The vulnerability of the application software interface of the Polarion ALM (Application Lifecycle Management) development tool allows a hacker to bypass the authentication process and gain full access to the device.

The vulnerability of the application software interface of the Polarion ALM development tool is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and gain full access to the device...

kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query

A NULL pointer dereference issue was found in the Linux kernel's vmwgfx driver in vmwcmddxdefinequery. This flaw allows a local, unprivileged attacker with access to either /dev/dri/card0 or /dev/dri/rendererD128, who can issue an ioctl on the resulting file descriptor, to crash the system, causi...

SUSE-SU-2024:0109-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: Security fixes: - CVE-2023-6816: Fixed heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer bsc1218582 - CVE-2024-0229: Fixed reattaching to different master device may lead to out-of-bounds memory access bsc1218583 -...

kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c

An integer overflow was found in the Linux kernel's vmwgfx driver. This flaw allows a local, unprivileged attacker with access to either /dev/dri/card0 or /dev/dri/rendererD128, and able to issue an ioctl on the resulting file descriptor to crash the system, causing a denial of service...

Design/Logic Flaw

D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers to arbitrarily access any services running on the device that may be inadvertently listening via IPv6...

PT-2024-14837 · Genie Company · Aladdin Connect Mobile Application

Name of the Vulnerable Software and Affected Versions: The Genie Company Aladdin Connect Mobile Application versions 5.65 Build 2075 and below Description: The issue concerns the storage of users' product account authentication data in clear text within the application. This allows an attacker wi...

The vulnerability of the microprogramming software for Phoenix Contact Automation Worx Software Suite devices, including AXC 1050, AXC 1050 XC, AXC 3050, Config+, FC 350 PCI ETH, ILC1x0, ILC1x1, ILC 3xx, PC Worx, PC Worx Express, PC WORX RT BASIC, PC WORX SRT, RFC 430 ETH-IB, RFC 450 ETH-IB, RFC 460R PN 3TX, RFC 470S PN 3TX, RFC 480S PN 4TX, arises from the incorrect assignment of permissions to critical resources. This allows an attacker to gain full access to the device.

The vulnerability of the microprogramming software for Phoenix Contact Automation Worx Software Suite, AXC 1050, AXC 1050 XC, AXC 3050, Config+, FC 350 PCI ETH, ILC1x0, ILC1x1, ILC 3xx, PC Worx, PC Worx Express, PC WORX RT BASIC, PC WORX SRT, RFC 430 ETH-IB, RFC 450 ETH-IB, RFC 460R PN 3TX, RFC...

The vulnerability of the FactoryTalk Services Platform’s software for managing manufacturing processes is related to deficiencies in the authentication process. This allows attackers to bypass the authentication process and gain full access to the device.

The vulnerability of the FactoryTalk Services Platform software-related manufacturing process management systems is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to bypass the authentication process and gain full access to the device...

Microsoft Incident Response lessons on preventing cloud identity compromise

Microsoft observed a surge in cyberattacks targeting identities in 2023, with attempted password-based attacks increasing by more than tenfold in the first quarter of 2023 compared to the same period in 2022. Threat actors leverage compromised identities to achieve a significant level of access t...

PT-2023-7571 · Rockwell Automation · Factorytalk Services Platform

Name of the Vulnerable Software and Affected Versions: FactoryTalk Services Platform affected versions not specified Description: The issue is related to inadequate code logic in the FactoryTalk Services Platform, which could allow a previously unauthenticated threat actor to obtain a local Windo...

Authentication flaw

The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings ADB debug...

CVE-2023-4896 Authenticated Disclosure of Sensitive Information in AirWave Management Platform

A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface. Successful exploitation allows the attacker to gain access to some data that could be further exploited to laterally access devices...

CVE-2023-44097

Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality...

The vulnerability of the prog.cgi component in D-Link DIR-X3260 Wi-Fi routers allows a hacker to bypass the authentication process and gain full access to the device.

The vulnerability of the prog.cgi component in D-Link DIR-X3260 Wi-Fi routers is related to deficiencies in authentication procedures. Exploiting this vulnerability allows attackers to bypass authentication processes and gain full access to the device...

PT-2023-5698 · D Link · D-Link Dir-X3260

Name of the Vulnerable Software and Affected Versions: D-Link DIR-X3260 affected versions not specified Description: This issue allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-X3260 routers. The specific flaw exists within the prog.cgi executable...

PT-2023-6600 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a permissions bypass in the Bluetooth component of the Android operating system. This could allow a paired Bluetooth device to access a long-term identifier for an...

CVE-2023-32202

Walchem Intuition 9 firmware versions prior to v4.21 are vulnerable to improper authentication. Login credentials are stored in a format that could allow an attacker to use them as-is to login and gain access to the device...

CVE-2023-32202 Walchem Intuition Improper Authentication

Walchem Intuition 9 firmware versions prior to v4.21 are vulnerable to improper authentication. Login credentials are stored in a format that could allow an attacker to use them as-is to login and gain access to the device...

PT-2023-23660 · Walchem · Walchem Intuition 9

Name of the Vulnerable Software and Affected Versions: Walchem Intuition 9 firmware versions prior to v4.21 Description: The issue concerns improper authentication in the Walchem Intuition 9 firmware. Login credentials are stored in a format that could allow an attacker to use them as-is to login...

Cross site request forgery (csrf)

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device...