-20487, CVE-2022-20488, CVE-2022-20491, CVE-2022-20495, CVE-2022-20496, CVE-2022-20500, CVE-2022-20501, CVE-2022-20611, CVE-2022-33268, CVE-2022-20468, CVE-2022-25677, CVE-2022-1419, CVE-2022-28390, CVE-2022-30594, CVE-2022-20571, CVE-2022-20572CVSS ScoresBase 9.8 / Temporal 8.5Description Android is a mobile operating system based on a modified version of the Linux kernel and other open source software, designed primarily for touchscreen mobile devices such as smartphones and tablets.Following security issues were discovered: CVE-2022-20411, CVE-2022-20472, CVE-2022-20473, CVE-2022-20498,,CVE-2021-0934, CVE-2022-20124, CVE-2022-20449, CVE-2022-20466, CVE-2022-20469, CVE-2022-20470, CVE-2022-20474, CVE-2022-20476, CVE-2022-20478, CVE-2022-20479, CVE-2022-20480, CVE-2022-20483, CVE-2022-20484, CVE-2022-20485, CVE-2022-20486, CVE-2022-20487, CVE-2022-20488, CVE-2022-20491, CVE-2022-20495, CVE-2022-20496, CVE-2022-20500, CVE-2022-20501, CVE-2022-20611, CVE-2022-33268,CVE-2022-20468, CVE-2022-25677, CVE-2022-1419, CVE-2022-28390, CVE-2022-30594, CVE-2022-20571, CVE-2022-20572Affected Devices : HUAWEI Mate series: HUAWEI Mate 40 Pro, HUAWEI Mate 50, HUAWEI Mate 50 Pro, HUAWEI Mate Xs 2, HUAWEI Mate XsHUAWEI P series: HUAWEI P40, HUAWEI P40 Pro, HUAWEI P40 Pro+, HUAWEI P50, HUAWEI P50 Pro, HUAWEI P50 Pocket, HUAWEI P50 Pocket Premium Edition, HUAWEI P40 lite 5GHUAWEI nova series: HUAWEI nova 10, HUAWEI nova 10 Pro, HUAWEI nova 10 SE, HUAWEI nova 9 SE, HUAWEI nova 9, HUAWEI nova 8i, HUAWEI nova 8, HUAWEI nova 7 5G, HUAWEI nova 7 SE 5G, HUAWEI nova 7iHONOR series: HONOR 30 Pro+, HONOR View30 Pro, HONOR 30, Honor 30SConsequenceOn successful exploitation, it could allow an attacker to execute code.SolutionRefer to HUAWEI Security advisory January 2023 to address this issue and obtain more information.Patches Android January 2023CVE-2022-23521+QID: 160446Oracle Enterprise Linux Security Update for git (ELSA-2023-0611)SeverityUrgent5Recently PublishedQualys ID160446Date PublishedFebruary 8, 2023Vendor ReferenceELSA-2023-0611CVE ReferenceCVE-2022-23521, CVE-2022-41903CVSS ScoresBase 9.8 / Temporal 8.5DescriptionOracle Enterprise Linux has released a security update for git to fix the vulnerabilities.Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation allows an attacker to compromise the system.SolutionTo resolve this issue, upgrade to the latest packages which contain a patch.Refer to Oracle Enterprise Linux advisory below for updates and patch information:ELSA-2023-0611Patches Oracle Linux ELSA-2023-0611CVE-2022-23521+QID: 160443Oracle Enterprise Linux Security Update for git (ELSA-2023-0610)SeverityUrgent5Recently PublishedQualys ID160443Date PublishedFebruary 8, 2023Vendor ReferenceELSA-2023-0610CVE ReferenceCVE-2022-23521, CVE-2022-41903CVSS ScoresBase 9.8 / Temporal 8.5DescriptionOracle Enterprise Linux has released a security update for git to fix the vulnerabilities.Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation allows an attacker to compromise the system.SolutionTo resolve this issue, upgrade to the latest packages which contain a patch.Refer to Oracle Enterprise Linux advisory below for updates and patch information:ELSA-2023-0610Patches Oracle Linux ELSA-2023-0610CVE-2022-22088+QID: 610468Google Android February 2023 Security Patch Missing for Huawei EMUISeverityUrgent5In DevelopmentQualys ID610468Vendor ReferenceFebruary 2023CVE ReferenceCVE-2022-22088, CVE-2022-41674, CVE-2022-20456, CVE-2022-20461, CVE-2022-20489, CVE-2022-20490, CVE-2022-20492, CVE-2022-20493, CVE-2022-20494, CVE-2023-20905, CVE-2023-20913, CVE-2023-20915, CVE-2023-20920, CVE-2023-20921, CVE-2022-33255, CVE-2022-32635CVSS ScoresBase 8.8 / Temporal 7.7Description Android is a mobile operating system based on a modified version of the Linux kernel and other open source software, designed primarily for touchscreen mobile devices such as smartphones and tablets.Following security issues were discovered: CVE-2022-22088, CVE-2022-41674,CVE-2022-20456, CVE-2022-20461, CVE-2022-20489, CVE-2022-20490, CVE-2022-20492, CVE-2022-20493, CVE-2022-20494, CVE-2023-20905, CVE-2023-20913, CVE-2023-20915, CVE-2023-20920, CVE-2023-20921, CVE-2022-33255, CVE-2022-32635Affected Devices : HUAWEI Mate series: HUAWEI Mate 40 Pro, HUAWEI Mate 50, HUAWEI Mate 50 Pro, HUAWEI Mate Xs 2, HUAWEI Mate XsHUAWEI P series: HUAWEI P40, HUAWEI P40 Pro, HUAWEI P40 Pro+, HUAWEI P50, HUAWEI P50 Pro, HUAWEI P50 Pocket, HUAWEI P50 Pocket Premium Edition, HUAWEI P40 lite 5GHUAWEI nova series: HUAWEI nova 10, HUAWEI nova 10 Pro, HUAWEI nova 10 SE, HUAWEI nova 9 SE, HUAWEI nova 9, HUAWEI nova 8i, HUAWEI nova 8, HUAWEI nova 7 5G, HUAWEI nova 7 SE 5G, HUAWEI nova 7iHONOR series: HONOR 30 Pro+, HONOR View30 Pro, HONOR 30, Honor 30SConsequenceOn successful exploitation, it could allow an attacker to execute code.SolutionRefer to HUAWEI Security advisory February 2023 to address this issue and obtain more information.Patches Android February 2023CVE-2022-42719+QID: 610467Google Android February 2023 Security Patch Missing