kernel: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

A vulnerability was found in the Linux kernel's iscsi tcp drivers. Improper resource allocation management can lead to a use-after-free scenario, triggered when the userspace attempts to access the session host's ipaddress attribute while the kernel is performing a session teardown via...

kernel: UAF during login when accessing the shost ipaddress

A use-after-free flaw was found in iscsiswtcpsessioncreate in drivers/scsi/iscsitcp.c in the SCSI sub-component in the Linux Kernel. This issue could allow an attacker to leak kernel internal information...

kernel: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress

In the Linux kernel, the following vulnerability has been resolved: scsi: iscsitcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr, we can get a KASAN UAF report like...

CVE-2024-23330 Tuta loads images from external resources

Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containing external content, they should be...

CVE-2024-23330

CVE-2024-23330 affects Tuta (encrypted email service). In versions before 119.10, an attacker can cause an image in a HTML email to load from an external resource by default, despite protections intended to block external content. The issue occurs when displaying emails containing external conten...

New Microsoft Incident Response guides help security teams analyze suspicious activity

Today Microsoft Incident Response are proud to introduce two one-page guides to help security teams investigate suspicious activity in Microsoft 365 and Microsoft Entra. These guides contain the artifacts that Microsoft Incident Response hunts for and uses daily to provide our customers with...

PT-2024-1253 · Totolink · Totolink Lr1200Gb

Name of the Vulnerable Software and Affected Versions: Totolink LR1200GB version 9.1.0u.6619 B20230130 Description: A critical issue has been identified, affecting the setDiagnosisCfg function of the /cgi-bin/cstecgi.cgi file. The manipulation of the ip argument leads to a stack-based buffer...

Wp Ultimate Review <= 2.3.2 - IP Spoofing

Description The plugin is vulnerable to IP Address Spoofing due to insufficient IP address validation and/or use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass IP rate limiting...

CVE-2024-23060

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg function...

CVE-2024-21638

Azure IPAM IP Address Management is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal used is only assign...

CVE-2024-21638

Azure IPAM (IP Address Management) suffers an elevation-of-privilege vulnerability (CVE-2024-21638) due to missing validation of the incoming authentication token, allowing impersonation of privileged users to access stored data. Affected component is the Azure IPAM solution running on Azure; the...

CVE-2023-7211

A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated remotely. The complexity of an...

CVE-2023-7211

A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated remotely. The complexity of an...

Design/Logic Flaw

A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated remotely. The complexity of an...

CVE-2023-7211 Uniway Router Administrative Web Interface reliance on ip address for authentication

A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated remotely. The complexity of an...

CVE-2023-7211 Uniway Router Administrative Web Interface reliance on ip address for authentication

A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated remotely. The complexity of an...

CVE-2023-7211

CVE-2023-7211 affects Uniway Router 2.0, specifically the Administrative Web Interface. The vulnerability arises from unknown code in that component, causing authentication to rely on the client’s IP address. The issue enables remote exploitation with high impact across confidentiality, integrity...

Uniway Router Security Vulnerability

Uniway Router is a series of routers from Uniway USA. A security vulnerability exists in Uniway Router version 2.0, which stems from unknown code in the component Administrative Web Interface, resulting in a dependency on an IP address for authentication...

Exploit for SQL Injection in Wordpress

WordPress CVE-2022-21661 Scanner Usage bash python wor...

Malware Scanner < 4.7.2 - IP Spoofing

Description The Malware Scanner plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 4.7.1 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated...