AFFECTED PRODUCTSReolink RLC-410W: v3.0.0.136_20121102QID Detection Logic:This QID checks for the Vulnerable version of Reolink RLC-410W using passive scanning.ConsequenceA denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP request to trigger this vulnerability.SolutionCustomers are advised to refer to CERT MITIGATIONS section TALOS-2021-1423 for affected packages and patching details.CVE-2021-40423QID: 591332Reolink RLC-410W cgiserver.cgi command parser denial of service (DoS) Vulnerability (TALOS-2021-1432)SeverityCritical4Under InvestigationQualys ID591332Vendor ReferenceTALOS-2021-1432CVE ReferenceCVE-2021-40423CVSS ScoresBase 7.5 / Temporal 7.1DescriptionAFFECTED PRODUCTSReolink RLC-410W: v3.0.0.136_20121102QID Detection Logic:This QID checks for the Vulnerable version of Reolink RLC-410W using passive scanning.ConsequenceA denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of HTTP requests can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.SolutionCustomers are advised to refer to CERT MITIGATIONS section TALOS-2021-1432 for affected packages and patching details.CVE-2022-3736+QID: 283685Fedora Security Update for bind (FEDORA-2023-a3d608daf4)SeverityCritical4In DevelopmentQualys ID283685Vendor ReferenceFEDORA-2023-a3d608daf4CVE ReferenceCVE-2022-3736, CVE-2022-3094, CVE-2022-3924CVSS ScoresBase 7.5 / Temporal 6.5DescriptionFedora has released a security update for bind to fix the vulnerabilities.Affected OS:Fedora 36ConsequenceMalicious users could use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability.SolutionRefer to Fedora security advisory Fedora 36 for updates and patch information.Patches Fedora 36 FEDORA-2023-a3d608daf4CVE-2023-24038QID: 181539Debian Security Update for libhtml-stripscripts-perl (DSA 5339-1)SeverityCritical4Recently PublishedQualys ID181539Date PublishedFebruary 6, 2023Vendor ReferenceDSA 5339-1CVE ReferenceCVE-2023-24038CVSS ScoresBase 7.5 / Temporal 6.5DescriptionDebian has released a security update for libhtml-stripscripts-perl to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to Debian security advisory DSA 5339-1 for updates and patch information.Patches Debian DSA 5339-1CVE-2023-20076QID: 317287Cisco IOx Application Hosting Environment Command Injection Vulnerability (cisco-sa-iox-8whGn5dL)SeverityCritical4In DevelopmentQualys ID317287Vendor Referencecisco-sa-iox-8whGn5dLCVE ReferenceCVE-2023-20076CVSS ScoresBase 7.2 / Temporal 6.3DescriptionA vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system.Affected ProductsThis vulnerability affects Cisco devices that are running Cisco IOS XE Software if they have the Cisco IOx feature enabled and they do not support native docker.800 Series Industrial ISRsCGR1000 Compute ModulesIC3000 Industrial Compute Gateways (releases 1.2.1 and later run native docker)IR510 WPAN Industrial Routers QID Detection Logic (Authenticated):The check matches Cisco IOS XE version retrieved via Unix Auth using "show version" command. QID Detection Logic (Unauthenticated):The check matches Cisco IOS XE version retrieved via SNMP or TCP/IP Fingerprint or NTP or Telnet. Note: This QID does not check for IC3000 Industrial Compute Gateways and IR510 WPAN Industrial Routers.ConsequenceA successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system.SolutionCustomers are advised to refer to cisco-sa-iox-8whGn5dL for more information.Patches cisco-sa-iox-8whGn5dLCVE-2022-42302+QID: 377958Veritas NetBackup SQL Injection VulnerbilitySeveritySerious3In DevelopmentQualys ID377958Vendor ReferenceVTS22-011CVE ReferenceCVE-2022-42302, CVE-2022-42303, CVE-2022-42304CVSS ScoresBase 9.8 / Temporal 8.5DescriptionVeritas NetBackup is an enterprise level heterogeneous backup and recovery suite.Affected Versions:Veritas NetBackup v10.0.0.0 and earlier.QID Detection Logic (Authenticated):Operating Systems: WindowsThe QID checks for the File Version of nbutil.exe ConsequenceAn attacker can comprise the Veritas NetBackup via SQL Injection. SolutionThe vendor has issued a fix for these vulnerabilities. Please refer to the vendor advisory VTS22-011 which addresses this issue.Patches VTS22-011CVE-2023-22374QID: 377959F5 BIG-IP IControl SOAP Vulnerability CVE-2023-22374 (K35253541)SeveritySerious3In DevelopmentQualys ID377959Vendor ReferenceK000130415CVE