for SamsungSeverityUrgent5In DevelopmentQualys ID610467Vendor ReferenceSMR-February-2023CVE ReferenceCVE-2022-42719, CVE-2022-42721, CVE-2022-42720, CVE-2022-41674, CVE-2022-22088, CVE-2022-20235, CVE-2023-20928, CVE-2022-2959, CVE-2022-32636, CVE-2022-32637, CVE-2022-25746, CVE-2022-23960, CVE-2022-25725, CVE-2022-33284, CVE-2022-33286, CVE-2022-33276, CVE-2022-33285, CVE-2022-44426, CVE-2022-44425, CVE-2022-44427, CVE-2022-44428, CVE-2022-44431, CVE-2022-44429, CVE-2022-44432, CVE-2022-44430, CVE-2022-44435, CVE-2022-44437, CVE-2022-44434, CVE-2022-44436, CVE-2022-44438, CVE-2022-20443, CVE-2022-20551, CVE-2023-20934, CVE-2023-20942, CVE-2023-20943, CVE-2023-20944, CVE-2023-20948, CVE-2023-20933, CVE-2022-20481, CVE-2022-43680, CVE-2023-20939, CVE-2023-20945, CVE-2023-20946, CVE-2023-20932, CVE-2022-20455, CVE-2020-27059, CVE-2022-20441, CVE-2022-20451CVSS ScoresBase 8.8 / Temporal 7.7Description Android is a mobile operating system based on a modified version of the Linux kernel and other open source software, designed primarily for touchscreen mobile devices such as smartphones and tablets.Following security issues were discovered: CVE-2022-42719, CVE-2022-42721, CVE-2022-42720, CVE-2022-41674, CVE-2022-22088,CVE-2022-20235, CVE-2023-20928, CVE-2022-2959, CVE-2022-32636, CVE-2022-32637, CVE-2022-25746, CVE-2022-23960, CVE-2022-25725, CVE-2022-33284, CVE-2022-33286, CVE-2022-33276, CVE-2022-33285, CVE-2022-44426, CVE-2022-44425, CVE-2022-44427, CVE-2022-44428, CVE-2022-44431, CVE-2022-44429, CVE-2022-44432, CVE-2022-44430, CVE-2022-44435, CVE-2022-44437, CVE-2022-44434, CVE-2022-44436, CVE-2022-44438, CVE-2022-20443, CVE-2022-20551, CVE-2023-20934, CVE-2023-20942, CVE-2023-20943, CVE-2023-20944, CVE-2023-20948, CVE-2023-20933, CVE-2022-20481, CVE-2022-43680, CVE-2023-20939, CVE-2023-20945, CVE-2023-20946, CVE-2023-20932, CVE-2022-20455, CVE-2020-27059, CVE-2022-20441, CVE-2022-20451Affected Products : Galaxy Z Fold2, Galaxy Z Fold2 5G, Galaxy Z Fold3 5G, Galaxy Z Fold4, Galaxy Z Flip, Galaxy Z Flip 5G, Galaxy Z Flip3 5G, Galaxy Z Flip4, W23, W23 flip Galaxy S10 Lite Galaxy S20, Galaxy S20 5G, Galaxy S20+, Galaxy S20+ 5G, Galaxy S20 Ultra, Galaxy S20 Ultra 5G, Galaxy S20 FE, Galaxy S20 FE 5G, Galaxy S21 5G, Galaxy S21+ 5G, Galaxy S21 Ultra 5G, Galaxy S21 FE 5G, Galaxy S22, Galaxy S22+, Galaxy S22 Ultra Galaxy Note10 Lite, Galaxy Note20, Galaxy Note20 5G, Galaxy Note20 Ultra, Galaxy Note20 Ultra 5G Enterprise Models: Galaxy A52, Galaxy A52 5G, Galaxy A52s 5G, Galaxy A53 5G, Galaxy Xcover Pro, Galaxy Xcover5, Galaxy Xcover6 ProConsequenceOn successful exploitation, it could allow an attacker to execute code.SolutionRefer to Samsung Security advisory SMR-February-2023 to address this issue and obtain more information.Patches Android SMR-February-2023CVE-2022-33225+QID: 610465Google Pixel Android February 2023 Security Patch MissingSeverityUrgent5In DevelopmentQualys ID610465Vendor ReferencePixel Update Bulletin February2023CVE ReferenceCVE-2022-33225, CVE-2023-20949, CVE-2022-25711CVSS ScoresBase 7.8 / Temporal 6.8Description Android is a mobile operating system based on a modified version of the Linux kernel and other open source software, designed primarily for touchscreen mobile devices such as smartphones and tablets.Following security issues were discovered: CVE-2022-33225,CVE-2023-20949,CVE-2022-25711Affected Products : Pixel 4 XL, Pixel 4, Pixel 3a XL, Pixel 3a, Pixel 3 XL, Pixel 3, Pixel 2 XL, Pixel 2 ConsequenceOn successful exploitation, it could allow an attacker to execute code.SolutionRefer to Google Pixel advisory Google Pixel Android February2023 to address this issue and obtain more information.Patches Android February 2023CVE-2021-39660+QID: 610463Google Android January 2023 Security Patch Missing for SamsungSeverityUrgent5In DevelopmentQualys ID610463Vendor ReferenceSMR-January-2023CVE ReferenceCVE-2021-39660, CVE-2022-23960, CVE-2022-32619, CVE-2022-32594, CVE-2022-32597, CVE-2022-32598, CVE-2022-32596, CVE-2022-25698, CVE-2022-25697, CVE-2022-25681, CVE-2022-25672, CVE-2022-25685, CVE-2022-25692, CVE-2022-25689, CVE-2022-25673, CVE-2022-25695, CVE-2022-25691, CVE-2022-25702, CVE-2022-25682, CVE-2022-33235, CVE-2022-39106, CVE-2022-39129, CVE-2022-39130, CVE-2022-39131, CVE-2022-39132, CVE-2022-39134, CVE-2022-42756, CVE-2022-42754, CVE-2022-42755, CVE-2022-39133, CVE-2022-42771, CVE-2022-42770, CVE-2022-42772, CVE-2022-20456, CVE-2022-20489, CVE-2022-20490, CVE-2022-20492, CVE-2022-20493, CVE-2023-20912, CVE-2023-20916, CVE-2023-20919, CVE-2023-20920, CVE-2023-20921, CVE-2022-20494, CVE-2023-20922, CVE-2022-20461, CVE-2023-20904, CVE-2023-20905, CVE-2023-20913, CVE-2023-20915CVSS ScoresBase 7.8 / Temporal 6.8Description Android is a mobile operating system based on a modified version of the Linux kernel and other open source software, designed primarily for touchscreen mobile devices such as smartphones and tablets.Following security issues were discovered: CVE-2021-39660, CVE-2022-23960(A-215557547), CVE-2022-32619, CVE-2022-32594, CVE-2022-32597, CVE-2022-32598, CVE-2022-32596, CVE-2022-25698, CVE-2022-25697, CVE-2022-25681, CVE-2022-25672, CVE-2022-25685, CVE-2022-25692, CVE-2022-25689, CVE-2022-25673, CVE-2022-25695, CVE-2022-25691, CVE-2022-25702, CVE-2022-25682, CVE-2022-33235, CVE-2022-39106, CVE-2022-39129, CVE-2022-39130, CVE-2022-39131, CVE-2022-39132, CVE-2022-39134, CVE-2022-42756, CVE-2022-42754, CVE-2022-42755, CVE-2022-39133, CVE-2022-42771, CVE-2022-42770, CVE-2022-42772, CVE-2022-20456, CVE-2022-20489, CVE-2022-20490, CVE-2022-20492, CVE-2022-20493, CVE-2023-20912, CVE-2023-20916, CVE-2023-20919, CVE-2023-20920, CVE-2023-20921, CVE-2022-20494, CVE-2023-20922, CVE-2022-20461, CVE-2023-20904, CVE-2023-20905, CVE-2023-20913, CVE-2023-20915Affected Products : Galaxy Z Fold2, Galaxy Z Fold2 5G, Galaxy Z Fold3 5G, Galaxy Z Fold4, Galaxy Z Flip, Galaxy Z Flip 5G, Galaxy Z Flip3 5G, Galaxy Z Flip4, W23, W23 flip Galaxy S10 Lite Galaxy S20, Galaxy S20 5G, Galaxy S20+, Galaxy S20+ 5G, Galaxy S20 Ultra, Galaxy S20 Ultra 5G, Galaxy S20 FE, Galaxy S20 FE 5G, Galaxy S21 5G, Galaxy S21+ 5G, Galaxy S21 Ultra 5G, Galaxy S21 FE 5G, Galaxy S22, Galaxy S22+, Galaxy S22 Ultra Galaxy Note10 Lite, Galaxy Note20, Galaxy Note20 5G, Galaxy Note20 Ultra, Galaxy Note20 Ultra 5G Enterprise Models: Galaxy A52, Galaxy A52 5G, Galaxy A52s 5G, Galaxy A53 5G, Galaxy Xcover Pro, Galaxy Xcover5, Galaxy Xcover6 ProConsequenceOn successful exploitation, it could allow an attacker to execute code.SolutionRefer to Samsung Security advisory SMR-January-2023 to address this issue and obtain more information.Patches Android SMR-January-2023CVE-2022-22079+QID: 610461Google Pixel Android January 2023 Security Patch MissingSeverityUrgent5In DevelopmentQualys ID610461Vendor ReferencePixel Update Bulletin January2023CVE ReferenceCVE-2022-22079, CVE-2023-20924, CVE-2022-25717, CVE-2022-25715, CVE-2023-20925, CVE-2023-20923, CVE-2022-25722, CVE-2022-25721CVSS ScoresBase 7.8 / Temporal 6.8Description Android is a mobile operating system based on a modified version of the Linux kernel and other open source software, designed primarily for touchscreen mobile devices such as smartphones and tablets.Following security issues were discovered: CVE-2022-22079,CVE-2023-20924,CVE-2022-25717,CVE-2022-25715,CVE-2023-20925,CVE-2023-20923,CVE-2022-25722,CVE-2022-25721Affected Products : Pixel 4 XL, Pixel 4, Pixel 3a XL, Pixel 3a, Pixel 3 XL, Pixel 3, Pixel 2 XL, Pixel 2 ConsequenceOn successful exploitation, it could allow an attacker to execute code.SolutionRefer to Google Pixel advisory Google Pixel Android January2023 to address this issue and obtain more information.Patches Android January 2023CVE-2022-33255+QID: 610462Google Android Devices January 2023 Security Patch MissingSeverityCritical4In DevelopmentQualys ID610462Vendor ReferenceAndroid Security Bulletin January2023CVE ReferenceCVE-2022-33255, CVE-2022-33253, CVE-2022-33252, CVE-2022-20461, CVE-2022-32635, CVE-2022-32636, CVE-2022-32637, CVE-2022-20235, CVE-2022-20489, CVE-2022-25746, CVE-2022-44435, CVE-2022-42719, CVE-2022-41674, CVE-2022-44432, CVE-2022-44431, CVE-2022-44430, CVE-2023-20922, CVE-2023-20905, CVE-2023-20920, CVE-2023-20921, CVE-2023-20904, CVE-2022-44438, CVE-2021-35113, CVE-2022-23960, CVE-2023-20928, CVE-2022-44436, CVE-2021-35134, CVE-2022-20456, CVE-2022-33266, CVE-2022-22088, CVE-2022-44434, CVE-2022-25725, CVE-2022-33286, CVE-2021-35097, CVE-2022-33284, CVE-2022-33285, CVE-2022-2959, CVE-2022-33283, CVE-2022-20494, CVE-2022-20493, CVE-2022-20492, CVE-2023-20919, CVE-2022-20490, CVE-2022-42721, CVE-2023-20916, CVE-2023-20915, CVE-2023-20913, CVE-2023-20912, CVE-2022-44437, CVE-2022-44425, CVE-2022-44426, CVE-2022-44427, CVE-2022-42720, CVE-2022-33276, CVE-2022-33274, CVE-2022-44428, CVE-2022-44429CVSS ScoresBase 8.8 / Temporal 7.7Description Android is a mobile operating system based on a modified version of the Linux kernel and other open source software, designed primarily for touchscreen mobile devices such as smartphones and tablets.Following security issues were discovered: CVE-2022-33255,CVE-2022-33253,CVE-2022-33252,CVE-2022-20461,CVE-2022-32635,CVE-2022-32636,CVE-2022-32637,CVE-2022-20235,CVE-2022-20489,CVE-2022-25746,CVE-2022-44435,CVE-2022-42719,CVE-2022-41674,CVE-2022-44432,CVE-2022-44431,CVE-2022-44430,CVE-2023-20922,CVE-2023-20905,CVE-2023-20920,CVE-2023-20921,CVE-2023-20904,CVE-2022-44438,CVE-2021-35113,CVE-2022-23960,CVE-2023-20928,CVE-2022-44436,CVE-2021-35134,CVE-2022-20456,CVE-2022-33266,CVE-2022-22088,CVE-2022-44434,CVE-2022-25725,CVE-2022-33286,CVE-2021-35097,CVE-2022-33284,CVE-2022-33285,CVE-2022-2959,CVE-2022-33283,CVE-2022-20494,CVE-2022-20493,CVE-2022-20492,CVE-2023-20919,CVE-2022-20490,CVE-2022-42721,CVE-2023-20916,CVE-2023-20915,CVE-2023-20913,CVE-2023-20912,CVE-2022-44437,CVE-2022-44425,CVE-2022-44426,CVE-2022-44427,CVE-2022-42720,CVE-2022-33276,CVE-2022-33274,CVE-2022-44428,CVE-2022-44429ConsequenceOn successful exploitation, it could allow an attacker to execute code.SolutionRefer to Google advisory Google Android January2023 to address this issue and obtain more information.Patches Android January 2023CVE-2022-3424+QID: 753628SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 17 for SLE 15 SP3) (SUSE-SU-2023:0281-1)SeverityCritical4Recently PublishedQualys ID753628Date PublishedFebruary 8, 2023Vendor ReferenceSUSE-SU-2023:0281-1CVE ReferenceCVE-2022-3424, CVE-2022-2602CVSS ScoresBase 8.6 / Temporal 7.5DescriptionSUSE has released a security update for kernel to fix the vulnerabilities.Affected product(s):SUSE Linux Enterprise Server 15 SP3SUSE Linux Enterprise Server for SAP Applications 15 SP3ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to SUSE security advisory SUSE-SU-2023:0281-1 for updates and patch information.Patches SUSE Enterprise Linux SUSE-SU-2023:0281-1CVE-2023-0494QID: 753627SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2023:0282-1)SeverityCritical4Recently PublishedQualys ID753627Date PublishedFebruary 8, 2023Vendor ReferenceSUSE-SU-2023:0282-1CVE ReferenceCVE-2023-0494CVSS ScoresBase 8.6 / Temporal 7.5DescriptionSUSE has released a security update for xorg-x11-server to fix the vulnerabilities.Affected product(s):SUSE Linux Enterprise Server for SAP Applications 12 SP4ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to SUSE security advisory SUSE-SU-2023:0282-1 for updates and patch information.Patches SUSE Enterprise Linux SUSE-SU-2023:0282-1CVE-2023-0430QID: 160445Oracle Enterprise Linux Security Update for thunderbird (ELSA-2023-0600)SeverityCritical4Recently PublishedQualys ID160445Date PublishedFebruary 8, 2023Vendor ReferenceELSA-2023-0600CVE ReferenceCVE-2023-0430CVSS ScoresBase 8.6 / Temporal 7.5DescriptionOracle Enterprise Linux has released a security update for thunderbird to fix the vulnerabilities.Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation allows an attacker to compromise the system.SolutionTo resolve this issue, upgrade to the latest packages which contain a patch.Refer to Oracle Enterprise Linux advisory below for updates and patch information:ELSA-2023-0600Patches Oracle Linux ELSA-2023-0600CVE-2023-0430QID: 160444Oracle Enterprise Linux Security Update for thunderbird (ELSA-2023-0608)SeverityCritical4Recently PublishedQualys ID160444Date PublishedFebruary 8, 2023Vendor ReferenceELSA-2023-0608CVE ReferenceCVE-2023-0430CVSS ScoresBase 8.6 / Temporal 7.5DescriptionOracle Enterprise Linux has released a security update for thunderbird to fix the vulnerabilities.Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation allows an attacker to compromise the system.SolutionTo resolve this issue, upgrade to the latest packages which contain a patch.Refer to Oracle Enterprise Linux advisory below for updates and patch information:ELSA-2023-0608Patches Oracle Linux ELSA-2023-0608CVE-2022-20443+QID: 610466Google Android Devices February 2023 Security Patch MissingSeverityCritical4In DevelopmentQualys ID610466Vendor ReferenceAndroid Security Bulletin February2023CVE ReferenceCVE-2022-20443, CVE-2023-20944, CVE-2023-20945, CVE-2023-20946, CVE-2023-20940, CVE-2023-20942, CVE-2023-20943, CVE-2022-47331, CVE-2022-20481, CVE-2023-20948, CVE-2022-40502, CVE-2022-40512, CVE-2022-0850, CVE-2022-41222, CVE-2022-33221, CVE-2022-33306, CVE-2022-39842, CVE-2022-47339, CVE-2022-33243, CVE-2022-20455, CVE-2022-43680, CVE-2022-33248, CVE-2022-34145, CVE-2022-33280, CVE-2022-20551, CVE-2023-20602, CVE-2022-34146, CVE-2022-33233, CVE-2023-20934, CVE-2023-20937, CVE-2022-33232, CVE-2022-40514, CVE-2022-33271, CVE-2023-20933, CVE-2023-20932, CVE-2022-33277, CVE-2023-20939, CVE-2023-20938, CVE-2022-39189CVSS ScoresBase 7.8 / Temporal 6.8Description Android is a mobile operating system based on a modified version of the Linux kernel and other open source software, designed primarily for touchscreen mobile devices such as smartphones and tablets.Following security issues were discovered: CVE-2022-20443,CVE-2023-20944,CVE-2023-20945,CVE-2023-20946,CVE-2023-20940,CVE-2023-20942,CVE-2023-20943,CVE-2022-47331,CVE-2022-20481,CVE-2023-20948,CVE-2022-40502,CVE-2022-40512,CVE-2022-0850,CVE-2022-41222,CVE-2022-33221,CVE-2022-33306,CVE-2022-39842,CVE-2022-47339,CVE-2022-33243,CVE-2022-20455,CVE-2022-43680,CVE-2022-33248,CVE-2022-34145,CVE-2022-33280,CVE-2022-20551,CVE-2023-20602,CVE-2022-34146,CVE-2022-33233,CVE-2023-20934,CVE-2023-20937,CVE-2022-33232,CVE-2022-40514,CVE-2022-33271,CVE-2023-20933,CVE-2023-20932,CVE-2022-33277,CVE-2023-20939,CVE-2023-20938,CVE-2022-39189ConsequenceOn successful exploitation, it could allow an attacker to execute code.SolutionRefer to Google advisory Google Android February2023 to address this issue and obtain more information.Patches Android February 2023CVE-2022-3424+QID: 753630SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 1 for SLE 15 SP4) (SUSE-SU-2023:0277-1)SeverityCritical4Recently PublishedQualys ID753630Date PublishedFebruary 8, 2023Vendor ReferenceSUSE-SU-2023:0277-1CVE ReferenceCVE-2022-3424, CVE-2022-4379, CVE-2022-2602CVSS ScoresBase 7.5 / Temporal 6.5DescriptionSUSE has released a security update for kernel to fix the vulnerabilities.Affected product(s):SUSE Linux Enterprise Server 15 SP4SUSE Linux Enterprise Server for SAP Applications 15 SP4ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to SUSE security advisory SUSE-SU-2023:0277-1 for updates and patch information.Patches SUSE Enterprise Linux SUSE-SU-2023:0277-1CVE-2022-4379+QID: 753629SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 5 for SLE 15 SP4) (SUSE-SU-2023:0280-1)SeverityCritical4Recently PublishedQualys ID753629Date PublishedFebruary 8, 2023Vendor ReferenceSUSE-SU-2023:0280-1CVE ReferenceCVE-2022-4379, CVE-2022-2602CVSS ScoresBase 7.5 / Temporal 6.5DescriptionSUSE has released a security update for kernel to fix the vulnerabilities.Affected product(s):SUSE Linux Enterprise Server 15 SP4SUSE Linux Enterprise Server for SAP Applications 15 SP4ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to SUSE security advisory SUSE-SU-2023:0280-1 for updates and patch information.Patches SUSE Enterprise Linux SUSE-SU-2023:0280-1CVE-2022-36323+QID: 591334Siemens SCALANCE denial-of-service (DoS) Multiple Vulnerabilities (SSA-710008, ICSA-22-223-07)SeveritySerious3Under InvestigationQualys ID591334Vendor Referencessa-710008CVE ReferenceCVE-2022-36323, CVE-2022-36324, CVE-2022-36325CVSS ScoresBase 7.5 / Temporal 6.7DescriptionSuccessful exploitation of these vulnerabilities could allow attackers to execute custom code through a cross site scripting attack or allow the unauthenticated attackers to create a denial-of-service situation.QID Detection Logic:This QID checks for the Vulnerable version of Siemens SCALANCE using passive scanning.ConsequenceSuccessful exploitation of these vulnerabilities could allow attackers to execute custom code through a cross site scripting attack or allow the unauthenticated attackers to create a denial-of-service situation.SolutionCustomers are advised to refer to CERT MITIGATIONS section SSA-710008 for affected packages and patching details.Patches SSA-710008CVE-2023-20021+QID: 317288Cisco Identity Services Engine (ISE) Privilege Escalation Vulnerabilities (cisco-sa-ise-os-injection-pxhKsDM)SeveritySerious3In DevelopmentQualys ID317288Vendor Referencecisco-sa-ise-os-injection-pxhKsDMCVE ReferenceCVE-2023-20021, CVE-2023-20022, CVE-2023-20023CVSS ScoresBase 6 / Temporal 5.2DescriptionMultiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid Administrator privileges on the affected device. Affected ProductsCisco ISE following vulnerable versions:3.2 prior to 3.2p1QID Detection Logic (Authenticated):The check matches the Cisco ISE version and ise_patch retrieved via Unix Auth using "show version" command. ConsequenceA successful exploit could allow the attacker to elevate privileges to root. SolutionCustomers are advised to refer to cisco-sa-ise-os-injection-pxhKsDM for more information.Patches cisco-sa-ise-os-injection-pxhKsDMCVE-2022-4729+QID: 181544Debian Security Update for graphite-web (DLA 3309-1)SeveritySerious3Recently PublishedQualys ID181544Date PublishedFebruary 8, 2023Vendor ReferenceDLA 3309-1CVE ReferenceCVE-2022-4729, CVE-2022-4730, CVE-2022-4728CVSS ScoresBase 5.4 / Temporal 4.7DescriptionDebian has released a security update for graphite-web to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to Debian security advisory DLA 3309-1 for updates and patch information.Patches Debian DLA 3309-1CVE-2022-2068+QID: 377937Splunk Enterprise Multiple Vulnerabilities (svd-2022-0804)SeverityCritical4Recently PublishedQualys ID377937Date PublishedFebruary 8, 2023Vendor Referencesvd-2022-0804CVE ReferenceCVE-2022-2068, CVE-2021-3541, CVE-2022-29824, CVE-2022-23308CVSS ScoresBase 9.8 / Temporal 8.5DescriptionSplunk Enterprise captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards, and visualizations.Splunk Enterprise is affected by multiple vulnerabilities:Affected Versions:Splunk Enterprise 8.1.10 and lowerSplunk Enterprise 8.2.0 to 8.2.7Splunk Enterprise 9.0.0 QID Detection Logic(Authenticated) It checks for vulnerable version of Splunk Enterprise .ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionVendor has released updated versions to fix these vulnerabilities. Please refer svd-2022-0804 for more details.Patches svd-2022-0804CVE-2023-21830+QID: 377930Azul Java Multiple Vulnerabilities Security Update January 2023SeveritySerious3Recently PublishedQualys ID377930Date PublishedFebruary 8, 2023Vendor ReferenceAzul Java Multiple Vulnerabilities Security Update January 2023CVE ReferenceCVE-2023-21830, CVE-2023-21835, CVE-2023-21843CVSS ScoresBase 5.3 / Temporal 4.6DescriptionAzul is a Java Platform for modern enterprise. The JDK by Azul also known as Zulu. Affected Versions: Azul Java Versions prior to 6.51(CPU), 8.66(CPU)/8.67(PSU), 11.60(CPU)/11.61(PSU), 13.53(CPU)/13.53(PSU), 15.44(CPU)/15.45(PSU), 17.38(CPU)/17.39(PSU), and 19.30(PSU)QID Detection Logic (Authenticated): This QID checks for "HKLM\Software\Azul Systems\Zulu" and "HKLM\Software\Wow6432Node\Azul Systems\Zulu 32-bit" subkeys and fetch Azul version on Windows Operating SystemsThis