Unauthenticated local file disclosure on Milesight DeviceHub

TL;DR Nginx container on Milesight DeviceHub includes MQTT private key store Can download MQTT private keys across network Milesight eventually responded and issued a firmware update Unauthenticated local file disclosure on Milesight DeviceHub CVSS: 6.5 Medium CVSS:3.1:...

OESA-2024-2265 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage. An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful...

Synology Router Manager (SRM) 1.3.x Multiple Vulnerabilities (Synology-SA-24:16) - Unreliable Remote Version Check

Synology Router Manager SRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

HPESBCR04683 rev.1 - Certain HPE Cray and ProLiant XL Servers Using Certain AMD EPYC Processors, AMD-SB-7014: SMM Lock Bypass, Local Arbitrary Code Execution Vulnerability

Potential Security Impact: Local: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Cray EX235a Accelerator Blade - Prior to v1.9.0 HFP 24.9 HPE Cray EX235n Server - Prior to v1.5.0 HFP 24.9 HPE Cray EX255a Accelerator Blade - Prior to v1.1.0 HFP 24.8.1...

JVN#41397971: Multiple vulnerabilities in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software

AIPHONE IX SYSTEM is an IP Network Audio-Video Intercom and IXG SYSTEM is an IP-based Residential System. IX SYSTEM, IXG SYSTEM, and System Support Software contain multiple vulnerabilities listed below. OS command injection CWE-78 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 8.0...

Synology Router Manager (SRM) 1.3.x Multiple Vulnerabilities (Synology-SA-24:16) - Remote Known Vulnerable Versions Check

Synology Router Manager SRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Kieback&Peter DDC4000 Series

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/low attack complexity Vendor : Kieback&Peter Equipment : DDC4000 Series Vulnerabilities : Path Traversal, Insufficiently Protected Credentials, Use of Weak Credentials 2. RISK EVALUATION Successful exploitation of these...

CVE-2024-48792

An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process...

CVE-2024-48789

An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via the firmware update process...

CVE-2024-48791

An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process...

CVE-2024-48793

An issue in INATRONIC com.inatronic.bmw 2.7.1 allows a remote attacker to obtain sensitive information via the firmware update process...

CVE-2024-48790

An issue in ILIFE com.ilife.home.global 1.8.7 allows a remote attacker to obtain sensitive information via the firmware update process...

CVE-2024-48798

An issue in Hubble Connected com.hubbleconnected.vervelife 2.00.81 allows a remote attacker to obtain sensitive information via the firmware update process...

CVE-2024-48799

An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive information via the firmware update process...

CVE-2024-48797

An issue in PCS Engineering Preston Cinema com.prestoncinema.app 0.2.0 allows a remote attacker to obtain sensitive information via the firmware update process...

CVE-2024-48789

CVE-2024-48789 affects the INATRONIC com.inatronic.drivedeck.home application (version 2.6.23). The issue, described in the vulnerability entry, allows a remote attacker to obtain sensitive information through the firmware update process. According to the provided metrics, the exploit vector is N...

CVE-2024-48792

An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process...

CVE-2024-48790

CVE-2024-48790 affects ILIFE com.ilife.home.global 1.8.7. A vulnerability in the firmware update process could let a remote attacker obtain sensitive information. Descriptions from NVD/Red Hat/CVE records align on the affected version and impact; no exploit details are provided in the sources. Th...

CVE-2024-48793

CVE-2024-48793 affects INATRONIC com.inatronic.bmw v2.7.1. The issue permits a remote attacker to obtain sensitive information via the firmware update process. The connected PT-2024-33228 entry notes the vulnerability exists in version 2.7.1 and suggests restricting access to the firmware update ...

CVE-2024-48795

The CVE-2024-48795 entry concerns Creative Labs com.creative.apps.xficonnect 2.00.02, where a flaw in the firmware update process could allow a remote attacker to obtain sensitive information. Affected component: com.creative.apps.xficonnect runtime/firmware update flow. Underlying cause and exac...