kernel: mptcp: ensure snd_nxt is properly initialized on connect

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure sndnxt is properly initialized on connect Christoph reported a splat hinting at a corrupted snduna: WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 mptcpcleanuna+0x4b3/0x620 net/mptcp/protocol.c:1005 Modules...

CVE-2024-44775

kmqtt v0.2.7 is vulnerable to Denial of Service DoS due to a Null Pointer Exception. A remote attacker can cause the broker to crash by sending a specially crafted MQTT CONNECT packet that triggers an unhandled null reference, leading to an immediate process termination...

GO-2024-3199 Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock

Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2024-45276 MB connect line/Helmholz: tmp directory exposed via webservice

An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication...

CVE-2024-45276 MB connect line/Helmholz: tmp directory exposed via webservice

An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication...

CVE-2024-45276

Summary: CVE-2024-45276 permits an unauthenticated remote attacker to read files in the "/tmp" directory due to missing authentication. Connected sources identify affected hardware as Helmholz MB connect line / REX100 wireless router, with public records noting versions prior to 2.3.1 are impacte...

CVE-2024-45275

CVE-2024-45275 concerns a trust-management vulnerability in Helmholz Rex100 wireless routers where two hard-coded user accounts with fixed passwords enable an unauthenticated remote attacker to gain full control of the device. Public sources in the provided connected documents specify affected de...

CVE-2024-45275 MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices...

CVE-2024-45274 MB connect line/Helmholz: Remote code execution via confnet service

An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication...

CVE-2024-45274

CVE-2024-45274 affects Helmholz REX100 and MBConnectline/mbNET.mini routers. Public data cites pre‑patch unauthenticated OS command execution via UDP on the confnet service, caused by missing authentication. Reported affected versions include REX100 < 2.3.3 (fixed in 2.3.3) and MBConnectline/m...

CVE-2024-45274 MB connect line/Helmholz: Remote code execution via confnet service

An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication...

CVE-2024-45273 MB connect line/Helmholz: Weak encryption of configuration file

An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used...

CVE-2024-45273

CVE-2024-45273 describes an unauthenticated local attacker who can decrypt the device’s configuration file due to a weak encryption implementation, leading to compromise of confidentiality, integrity, and availability. The vulnerability is triggered locally (attack vector: LOCAL) with low privile...

CVE-2024-45272

CVE-2024-45272 describes an unauthenticated remote brute-force attack against the credentials of the Remote Service Portal, leading to connection loss with a high likelihood of success (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The available connected documents corroborate a credential brut...

CVE-2024-45271 MB connect line/Helmholz: Remote code execution due to improper input validation

An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation...

CVE-2024-45271

Consolidated data shows CVE-2024-45271 affects Helmholz Rex100 (wireless router). The vulnerability arises from improper input validation in config deployment, enabling an unauthenticated local attacker to gain admin privileges by deploying a configuration file. Publicly referenced advisories (e....

PT-2024-9864 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 12.6, 11.4.7 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability. If an attacker convinces a victim to visit a URL referencing a vulnerable page, malicious JavaScript...

The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the failure to handle CRLF sequences properly, allows a violator to execute arbitrary code.

The vulnerability of Ivanti Connect Secure previously known as Pulse Connect Secure and Ivanti Policy Secure lies in the lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands with root privileges by...

CVE-2024-8376

A flaw was found in Eclipse Mosquitto. A remote attacker may be able to trigger memory leakage, segmentation fault, or a heap-use-after-free condition by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE", and "PUBLISH" packets...

DEBIAN-CVE-2024-8376

In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets...