CVE-2024-0912

CVE-2024-0912 affects Johnson Controls Software House C•CURE 9000 running on IIS. In certain conditions, the IIS web host can log Windows credentials within the application logs, exposing sensitive information. Affected product/version: Software House C•CURE 9000 v3.00.2 (hosted on IIS). Technica...

CVE-2024-0912 CCURE passwords exposed to administrators

Under certain circumstances the Microsoft® Internet Information Server IIS used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C•CURE 9000 or prior versions...

PT-2024-15915 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: C•CURE 9000 Web Server affected versions not specified Microsoft Internet Information Server IIS affected versions not specified Description: Under certain circumstances, the Microsoft Internet Information Server IIS used to host the C•CURE...

Johnson Controls Software House C●CURE 9000

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.7 ATTENTION : Low attack complexity Vendor : Johnson Controls Equipment : Software House C●CURE 9000 Vulnerability : Insertion of Sensitive Information into Log File 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to...

Cisco Nexus 3000 and 9000 Series Switches Port Channel ACL Programming (cisco-sa-nxos-po-acl-TkyePgvL)

A vulnerability exists in the access control list ACL programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device. Please see the...

Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers PPPoE DoS (cisco-sa-iosxr-pppma-JKWFgneW)

According to its self-reported version, Cisco IOS XR is affected by a vulnerability. - A vulnerability in the PPP over Ethernet PPPoE termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the...

CVE-2024-20327

A vulnerability in the PPP over Ethernet PPPoE termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the pppma process, resulting in a denial of service DoS condition. This vulnerability is du...

CVE-2024-20327

Cisco IOS XR Software for ASR 9000 Series (PPPoE termination) is affected by CVE-2024-20327. The issue arises from improper handling of malformed PPPoE packets on a router running BNG PPPoE termination on Lightspeed-based line cards, allowing an unauthenticated adjacent attacker to crash the ppp_...

GHSA-XHG9-XWCH-VR7X quiche vulnerable to unbounded storage of information related to connection ID retirement

Impact Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers IDs; see RFC 9000 Section 5.1. Endpoints declare the...

quiche vulnerable to unbounded storage of information related to connection ID retirement

Impact Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers IDs; see RFC 9000 Section 5.1. Endpoints declare the...

Cisco ASR 9000 Security Vulnerability

The Cisco ASR 9000 is a 9000 series aggregation services router from Cisco. A security vulnerability exists in the Cisco ASR 9000 that stems from a security hole in the PPP over Ethernet PPPoE termination feature that could allow an unauthenticated, neighboring attacker to corrupt the pppma...

CVE-2024-1410

Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers IDs; see RFC 9000 Section 5.1...

Design/Logic Flaw

Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers IDs; see RFC 9000 Section 5.1...

CVE-2024-1410

CVE-2024-1410 affects Cloudflare quiche, an open-source QUIC implementation. The issue is unbounded storage of information related to connection ID retirement, where an unauthenticated attacker can cause RETIRE_CONNECTION_ID frames to arrive faster than they can be retired, potentially overflowin...

CVE-2024-1410 Unbounded storage of information related to connection ID retirement, in quiche

Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers IDs; see RFC 9000 Section 5.1...

Improper access control

A vulnerability in the access control list ACL programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device. This vulnerability is...

Cisco Nexus 3000 Series Switches Security Vulnerability

The Cisco Nexus 3000 Series Switches is a 3000 series switch from Cisco. A security vulnerability exists in the Cisco Nexus 3000 and 9000 Series Switches that arises from incorrect hardware programming when making configuration changes to ports...

CVE-2023-50923

In QUIC in RFC 9000, the Latency Spin Bit specification section 17.4 does not strictly constrain the bit value when the feature is disabled, which might allow remote attackers to construct a covert channel with data represented as changes to the bit value. NOTE: The "Sheridan, S., Keane, A. 2015...

Code injection

In QUIC in RFC 9000, the Latency Spin Bit specification section 17.4 does not strictly constrain the bit value when the feature is disabled, which might allow remote attackers to construct a covert channel with data represented as changes to the bit value. NOTE: The "Sheridan, S., Keane, A. 2015...

CVE-2023-50923

In QUIC in RFC 9000, the Latency Spin Bit specification section 17.4 does not strictly constrain the bit value when the feature is disabled, which might allow remote attackers to construct a covert channel with data represented as changes to the bit value. NOTE: The "Sheridan, S., Keane, A. 2015...