CVE-2023-53362

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: don't assume child devices are all fsl-mc devices Changes in VFIO caused a pseudo-device to be created as child of fsl-mc devices causing a crash 1 when trying to bind a fsl-mc device to VFIO. Fix this by checking th...

ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()

...

CVE-2022-43110

Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web interface. An unauthenticated remote attacker can make changes to the system including: changing the web interface admin password,...

CVE-2023-6368

In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold...

CVE-2025-27927

An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...

CVE-2025-24248

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to enumerate devices that have signed into the user's Apple Account...

CVE-2025-24248

CVE-2025-24248 affects macOS Sequoia 15.4 under the Siri component. It is described as a permissions issue that could allow an app to enumerate devices signed into the user’s Apple Account. Apple fixed this by restricting permissions in macOS Sequoia 15.4. The public description does not provide ...

CVE-2025-24248

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to enumerate devices that have signed into the user's Apple Account...

CVE-2024-56782

In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: Add adev NULL check to acpiquirkskipserdevenumeration acpidevhidmatch does not check for adev == NULL, dereferencing it unconditional. Add a check for adev being NULL before calling acpidevhidmatch. At the moment...

CVE-2024-6449

HyperView Geoportal Toolkit in versions lower than 8.5.0 does not restrict cross-domain requests when fetching remote content pointed by one of GET request parameters. An unauthenticated remote attacker can prepare links, which upon opening will load scripts from a remote location controlled by t...

kernel: Linux kernel (soundwire): Memory corruption due to incorrect device enumeration completion

A flaw was found in the Linux kernel's soundwire subsystem. The code responsible for managing device enumeration completion, which allows drivers to synchronize with soundwire devices, contains a defect. This issue can lead to memory corruption if drivers are still waiting for completion, as the...

DEBIAN-CVE-2024-35785

In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix kernel panic caused by incorrect error handling The error path while failing to register devices on the TEE bus has a bug leading to kernel panic as follows: 15.398930 Unable to handle kernel paging request at...

CVE-2024-35785

CVE-2024-35785 affects the Linux kernel: a bug in the error path when registering devices on the TEE bus could trigger a kernel panic due to an incorrect error handling flow, specifically following the supplicant-based device enumeration change (commit 7269cba53d90). The issue manifests as a tran...

kernel: Linux kernel (soundwire): Memory corruption due to incorrect device enumeration completion

A flaw was found in the Linux kernel's soundwire subsystem. The code responsible for managing device enumeration completion, which allows drivers to synchronize with soundwire devices, contains a defect. This issue can lead to memory corruption if drivers are still waiting for completion, as the...

CVE-2023-6368

In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold...

CVE-2023-6368

In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold...

Authentication flaw

In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold...

CVE-2023-48294 Broken Access control on Graphs Feature in LibreNMS

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...

CVE-2023-48294

LibreNMS vulnerability CVE-2023-48294 allows a low-privilege user to enumerate devices by id or hostname via an unauthenticated graph.php request when viewing a device dashboard. The root cause is broken/insufficient access control around the graph endpoint, enabling information disclosure of all...

LibreNMS Security Vulnerabilities

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A security vulnerability exists in LibreNMS versions prior to 23.11.0. An attacker...