AZL-31167 CVE-2023-27043 affecting package python3 for versions less than 3.9.19-9

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is...

CVE-2023-28979

An Improper Check for Unusual or Exceptional Conditions vulnerability in the kernel of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to bypass an integrity check. In a 6PE scenario and if an additional integrity check is configured, it will fail to drop specific malformed...

PT-2023-22061 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 19.3R3-S7 Juniper Networks Junos OS 19.4 versions prior to 19.4R3-S9 Juniper Networks Junos OS 20.2 versions prior to 20.2R3-S7 Juniper Networks Junos OS 20.3 versions prior to 20.3R3-S5 Juniper...

CVE-2023-28979 Junos OS: In a 6PE scenario upon receipt of a specific IPv6 packet an integrity check fails

An Improper Check for Unusual or Exceptional Conditions vulnerability in the kernel of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to bypass an integrity check. In a 6PE scenario and if an additional integrity check is configured, it will fail to drop specific malformed...

CVE-2023-27748

CVE-2023-27748 affects BlackVue DR750-2CH LTE version 1.012_2022.10.26. The issue is that firmware uploads are not checked for authenticity, enabling an attacker to upload crafted firmware that can contain backdoors and allow arbitrary code execution. Documents confirm the vulnerability exists bu...

Arista Networks CloudEOS 缓冲区错误漏洞

Arista Networks CloudEOS is a new platform version of EOS Arista Networks Extensible Operating System that supports Amazon Web Service AWS, Microsoft Azure and other public clouds. A security vulnerability exists in Arista Networks CloudEOS, which stems from a size-check bypass issue in the...

CVE-2023-24513 On affected platforms running Arista CloudEOS a size check bypass issue in the Software Forwarding Engine (Sfe) may allow buffer over reads in later code. Additionally, depending on configured options this may cause a recomputation of the TCP checksum ...

On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine Sfe can lead to a potential denial of service attack by sending malformed packets to the switch. This causes a leak of packet buffers and if enough malformed packets are received, the switch may eventually st...

GHSA-P3W6-3F7F-PM98 Jenkins OctoPerf Load Testing Plugin missing permission check allows for unauthorized server connections

Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to a previously configured Octoperf server using attacker-specified credentials. Additionally, these endpoints ...

SUSE CVE-2011-5063

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weak...

SUSE CVE-2021-25630

"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it was invoked by the "lool" user, and refuses to run with privileges, if it's not the case. In the vulnerable version of "loolforkit" this...

SUSE CVE-2022-3676

In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to access or modify memory via an incompatible type...

PT-2023-1347 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.9 through 15.3.4 GitLab CE/EE versions 15.4 through 15.4.3 GitLab CE/EE versions 15.5 through 15.5.1 Description: The issue is related to a flaw in the authorization procedure when managing keys and tokens using...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2023-1030)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-2484

The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware. This could result in the execution of a malicious kernel, arbitrary programs, or modified Nokia programs...

CVE-2022-2484

The vulnerability CVE-2022-2484 affects Nokia ASIK AirScale system module version 474021A.101. The Red Hat/CISA/NVD records describe a bypass of the module’s signature check, enabling an attacker to run modified firmware, which could lead to execution of a malicious kernel, arbitrary programs, or...

CVE-2022-46423

An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. An attacker can conduct a MITM Man-in-the-Middle attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause a Denial of Service...

Design/Logic Flaw

An exploitable firmware modification vulnerability was discovered on the Netgear XWN5001 Powerline 500 WiFi Access Point. An attacker can conduct a MITM Man-in-the-Middle attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or...

Design/Logic Flaw

An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. An attacker can conduct a MITM Man-in-the-Middle attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause a Denial of Service...

PT-2022-27872 · Tp Link · Tp-Link Tl-Wr743Nd

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR743ND V1 versions prior to 3.12.20 Description: An exploitable firmware modification vulnerability was discovered, allowing an attacker to conduct a Man-in-the-Middle MITM attack to modify the user-uploaded firmware image and...

PT-2022-14765 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a tapjacking/overlay attack in the onCreate method of LogAccessDialogActivity.java. This could allow bypassing a permission check, leading to local escalation of privilege with...