Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to denial of service due to FasterXML jackson-core (PRISMA-2023-0067)

Summary FasterXML jackson-core is shipped with IBM Tivoli Netcool Impact as part of it's backend infrastructure. Information about a security vulnerability affecting FasterXML jackson-core has been published in a security bulletin. Vulnerability Details IBM X-Force ID: 256137 DESCRIPTION: FasterX...

GHSA-RHRV-645H-FJFH Apache Avro Java SDK vulnerable to Improper Input Validation

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro...

Linux Kernel eBPF Improper Input Validation Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF...

Rockwell Automation PanelView 800

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : PanelView 800 Vulnerability : Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to disclose...

WordPress plugin TM WooCommerce Compare & Wishlist Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

Real Time Automation Cross-Site Scripting Vulnerability

Real Time Automation 460 Series is a series of gateways from Real Time Automation, Inc. A cross-site scripting vulnerability exists in Real Time Automation 460 Series versions prior to v8.9.8 that stems from an improper neutralization of input during 1 web page generation, allowing an attacker to...

Siemens InsydeH2O Improper Input Validation (CVE-2021-41842)

An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5.4 before 05.43.46, and 5.5 before 05.51.45 in Insyde InsydeH2O. Code execution can occur because the SMI handler lacks a CommBuffer check. Insyde BIOS is...

Siemens InsydeH2O Improper Input Validation (CVE-2023-27373)

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Due to insufficient input validation, an attacker can tamper with a runtime-accessible EFI variable to cause a dynamic BAR setting to overlap SMRAM. Insyde BIOS is typically used in RUGGEDCOM APE products and some SIMATIC...

Debian: Security Advisory (DLA-3585-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dla-3585 : exempi - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3585 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3585-1 [email protected]...

The vulnerability of the SetHostIPv6Settings function in the D-Link DAP-1325 wireless signal booster software allows a hacker to execute arbitrary code.

The vulnerability of the SetHostIPv6Settings function in the D-Link DAP-1325 wireless signal booster software relates to the lack of measures to neutralize specific elements. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

[SECURITY] [DLA 3585-1] exempi security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3585-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès September 25, 2023 https://wiki.debian.org/LTS -...

Denial Of Service

nocodb is vulnerable to Denial Of Service. The vulnerability is due to Improper Input Validation via the Add new table field which can cause a Denial of Service by sending a specially crafted HTTP request...

Rockwell Automation FactoryTalk View Machine Edition

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : FactoryTalk View Machine Edition Vulnerability : Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

Siemens LOGO! 8 BM Devices Improper Input Validation (CVE-2022-36362)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions. Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be...

Improper Input Validation

github.com/hashicorp/vault is vulnerable to Improper Input Validation. The vulnerability is due to the transit secrets engine which allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. This could allow an attacker to potentially decrypt arbitrary...

Security Bulletin: IBM Security Guardium is affected by several vulnerabilities

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2022-24903 DESCRIPTION: rsyslog is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the TCP syslog server receiver components. By sending a specially-crafted...

CVE-2023-32649

A Denial of Service Dos vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, allows an unauthenticated attacker to crash the IDS module by sending specially crafted malformed network packets...

CVE-2023-32649 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0

A Denial of Service Dos vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, allows an unauthenticated attacker to crash the IDS module by sending specially crafted malformed network packets...

PT-2023-23106 · Nvidia · Nvidia Dgx H100 Bmc

Name of the Vulnerable Software and Affected Versions: NVIDIA DGX H100 BMC affected versions not specified Description: The issue is related to improper input validation in IPMI, which can be exploited by an attacker to achieve code execution, denial of services, escalation of privileges, and...