ReferenceCVE-2023-22374CVSS ScoresBase 8.6 / Temporal 7.5DescriptionBIG-IP has released a security update for BIG-IP to fix the vulnerabilities.Vulnerable Component: Affected Versions:17.0.016.1.0 - 16.1.315.1.0 - 15.1.814.1.0 - 14.1.513.1.5QID Detection Logic(Authenticated):This QID checks for the vulnerable versions of F5 BIG-IP devices using the tmsh command.ConsequenceThis vulnerability may allow an authenticated attacker with network access to iControl SOAP through the BIG-IP management port and/or self IP addresses to cause a denial-of-service (DoS) on the iControl SOAP CGI process or potentially execute arbitrary system commandsSolutionPlease refer to K000130415 for more information. Patches K000130415CVE-2022-45789QID: 591331Schneider Electric Modicon M340, M580 CPU and M580 CPU Safety Authentication Bypass Vulnerability (SEVD-2023-010-06)SeveritySerious3Under InvestigationQualys ID591331Vendor ReferenceSEVD-2023-010-06CVE ReferenceCVE-2022-45789CVSS ScoresBase 8.1 / Temporal 7.2DescriptionAFFECTED PRODUCTSModicon M340 CPU (part numbers BMXP34*): All VersionsModicon M580 CPU (part numbers BMEP* and BMEH*): All VersionsModicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S): All VersionsQID Detection Logic:This QID checks for the Vulnerable version of Schneider Electric Modicon M340, M580 CPU and M580 CPU Safety using passive scanning.ConsequenceSuccessful exploitation of these vulnerabilities may risk unauthorized access to your PLC, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller. SolutionCustomers are advised to refer to Schneider Electric MITIGATIONS section SEVD-2023-010-06 for affected packages and patching details.CVE-2022-22483QID: 20323IBM DB2 Information Disclosure Vulnerability (6618779)SeveritySerious3In DevelopmentQualys ID20323Vendor Reference6618779CVE ReferenceCVE-2022-22483CVSS ScoresBase 6.5 / Temporal 5.7DescriptionIBM Db2 may be vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used.Affected Versions:IBM DB2 up to V9.7 FP11IBM DB2 up to V10.1 FP6IBM DB2 up to V10.5 FP11IBM DB2 up to V11.1 FP 7IBM DB2 up to 11.5 FP8QID Detection Logic:Authenticated (DB2):This QID queries the DB2 server to get the server version and fix pack level and checks to see if it's vulnerable.Authenticated (Windows):This QID checks for vulnerable versions of DB2 on windows OSConsequenceSuccessful exploitation could lead to leakage of sensitive information SolutionPlease refer to the following links 6618779Patches 6618779CVE-2022-31697+QID: 216307VMware vCenter Server 7.0 Update 7.0 U3i (VMSA-2022-0030)SeveritySerious3Under InvestigationQualys ID216307Vendor ReferenceVMSA-2022-0030CVE ReferenceCVE-2022-31697, CVE-2022-31698CVSS ScoresBase 5.5 / Temporal 4.8DescriptionVMware vCenter Server is a server management solution that helps IT admins manage virtualized hosts and virtual machines in enterprise environments via a single console.Affected Versions: VMware vCenter Server Virtual Appliance 6.7 prior to build 20845200QID Detection Logic (Unauthenticated):This QID checks for vulnerable versions of VMware vCenter Server with build version using web service present on the target. ConsequenceA malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.SolutionRefer to VMware advisory VMSA-2022-0030 for more information.Patches VMSA-2022-0030CVE-2022-31697+QID: 216306VMware vCenter Server 6.7 Update 6.7 U3S (VMSA-2022-0030)SeveritySerious3Under InvestigationQualys ID216306Vendor ReferenceVMSA-2022-0030CVE ReferenceCVE-2022-31697, CVE-2022-31698CVSS ScoresBase 5.5 / Temporal 4.8DescriptionVMware vCenter Server is a server management solution that helps IT admins manage virtualized hosts and virtual machines in enterprise environments via a single console.Affected Versions: VMware vCenter Server Virtual Appliance 6.7 prior to build 20540798QID Detection Logic (Unauthenticated):This QID checks for vulnerable versions of VMware vCenter Server with build version using web service present on the target. ConsequenceA malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.SolutionRefer to VMware advisory VMSA-2022-0030 for more information.Patches VMSA-2022-0030CVE-2023-23608QID: 691050Free Berkeley Software Distribution (FreeBSD) Security Update for spotipy (c3fb48cc-a2ff-11ed-8fbc-6cf0490a8c18)SeverityMedium2In