SUSE-SU-2023:3711-1 Security update for redis7

This update for redis7 fixes the following issues: - CVE-2023-41053: Fixed SORTRO may bypass ACL configuration bsc1215094...

CVE-2023-43137

Summary : CVE-2023-43137 affects TP-LINK TL-ER5120G (firmware 4.0 2.0.0 Build 210817 Rel.80868n). The issue is a command injection in the router’s ACL handling: when an attacker adds ACL rules after authentication, the rule name parameter contains injection points that can lead to arbitrary comma...

PT-2023-28711 · Tp Link · Tplink Tl-Er5120G

Name of the Vulnerable Software and Affected Versions: TPLINK TL-ER5120G version 4.0 2.0.0 Build 210817 Rel.80868n Description: The issue is a command injection vulnerability. It occurs when an attacker adds ACL rules after authentication, and the rule name parameter has injection points...

The vulnerability of the handle_interface_acl function in Milesight UR32L router software allows a hacker to execute arbitrary code.

The vulnerability of the handleinterfaceacl function in Milesight UR32L router microprogramming software arises due to a stack-based buffer overflow. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

ROS-20230915-12

A vulnerability in the Redis database management system is related to insecure privilege management. Exploitation of the vulnerability could allow an attacker to gain unauthorized access to keys that are not explicitly authorized by the ACL configuration...

The vulnerability of the handle_interface_acl function in Milesight UR32L router software allows a hacker to execute arbitrary code.

The vulnerability of the handleinterfaceacl function in Milesight UR32L router microprogramming software arises due to a stack-based buffer overflow. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Cisco IOS XR Software Compression ACL Bypass (cisco-sa-comp3acl-vGmp6BQ3)

According to its self-reported version, Cisco IOS XR is affected by an ACL bypass vulnerability. An unauthenticated, remote attacker can exploit this, to access trusted networks that the device might be protecting. Please see the included Cisco BID and Cisco Security Advisory for more information...

Vulnerabilities fixed in Cisco IOS XR

Cisco has fixed vulnerabilities in IOS XR. A unauthenticated malicious party could exploit the vulnerabilities to cause a denial-of-service, or to bypass existing ACLs bypassing them by sending specially prepared network traffic. Cisco has also fixed vulnerabilities that allow a local,...

CVE-2023-20190

A vulnerability in the classic access control list ACL compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to incorrect destination address range...

CVE-2023-20191

A vulnerability in the access control list ACL processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incomplete support for this feature. An attacker could exploit th...

Design/Logic Flaw

A vulnerability in the access control list ACL processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incomplete support for this feature. An attacker could exploit th...

CVE-2023-20190

Cisco IOS XR Software contains a vulnerability in the ACL compression feature (CVE-2023-20190) that can allow an unauthenticated, remote attacker to bypass ACL protections on an interface by exploiting incorrect destination address range encoding in the compression module. This could enable acces...

CVE-2023-20190

A vulnerability in the classic access control list ACL compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to incorrect destination address range...

CVE-2023-20191

Cisco IOS XR Software ACL bypass vulnerability (CVE-2023-20191) affects ACL processing on MPLS interfaces in the ingress direction. The issue arises from incomplete support for this feature, potentially allowing an unauthenticated, remote attacker to bypass a configured ACL by sending traffic thr...

CVE-2023-20191

A vulnerability in the access control list ACL processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incomplete support for this feature. An attacker could exploit th...

Cisco IOS XR Software Compression ACL Bypass Vulnerability

A vulnerability in the classic access control list ACL compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to incorrect destination address range...

Cisco IOS XR Software Access Control List Bypass Vulnerability

A vulnerability in the access control list ACL processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incomplete support for this feature. An attacker could exploit th...

CVE-2023-41053

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORTRO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been...

Oracle Linux 6 : dovecot (ELSA-2011-0600)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0600 advisory. 2.0.9-2 - fix issues and assert crashes found in 2.0.9 lmtp,dotlock,zlib 2.0.9-1 - dovecot updated to 2.0.9 - fixed a high system CPU usage / high...

Oracle Linux 5 : dovecot (ELSA-2009-0205)

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2009-0205 advisory. - Resolves: 436287, CVE-2008-4870 - Resolves: 469015, CVE-2008-4577 Tenable has extracted the preceding description block directly from the Oracle Linu...