CVE-2023-40462

The CVE-2023-40462 issue affects Sierra Wireless AirLink ALEOS ACEManager (4.16 and earlier). The root cause is inadequate input sanitization during authentication, potentially enabling a DoS on ACEManager with a restart recovery within about ten seconds. The connected documents confirm the vulne...

CVE-2023-40461

CVE-2023-40461 : Stored Cross-Site Scripting in the ACEManager file upload field of Sierra Wireless AirLink ALEOS (versions 4.16 and earlier). An authenticated administrator can upload files with names that are not fully validated, enabling client-side script execution within ACEManager and affec...

CVE-2023-40461 Cross-site scripting vulnerability in ACEManager

The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload field which does not fully validate the file name, creating a Stored Cross-Site Scripting condition...

CVE-2023-40460 Improper input leads to DoS

The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until the device is restarted...

CVE-2023-40459

The CVE-2023-40459 issue affects the ACEManager component in Sierra Wireless ALEOS firmware 4.16 and earlier, caused by inadequate input sanitization during authentication. This can lead to a Denial of Service (DoS) against ACEManager while other router functions remain operational. The vulnerabl...

CVE-2023-40459 Improper input leads to DoS

The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a Denial of Service DoS condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by...

Sierra Wireless ALEOS Security Vulnerability

Sierra Wireless ALEOS AAF is a framework for creating applications in Sierra Wireless AirLink gateways from Sierra Wireless Canada. A security vulnerability exists in Sierra Wireless ALEOS 4.16 and prior versions that stems from the ACEManager component not validating input, allowing an attacker ...

PT-2023-7520 · Aleos · Aleos

Name of the Vulnerable Software and Affected Versions: ALEOS versions 4.16 and earlier Description: The issue is related to the ACEManager component of the ALEOS operating system, which does not properly validate file names in a file upload field. This can lead to a Stored Cross-Site Scripting...

PT-2023-7789 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.35 Zyxel USG FLEX series versions 4.50 through 5.35 Zyxel USG FLEX 50W versions 4.16 through 5.35 Zyxel USG20W-VPN versions 4.16 through 5.35 Zyxel VPN series versions 4.30 through 5.35 Description: Th...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : Exo vulnerability (USN-6008-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6008-1 advisory. It was discovered that Exo did not properly sanitized desktop files. A remote attacker could possibly use this issue to to cau...

CVE-2022-47607

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Usersnap plugin = 4.16 versions...

CVE-2022-47607 WordPress Usersnap Plugin <= 4.16 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Usersnap plugin = 4.16 versions...

SUSE CVE-2019-3016

In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD...

x86: Cross-Thread Return Address Predictions

ISSUE DESCRIPTION It has been discovered that on some AMD CPUs, the RAS Return Address Stack, also called RAP - Return Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology is dynamically partitioned between non-idle threads. This allows an attacker t...

Code injection

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...

CVE-2022-46650

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...

PT-2023-33465 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.19 Description: The issue is related to the drm/i915/gvt component in the Linux Kernel. It was introduced in version v4.16 and fixed in version v6.0.19. The actual impact and attack plausibility have not ye...

PT-2022-36330 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.16 through 5.10.154 Description: A resource leak was discovered in the mv xor v2 remove function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions 4.16...

Security fix for the ALT Linux 10 package samba version 4.16.7-alt1

Nov. 22, 2022 Evgeny Sinelnikov 4.16.7-alt1 - Update to maintenance release of Samba 4.16 Samba15203 - Security fixes: + CVE-2022-42898: Samba's Kerberos libraries and AD DC failed to guard against integer overflows when parsing a PAC on a 32-bit system, which allowed an attacker with a forged PA...

PT-2022-35719 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.264 Description: The issue concerns error handling in the netsec register mdio function. It was introduced in version v4.16 and fixed in version v4.19.264. The actual impact and attack plausibility have no...