PT-2024-13264 · Unknown · Ailux Imx6 Bundle

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A CWE-613 “Insufficient Session Expiration” issue in the web application exists due to the session cookie sessionid lasting two weeks, which facilitates session hijacking attacks...

PT-2024-13255 · Unknown · Ailux Imx6 Bundle

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A heap-based buffer overflow vulnerability in the logger generic function of the Ax rtu binary allows a remote authenticated attacker to trigger a memory corruption. This may resul...

PT-2024-13258 · Google · Chromium

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A CWE-552 vulnerability in the embedded Chromium browser allows a physical attacker to arbitrarily download or upload files to or from the file system. This issue has unspecified...

Apple Security Update: iOS 15.8.2 and iPadOS 15.8.2

Apple recommends to install security update iOS 15.8.2 and iPadOS 15.8.2 on devices iPhone 6s all models, iPhone 7 all models, iPhone SE 1st generation, iPad Air 2, iPad mini 4th generation, and iPod touch 7th generation...

AiLux imx6 Security Vulnerability

AiLux imx6 is a computing module from AiLux. A security vulnerability exists in versions prior to AiLux imx6 bundle imx61.0.7-2, which stems from insufficient session expiration and allows an attacker to conduct a session hijacking attack...

Amazon Linux 2 : unbound (ALAS-2024-2481)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2481 advisory. Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of servi...

Amazon Linux 2 : kernel (ALAS-2024-2475)

The version of kernel installed on the remote host is prior to 4.14.336-257.562. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2475 advisory. 2024-07-03: CVE-2024-23851 was added to this advisory. dmtablecreate in drivers/md/dm-table.c in the Linux kernel...

Amazon Linux 2 : wpa_supplicant (ALAS-2024-2480)

The version of wpasupplicant installed on the remote host is prior to 2.6-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2480 advisory. wpasupplicant: potential authorization bypass CVE-2023-52160 Tenable has extracted the preceding description block directly fr...

Amazon Linux 2 : glib2 (ALAS-2024-2487)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2487 advisory. An issue was discovered in GNOME GLib before 2.66.8. When gfilereplace is used with GFILECREATEREPLACEDESTINATION to replace a path...

AiLux imx6 Security Vulnerability

AiLux imx6 is a computing module from AiLux. A security vulnerability exists in versions prior to AiLux imx61.0.7-2. A remote attacker could exploit the vulnerability to trigger memory corruption in a binary file...

PT-2024-13257 · Google · Chromium

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A vulnerability in the embedded Chromium browser, concerning the handling of alternative URLs other than "http://localhost", allows a physical attacker to read arbitrary files on t...

PT-2024-14811 · Mariadb · Mariadb

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A CWE-798 “Use of Hard-coded Credentials” issue in the MariaDB database of the web application allows a remote unauthenticated attacker to access the database service and all...

Debian dla-3751 : libapache2-mod-auth-openidc - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3751 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3751-1 [email protected] https://www.debian.org/lts/security/...

Amazon Linux 2 : curl (ALAS-2024-2490)

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2490 advisory. This update enables libpsl support in curl, which adds protection against domain spanning super cookies as described in section 5.3 of...

Amazon Linux 2 : less (ALAS-2024-2485)

The version of less installed on the remote host is prior to 458-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2485 advisory. closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE. CVE-2022-48624 Tenable has extracted the preceding...

RHEL 8 : squid:4 (RHSA-2024:1066)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1066 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fixes: squid: denial of service in...

Amazon Linux 2 : shim (ALAS-2024-2484)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2484 advisory. A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious...

Amazon Linux 2 : xerces-c (ALAS-2024-2476)

The version of xerces-c installed on the remote host is prior to 3.1.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2476 advisory. Apache issued this CVE to indicate the correct versions of xerces-c, which included the fix for CVE-2018-1311. See the older CVE...

AiLux imx6 Security Vulnerability

AiLux imx6 is a computing module from AiLux. A security vulnerability exists in versions prior to AiLux imx6 bundle imx61.0.7-2 that stems from a lack of authorization and allows an unauthenticated, remote attacker to access confidential configuration files...

Amazon Linux 2 : openssl (ALAS-2024-2479)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2479 advisory. Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack The...