CVE-2023-45226 BIG-IP Next SPK SSH vulnerability

The BIG-IP SPK TMM Traffic Management Module f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell SSH server on those containers. This is only exposed when ssh debug is...

x86/AMD: Debug Mask handling

ISSUE DESCRIPTION AMD CPUs since 2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of the guest state, leading to denials of service. 1 CVE-2023-34327 - An HVM vCPU can end up operating in the...

CVE-2023-36380

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support, CP-8050 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support. The affected devices contain a hard-coded ID in the SSH authorizedkeys configuration file...

CVE-2023-36380

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support, CP-8050 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support. The affected devices contain a hard-coded ID in the SSH authorizedkeys configuration file...

Hardcoded credentials

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support, CP-8050 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support. The affected devices contain a hard-coded ID in the SSH authorizedkeys configuration file...

CVE-2023-36380

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support, CP-8050 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support. The affected devices contain a hard-coded ID in the SSH authorizedkeys configuration file...

CVE-2023-36380

The CVE-2023-36380 issue affects Siemens SICAM A8000 CP-8031 and CP-8050 MASTER MODULEs prior to CPCI85 V05.11 when debug support is activated. A hard-coded credential in the SSH authorized_keys configuration enables login if the attacker knows the corresponding private key. The vulnerability is ...

CVE-2023-36380

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support, CP-8050 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support. The affected devices contain a hard-coded ID in the SSH authorizedkeys configuration file...

Siemens CPCI85 Firmware of SICAM A8000 Devices

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2023-8552 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions prior to the fixed version Description: The BIG-IP SPK TMM contains hardcoded credentials in the f5-debug-sidecar and f5-debug-sshd containers. This may allow an attacker to impersonate the SPK Secure Shell SSH server on those...

CVE-2023-45226: Use of Hard-coded Credentials

The BIG-IP SPK TMM Traffic Management Module f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell SSH server on those containers. This is only exposed when ssh debug is...

PT-2023-5961

Name of the Vulnerable Software and Affected Versions CP-8031 MASTER MODULE versions prior to CPCI85 V05.11 CP-8050 MASTER MODULE versions prior to CPCI85 V05.11 Description A vulnerability has been identified in the CP-8031 and CP-8050 MASTER MODULES, where the affected devices contain a...

Exploit for Heap-based Buffer Overflow in Gnu Glibc

CVE-2023-4911 https://www.qualys.com/2023/10/03/cve-2023-4911...

PT-2023-9491

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is related to a memory leak in the Linux kernel, specifically in the damon do test apply three regions function. This issue can be detected when CONFIG DAMON VADDR KUNI...

SUSE-SU-2023:3887-1 Security update for iperf

This update for iperf fixes the following issues: - update to 3.15 bsc1215662, ESNET-SECADV-2023-0002: Several bugs that could allow the iperf3 server to hang waiting for input on the control connection has been fixed ESnet Software Security Advisory ESNET-SECADV-2023-0002 A bug that caused garbl...

CLSA-2023-1695752345 Fix CVE(s): CVE-2022-45703

SECURITY UPDATE: a heap buffer overflow triggered in displaydebugsection at binutils/readelf.c - debian/patches/CVE-2022-45703.patch: combine sanity checks, calculate element counts, not word counts, fix typo - CVE-2022-45703...

CLSA-2023-1695752243 Fix CVE(s): CVE-2022-45703

SECURITY UPDATE: a heap buffer overflow triggered in displaydebugsection at binutils/readelf.c - debian/patches/CVE-2022-45703.patch: combine sanity checks, calculate element counts, not word counts, fix typo - CVE-2022-45703...

CVE-2023-5165

Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation ECI restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for Docker Business customers only and...

Design/Logic Flaw

Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation ECI restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for Docker Business customers only and...

CVE-2023-5165: Missing Authorization

Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation ECI restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for Docker Business customers only and...