DevelopmentQualys ID691050Vendor Referencec3fb48cc-a2ff-11ed-8fbc-6cf0490a8c18CVE ReferenceCVE-2023-23608CVSS ScoresBase 0 / Temporal 0DescriptionFreeBSD has released a security update for spotipy to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to FreeBSD security advisory c3fb48cc-a2ff-11ed-8fbc-6cf0490a8c18 for updates and patch information.Patches "FreeBSD" c3fb48cc-a2ff-11ed-8fbc-6cf0490a8c18CVE-2022-46146QID: 691047Free Berkeley Software Distribution (FreeBSD) Security Update for node_exporter (d835c54f-a4bd-11ed-b6af-b42e991fc52e)SeverityCritical4Recently PublishedQualys ID691047Date PublishedFebruary 6, 2023Vendor Referenced835c54f-a4bd-11ed-b6af-b42e991fc52eCVE ReferenceCVE-2022-46146CVSS ScoresBase 8.8 / Temporal 7.7DescriptionFreeBSD has released a security update for node_exporter to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to FreeBSD security advisory d835c54f-a4bd-11ed-b6af-b42e991fc52e for updates and patch information.Patches "FreeBSD" d835c54f-a4bd-11ed-b6af-b42e991fc52eCVE-2022-2602+QID: 753620SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 12 for SLE 15 SP3) (SUSE-SU-2023:0262-1)SeverityCritical4Recently PublishedQualys ID753620Date PublishedFebruary 6, 2023Vendor ReferenceSUSE-SU-2023:0262-1CVE ReferenceCVE-2022-2602, CVE-2022-3424CVSS ScoresBase 8.6 / Temporal 7.5DescriptionSUSE has released a security update for kernel to fix the vulnerabilities.Affected product(s):SUSE Linux Enterprise Server 15 SP2SUSE Linux Enterprise Server for SAP Applications 15 SP2SUSE Linux Enterprise Server 15 SP3SUSE Linux Enterprise Server for SAP Applications 15 SP3ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionRefer to SUSE security advisory SUSE-SU-2023:0262-1 for updates and patch information.Patches SUSE Enterprise Linux SUSE-SU-2023:0262-1CVE-2023-22809QID: 283684Fedora Security Update for sudo (FEDORA-2023-298c136eee)SeverityCritical4Recently PublishedQualys ID283684Date PublishedFebruary 6, 2023Vendor ReferenceFEDORA-2023-298c136eeeCVE ReferenceCVE-2023-22809CVSS ScoresBase 7.8 / Temporal 6.8DescriptionFedora has released a security update for sudo to fix the vulnerabilities.Affected OS:Fedora 36ConsequenceMalicious users could use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability.SolutionRefer to Fedora security advisory Fedora 36 for updates and patch information.Patches Fedora 36 FEDORA-2023-298c136eeeCVE-2022-4510QID: 283676Fedora Security Update for binwalk (FEDORA-2023-32eb9d8ee7)SeverityCritical4Recently PublishedQualys ID283676Date PublishedFebruary 6, 2023Vendor ReferenceFEDORA-2023-32eb9d8ee7CVE ReferenceCVE-2022-4510CVSS ScoresBase 7.8 / Temporal 6.8DescriptionFedora has released a security update for binwalk to fix the vulnerabilities.Affected OS:Fedora 37ConsequenceMalicious users could use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability.SolutionRefer to Fedora security advisory Fedora 37 for updates and patch information.Patches Fedora 37 FEDORA-2023-32eb9d8ee7CVE-2022-4510QID: 283675Fedora Security Update for binwalk (FEDORA-2023-23047a5f4f)SeverityCritical4Recently PublishedQualys ID283675Date PublishedFebruary 6, 2023Vendor ReferenceFEDORA-2023-23047a5f4fCVE ReferenceCVE-2022-4510CVSS ScoresBase 7.8 / Temporal 6.8DescriptionFedora has released a security update for binwalk to fix the vulnerabilities.Affected OS:Fedora 36ConsequenceMalicious users could use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability.SolutionRefer to Fedora security advisory Fedora 36 for updates and patch information.Patches Fedora 36 FEDORA-2023-23047a5f4fCVE-2022-3736QID: 905380Common Base Linux Mariner (CBL-Mariner) Security Update for bind (13203)SeverityCritical4Recently PublishedQualys ID905380Date PublishedFebruary 6, 2023Vendor ReferenceMariner_2.0_13203CVE ReferenceCVE-2022-3736CVSS ScoresBase 7.5 / Temporal 6.9DescriptionCBL-Mariner 2.0 is an internal Linux distribution for cloud infrastructure and edge products and services of Microsoft.CBL-Mariner has NOT released a security update for bind to fix the vulnerabilities.ConsequenceSuccessful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.SolutionPatch is NOT available for the package.
android os 2.2 kernel 2.6.32 build number v1.5.7
DOWNLOAD: https://vittuv.com/2vIwZN
2ff7e9595c
Comments