CAREL Boss-Mini

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : CAREL Equipment : Boss-Mini Vulnerability : Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

CVE-2021-47597 inet_diag: fix kernel-infoleak for UDP sockets

In the Linux kernel, the following vulnerability has been resolved: inetdiag: fix kernel-infoleak for UDP sockets KMSAN reported a kernel-infoleak 1, that can exploited by unpriv users. After analysis it turned out UDP was not initializing r-idiagexpires. Other users of inetskdiagfill might make...

UBUNTU-CVE-2024-38577

In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix showrcutaskstracegpkthread buffer overflow There is a possibility of buffer overflow in showrcutaskstracegpkthread if counters, passed to sprintf are huge. Counter numbers, needed for this are unrealistically high,...

UBUNTU-CVE-2024-38571

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/tsens: Fix null pointer dereference computeinterceptslope is called from calibrate8960 in tsens-8960.c as computeinterceptslopepriv, p1, NULL, ONEPTCALIB which lead to null pointer dereference if DEBUG or...

MAL-2024-1642 Malicious code in test-package-random-name-for-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1f87eff60d8591d10e2be79afe5011ea9f63f823c7a014281e4e21f0da76eb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in draconianspeed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b1212e40bb57fce7672f50431153645b13624cc1e2061b44c0b91fec275e7853 The OpenSSF Package Analysis project identified 'draconianspeed' @ 5.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1630 Malicious code in mvp-website-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 89574af4bb00d4c540ffc8651f5ef4bcc0f72af2368ee6e32346807e91d2e8a0 The OpenSSF Package Analysis project identified 'mvp-website-html' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

CyberChef - The Cyber Swiss Army Knife - A Web App For Encryption, Encoding, Compression And Data Analysis

CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include simple encoding like XOR and Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps, compression and decompression of data,...

MAL-2024-1628 Malicious code in rb-info-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 795c3e45bb638b1058118c99f65db4e6f84244a2af7acbb4d6bd09a19b94dca6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rb-accordion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 435bf9e58c9f11fe55f80f865ec1f291beee55aaaf1ff78d0235dbf93b35202f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the PT Network Attack Discovery (PT NAD) traffic analysis system arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands on behalf of the superuser.

The vulnerability of the PT Network Attack Discovery PT NAD traffic analysis system exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on behalf of the superuser...

This Week in Spring - June 18th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! I've just come from Paris, France, and now I'm in equally beautiful Krakow, Poland, for the amazing Devoxx PL event. We've got a ton of good stuff to dive into, so let's get going! In last week's installment of Spring Tips, I...

The vulnerability of the bgpd/bgp_label.c file in the networking routing implementation software for Unix-like systems allows a hacker to cause a service failure.

The vulnerability of the bgpd/bgplabel.c file in the networking routing implementation software for Unix-like systems in FRRouting is related to the inability to read data beyond the end of the stream during the analysis of marked one-way broadcasts. Exploiting this vulnerability could allow a...

Malicious code in delta0231 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7df399fa1580fb8e64d7cd2481b0212f607aa8146a1b904b83a7af05ebb8031b The OpenSSF Package Analysis project identified 'delta0231' @ 100.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1619 Malicious code in dc-test1-asdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 04026ef40e4abce9afd70341d1bbb7d8907a917e7a6bd0fd6b7ffb15623a30c0 The OpenSSF Package Analysis project identified 'dc-test1-asdf' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in dc-test1-asdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 04026ef40e4abce9afd70341d1bbb7d8907a917e7a6bd0fd6b7ffb15623a30c0 The OpenSSF Package Analysis project identified 'dc-test1-asdf' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1624 Malicious code in importlib-metadate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b6db8994d6a78a5d0d95df2d0add2257ee6188f8c5419cbd7e2813426739d15d --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: baidu-readver Reasons based on the campaign: - The package...

CVE-2024-6048

Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vulnerability to inject system commands and execute them on the remote server...

CVE-2024-6045

CVE-2024-6045 relates to certain D-Link wireless routers that contain an undisclosed factory testing backdoor. An unauthenticated attacker on the local network can force Telnet to be enabled via a specific URL and then登录 using administrator credentials extracted from the firmware. The root cause ...

The vulnerability of the Radius syntax analysis function in the Nozomi Guardian tool for detecting and tracking network activities allows a perpetrator to trigger a service failure.

The vulnerability of the Radius syntax analysis function in the Nozomi Guardian tool for detecting and tracking network activities is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...