CVE-2024-32771

CVE-2024-32771 concerns an improper restriction of excessive authentication attempts in several QNAP OS versions. Multiple connected sources (NVD, RH, Tenable, etc.) confirm that QuTScloud is not affected, while QTS and QuTS hero were patched in the fixed builds: QTS 5.2.0.2782 build 20240601 and...

CVE-2024-38641: Improper Neutralization of Special Elements used in a Command

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network users to execute commands via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823...

CVE-2024-38642: Improper Certificate Validation

An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local network users to compromise the security of the system via unspecified vectors. We have already fixed the vulnerability in the following version: QuMagie 2.3.1 a...

CVE-2024-32771: Improper Restriction of Excessive Authentication Attempts

An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network authenticated administrators to perform an arbitrary number of authentication attempts via...

PT-2024-38976 · Gix-Path · Gix-Path

Name of the Vulnerable Software and Affected Versions: gix-path affected versions not specified Description: The issue allows an attacker to expose sensitive data via gix path::env with local network access. It is recommended to limit network exposure. Recommendations: At the moment, there is no...

HyperView Geoportal Toolkit 安全漏洞

HyperView Geoportal Toolkit is a Map application in a Web browser from HyperView, Inc. A security vulnerability exists in HyperView Geoportal Toolkit version 8.2.4 and prior versions, which arises from an unrestricted cross-domain request for remote content pointed to by a GET request parameter,...

PT-2024-37636 · Unknown · Hyperview Geoportal Toolkit

Name of the Vulnerable Software and Affected Versions: HyperView Geoportal Toolkit versions prior to 8.5.0 Description: The issue allows an unauthenticated remote attacker to prepare links that, when opened, will load scripts from a remote location controlled by the attacker and execute them in t...

SUSE CVE-2024-42040

Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 3861aa5 up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of...

DEBIAN-CVE-2024-42040

Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 3861aa5 up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of...

OESA-2024-2024 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable function, allowing a user to trigger a heap buffer overflow via a local network. Successful...

OESA-2024-2022 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable function, allowing a user to trigger a heap buffer overflow via a local network. Successful...

OESA-2024-2023 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable function, allowing a user to trigger a heap buffer overflow via a local network. Successful...

PT-2024-29707

Name of the Vulnerable Software and Affected Versions DENEX U-Boot versions from its initial commit in 2002 3861aa5 up to today Description A Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot allows an attacker on the local network to leak memory from four up to 32 bytes of memory...

CVE-2024-42040

A buffer overflow vulnerability exists in the net/bootp.c component of DENEX U-Boot (affecting versions from initial commit in 2002 to present). An attacker on the local network can use crafted DHCP responses to trigger an overread, leaking 4 to 32 bytes of memory stored behind the packet. This i...

CVE-2024-42040: Buffer Copy without Checking Size of Input

Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 3861aa5 up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of...

CVE-2024-42040

Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 3861aa5 up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of...

PT-2024-7026

Name of the Vulnerable Software and Affected Versions IntelR CSME affected versions not specified Description The issue is related to an integer overflow in the firmware of some IntelR CSME, which may allow an unauthenticated user to potentially enable denial of service via adjacent access. This...

PT-2024-7101 · Phoenix Contact · Phoenix Contact Charx Sec-3000

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3000 versions up to 1.6.2 Description: A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user user-app t...

PT-2024-27006 · Apache · Apache Iotdb Workbench

Name of the Vulnerable Software and Affected Versions: Apache IoTDB Workbench versions 0.13.0 and later Description: A Server-Side Request Forgery SSRF issue affects Apache IoTDB Workbench, allowing an attacker to access the local network. This issue only affects products that are no longer...

EulerOS Virtualization 3.0.6.0 : edk2 (EulerOS-SA-2024-2068)

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable function, allowing a user to trigger a heap buffer overflow via a...