QID executes the command "java -version 2>&1" and checks for the zulu version on Linux Operating SystemsConsequenceSuccessful exploitation of this vulnerability could result in unauthorized access and an attacker can gain access to sensitive information.SolutionThe vendor has released updates to resolve these issues. Customers are advised to visit Azul Java webpage for release notes.Patches Azul Java January 2023CVE-2022-4621QID: 591302Panasonic Sanyo CCTV Network Camera Cross-Site Request Forgery (CSRF) VulnerabilitySeveritySerious3Under InvestigationQualys ID591302Date PublishedFebruary 8, 2023Vendor Referenceicsa-23-012-04CVE ReferenceCVE-2022-4621CVSS ScoresBase 8.8 / Temporal 8.1DescriptionSuccessful exploitation of this vulnerability could allow attackers to perform actions via HTTP without validity checks. Affected Versions VCC-HD5600P version 2.03-06 VDC-HD3300P version 2.03-08 VDC-HD3300P version 1.02-05 VCC-HD3300 version 2.03-02 VDC-HD3100P version 2.03-00 VCC-HD2100P version 2.03-02 QID Detection Logic:This QID checks for the Vulnerable version of Sanyo CCTV camera using passive scanningConsequenceSuccessful exploitation of this vulnerability could allow attackers to perform actions via HTTP without validity checks. SolutionCustomers are advised to refer to CERT MITIGATIONS section icsa-23-012-04 for affected packages and patching details.CVE-2022-3090QID: 591300Red Lion Crimson Path Traversal Vulnerabilities(ICSA-22-321-01)SeveritySerious3In DevelopmentQualys ID591300Date PublishedFebruary 8, 2023Vendor ReferenceICSA-22-321-01CVE ReferenceCVE-2022-3090CVSS ScoresBase 5.3 / Temporal 4.6DescriptionAFFECTED PRODUCTSThe following versions of Crimson 3.1 for the DA10D Protocol Converter are affected:Crimson 3.0: Version 707.000 and priorCrimson 3.1: Version 3126.001 and priorCrimson 3.2: Version 3.2.0044.0 and priorQID Detection:(Authenticated)This QID checks for vulnerable versions of Crimson using HKLM\SOFTWARE\Classes\Crimson(version-number).Database\DefaultIcon.ConsequenceSuccessful exploitation of this vulnerability could allow an attacker to obtain user credential hashes.SolutionCustomers are advised to refer to CERT MITIGATIONS section ICSA-22-321-01 for affected packages and patching details.Patches ICSA-22-321-01CVE-2020-14496QID: 591267Mitsubishi Electric Factory Automation Engineering Products (Update D) Multiple Vulnerabilities (ICSA-20-212-04)SeverityUrgent5Under InvestigationQualys ID591267Date PublishedFebruary 8, 2023Vendor ReferenceICSA-20-212-02CVE ReferenceCVE-2020-14496CVSS ScoresBase 9.8 / Temporal 8.5DescriptionAFFECTED PRODUCTSThe following products and versions are affected:MI Configurator, Versions 1.004E and priorSetting/monitoring tools for the C Controller module Versions 4.12N and priorCPU Module Logging Configuration Tool, versions 1.100E and priorNetwork Interface Board CC IE Control utility, Versions 1.29F and priorNetwork Interface Board CC IE Field Utility, Versions 1.16S and priorNetwork Interface Board MNETH utility, Versions 34L and priorMR Configurator2, Versions 1.105K and priorGX LogViewer, Versions 1.100E and priorM_CommDTM-IO-Link, Versions 1.03D and priorQID Detection Logic (Authenticated)This QID checks for the Vulnerable version using windows registry keys.ConsequenceSuccessful exploitation of this vulnerability may enable the reading of arbitrary files, cause a denial-of-service condition, and allow the execution of a malicious binary.SolutionCustomers are advised to refer to CERT MITIGATIONS section ICSA-20-212-02 for affected packages and patching details.Patches ICSA-20-212-02CVE-2022-38380QID: 43948FortiOS - Improper Access Control Vulnerability (FG-IR-22-174)SeverityMedium2Recently PublishedQualys ID43948Date PublishedFebruary 8, 2023Vendor ReferenceFG-IR-22-174CVE ReferenceCVE-2022-38380CVSS ScoresBase 4.3 / Temporal 3.8DescriptionAn improper access control [CWE-284] vulnerability in FortiOS may allow a remote authenticated read-only user to modify the interface settings via the API.Affected Versions:FortiOS version 7.2.0FortiOS version 7.0.0 through 7.0.7QID Detection Logic (Authenticated):Detection checks for vulnerable version of FortiOS.ConsequenceSuccessful exploitation of the vulnerability may allow Improper Access Control vulnerability. SolutionFortinet has released patch addressing the vulnerability. For more information please refer to FG-IR-22-174Patches FG-IR-22-174CVE-2022-2825+QID: 591239PTC Kepware KEPServerEX (Update A) Multiple Vulnerabilities (ICSA-22-242-10)SeverityUrgent5In DevelopmentQualys ID591239Date PublishedFebruary 8, 2023Vendor ReferenceICSA-22-242-10CVE ReferenceCVE-2022-2825, CVE-2022-2848CVSS ScoresBase 9.8 / Temporal 8.5DescriptionAFFECTED PRODUCTSThe following products are affected by the vulnerabilities found in Kepware KEPServerEX, a connectivity platform:Kepware KEPServerEX: Versions prior to v6.12ThingWorkx Kepware Server: Versions prior to v6.12OPC-Aggregator: Versions prior to v6.12GE Digital Industrial Gateway Server: Versions prior to v7.612Software Toolbox TOP Server: Versions prior to v6.12QID Detection Logic (Authenticated):QID checks for the Vulnerable version of using registry in "HKLM\SoftwareConsequenceSpecifically crafted OPC UA messages transmitted to the server could allow an attacker to crash the server and leak data and crash the server and remotely execute code.SolutionCustomers are advised to refer to CERT MITIGATIONS section ICSA-22-242-10 for affected packages and patching details.Patches ICSA-22-242-10CVE-2022-23521+QID: 354733Amazon Linux Security Advisory for git : ALAS2-2023-1923SeverityUrgent5Recently PublishedQualys ID354733Date PublishedFebruary 7, 2023Vendor ReferenceALAS2-2023-1923CVE ReferenceCVE-2022-23521, CVE-2022-41903CVSS ScoresBase 9.8 / Temporal 8.5Description git is distributed revision control system. Gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2kb when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue. (( CVE-2022-23521) git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.SolutionPlease refer to Amazon advisory: ALAS2-2023-1923 for affected packages and patching details, or update with your package manager.Patches amazon linux 2 ALAS2-2023-1923CVE-2022-23521+QID: 354718Amazon Linux Security Advisory for git : ALAS-2023-1679SeverityUrgent5Recently PublishedQualys ID354718Date PublishedFebruary 7, 2023Vendor ReferenceALAS-2023-1679CVE ReferenceCVE-2022-23521, CVE-2022-41903CVSS ScoresBase 9.8 / Temporal 8.5Description git is distributed revision control system. Gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2kb when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue. (( CVE-2022-23521) git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.SolutionPlease refer to Amazon advisory: ALAS-2023-1679 for affected packages and patching details, or update with your package manager.Patches amazon linux ALAS-2023-1679CVE-2022-47629QID: 241167Red Hat Update for libksba (RHSA-2023:0594)SeverityUrgent5Recently PublishedQualys ID241167Date PublishedFebruary 7, 2023Vendor ReferenceRHSA-2023:0594CVE ReferenceCVE-2022-47629CVSS ScoresBase 9.8 / Temporal 8.5DescriptionKsba (pronounced kasbah) is a library to make x.509 certificates as well as the cms easily accessible by other applications. Both specifications are building blocks of s/mime and tls...Security Fix(es): libksba: integer overflow to code executiona (cve-2022-47629). Affected Products: Red Hat enterprise linux for x86_64 - extended update support 8.6 x86_64. Red hat enterprise linux server - aus 8.6 x86_64. Red hat enterprise linux for ibm z systems - extended update support 8.6 s390x. Red hat enterprise linux for power, little endian - extended update support 8.6 ppc64le. Red hat enterprise linux server - tus 8.6 x86_64. Red hat enterprise linux for arm 64 - extended update support 8.6 aarch64. Red hat enterprise linux server for power le - update services for sap solutions 8.6 ppc64le. Red hat enterprise linux for x86_64 - update services for sap solutions 8.6 x86_64. Red hat codeready linux builder for x86_64 - extended update support 8.6 x86_64. Red hat codeready linux builder for power, little endian - extended update support 8.6 ppc64le. Red hat codeready linux builder for ibm z systems - extended update support 8.6 s390x. Red hat codeready linux builder for arm 64 - extended update support 8.6 aarch64.. Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to Red Hat security advisory RHSA-2023:0594 for updates and patch information.Patches Red Hat Enterprise Linux RHSA-2023:0594CVE-2022-23521+QID: 241166Red Hat Update for git (RHSA-2023:0610)SeverityUrgent5Recently PublishedQualys ID241166Date PublishedFebruary 7, 2023Vendor ReferenceRHSA-2023:0610CVE ReferenceCVE-2022-23521, CVE-2022-41903CVSS ScoresBase 9.8 / Temporal 8.5DescriptionGit is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, git ensures that each working copy of a git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection...Security Fix(es): git: gitattributes parsing integer overflow (cve-2022-23521). Git: heap overflow in `git archive`, `git log --format` leading to rce (cve-2022-41903). Affected Products: Red Hat enterprise linux for x86_64 8 x86_64. Red hat enterprise linux for ibm z systems 8 s390x. Red hat enterprise linux for power, little endian 8 ppc64le. Red hat enterprise linux for arm 64 8 aarch64.. Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to Red Hat security advisory RHSA-2023:0610 for updates and patch information.Patches Red Hat Enterprise Linux RHSA-2023:0610CVE-2022-23521+QID: 241163Red Hat Update for git (RHSA-2023:0611)SeverityUrgent5Recently PublishedQualys ID241163Date PublishedFebruary 7, 2023Vendor ReferenceRHSA-2023:0611CVE ReferenceCVE-2022-23521, CVE-2022-41903CVSS ScoresBase 9.8 / Temporal 8.5DescriptionGit is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, git ensures that each working copy of a git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection...Security Fix(es): git: gitattributes parsing integer overflow (cve-2022-23521). Git: heap overflow in `git archive`, `git log --format` leading to rce (cve-2022-41903). Affected Products: Red Hat enterprise linux for x86_64 9 x86_64. Red hat enterprise linux for ibm z systems 9 s390x. Red hat enterprise linux for power, little endian 9 ppc64le. Red hat enterprise linux for arm 64 9 aarch64.. Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to Red Hat security advisory RHSA-2023:0611 for updates and patch information.Patches Red Hat Enterprise Linux RHSA-2023:0611CVE-2022-23521+QID: 241161Red Hat Update for rh-git227-git (RHSA-2023:0597)SeverityUrgent5Recently PublishedQualys ID241161Date PublishedFebruary 7, 2023Vendor ReferenceRHSA-2023:0597CVE ReferenceCVE-2022-23521, CVE-2022-41903CVSS ScoresBase 9.8 / Temporal 8.5DescriptionGit is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, git ensures that each working copy of a git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection...Security Fix(es): git: gitattributes parsing integer overflow (cve-2022-23521). Git: heap overflow in `git archive`, `git log --format` leading to rce (cve-2022-41903). Affected Products: Red Hat software collections (for rhel server) 1 for rhel 7 x86_64. Red hat software collections (for rhel server for system z) 1 for rhel 7 s390x. Red hat software collections (for rhel server for ibm power le) 1 for rhel 7 ppc64le. Red hat software collections (for rhel workstation) 1 for rhel 7 x86_64.. Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to Red Hat security advisory RHSA-2023:0597 for updates and patch information.Patches Red Hat Enterprise Linux RHSA-2023:0597CVE-2021-35065+QID: 241160Red Hat Update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon (RHSA-2023:0612)SeverityUrgent5Recently PublishedQualys ID241160Date PublishedFebruary 7, 2023Vendor ReferenceRHSA-2023:0612CVE ReferenceCVE-2021-35065, CVE-2021-44906, CVE-2022-0235, CVE-2022-3517, CVE-2022-24999, CVE-2022-43548CVSS ScoresBase 9.8 / Temporal 8.5DescriptionNode.js is a software development platform for building fast and scalable network applications in the javascript programming language. .. Security fix(es): glob-parent: regular expression denial of service (cve-2021-35065). Minimist: prototype pollution (cve-2021-44906). Node-fetch: exposure of sensitive information to an unauthorized actor (cve-2022-0235). Nodejs-minimatch: redos via the braceexpand function (cve-2022-3517). Express: "qs" prototype poisoning causes the hang of the node process (cve-2022-24999). Nodejs: dns rebinding in inspect via invalid octal ip address (cve-2022-43548). Affected Products: Red Hat software collections (for rhel server) 1 for rhel 7 x86_64. Red hat software collections (for rhel server for system z) 1 for rhel 7 s390x. Red hat software collections (for rhel server for ibm power le) 1 for rhel 7 ppc64le. Red hat software collections (for rhel workstation) 1 for rhel 7 x86_64.. Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to Red Hat security advisory RHSA-2023:0612 for updates and patch information.Patches Red Hat Enterprise Linux RHSA-2023:0612CVE-2022-23521+QID: 241158Red Hat Update for git (RHSA-2023:0596)SeverityUrgent5Recently PublishedQualys ID241158Date PublishedFebruary 7, 2023Vendor ReferenceRHSA-2023:0596CVE ReferenceCVE-2022-23521, CVE-2022-41903CVSS ScoresBase 9.8 / Temporal 8.5DescriptionGit is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, git ensures that each working copy of a git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection...Security Fix(es): git: gitattributes parsing integer overflow (cve-2022-23521). Git: heap overflow in `git archive`, `git log --format` leading to rce (cve-2022-41903). Affected Products: Red Hat enterprise linux for x86_64 - extended update support 8.4 x86_64. Red hat enterprise linux server - aus 8.4 x86_64. Red hat enterprise linux for ibm z systems - extended update support 8.4 s390x. Red hat enterprise linux for power, little endian - extended update support 8.4 ppc64le. Red hat enterprise linux server - tus 8.4 x86_64. Red hat enterprise linux for arm 64 - extended update support 8.4 aarch64. Red hat enterprise linux server for power le - update services for sap solutions 8.4 ppc64le. Red hat enterprise linux for x86_64 - update services for sap solutions 8.4 x86_64.. Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to Red Hat security advisory RHSA-2023:0596 for updates and patch information.Patches Red Hat Enterprise Linux RHSA-2023:0596CVE-2022-25147QID: 905385Common Base Linux Mariner (CBL-Mariner) Security Update for apr-util (13212)SeverityCritical4Recently PublishedQualys ID905385Date PublishedFebruary 7, 2023Vendor ReferenceMariner_2.0_13212CVE ReferenceCVE-2022-25147CVSS ScoresBase 9.8 / Temporal 9DescriptionCBL-Mariner 2.0 is an internal Linux distribution for cloud infrastructure and edge products and services of Microsoft.CBL-Mariner has NOT released a security update for apr-util to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionPatch is NOT available for the package.
Package Disabler Plus 4 Samsung v11.2 [Patched] [Latest]
2ff7e9595c
Comments