Westermo Lynx 206-F2G Cleartext Transmission of Sensitive Information (CVE-2023-40544)

An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Westermo Lynx 206-F2G Permissive Cross-Domain Policy with Untrusted Domains (CVE-2023-45213)

A potential attacker with access to the device would be able to execute malicious code that could affect the correct functioning of the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Westermo Lynx 206-F2G Improper Neutralization of Input During Web Page Generation (CVE-2023-45227)

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'dns.0.server' parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Westermo Lynx 206-F2G Improper Neutralization of Input During Web Page Generation (CVE-2023-45222)

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'autorefresh' parameter. This plugin only works with Tenable.ot. Please visit...

Westermo Lynx 206-F2G Improper Neutralization of Input During Web Page Generation (CVE-2023-40143)

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'forward.0.domain' parameter. This plugin only works with Tenable.ot. Please visit...

Westermo Lynx 206-F2G Cross-Site Request Forgery (CVE-2023-38579)

The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user to carry out an action unintentionally...

SUSE CVE-2023-52505

In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent physetmodeext calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD implemented by the driver, as well as others, control protocol converters from multiple...

CVE-2023-52505

In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent physetmodeext calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD implemented by the driver, as well as others, control protocol converters from multiple...

CVE-2023-52505

In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent physetmodeext calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD implemented by the driver, as well as others, control protocol converters from multiple...

UBUNTU-CVE-2023-52505

In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent physetmodeext calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD implemented by the driver, as well as others, control protocol converters from multiple...

CVE-2023-52505

In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent physetmodeext calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD implemented by the driver, as well as others, control protocol converters from multiple...

CVE-2023-52505 phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers

In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent physetmodeext calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD implemented by the driver, as well as others, control protocol converters from multiple...

CVE-2023-52505

CVE-2023-52505 affects the Linux kernel driver for lynx-28g PHYs. The issue arises when concurrent phy_set_mode_ext() calls target PCC-related protocol-converter registers (PCC8, PCCC, PCCD) across multiple lanes, risking hardware register corruption because lynx_28g_rmw() lacked locking. The fix...

CentOS 9 : lynx-2.8.9-18.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the lynx-2.8.9-18.el9 build changelog. - Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may...

Amazon Linux 2023 : lynx (ALAS2023-2024-535)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-535 advisory. Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data. CVE-2021-38165 Tenable has extracte...

Medium: lynx

Issue Overview: Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data. CVE-2021-38165 Affected Packages: lynx Issue Correction: Run dnf update lynx --releasever 2023.3.20240219 or dnf...

Medium: lynx

Issue Overview: Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data. CVE-2021-38165 Affected Packages: lynx Issue Correction: Run dnf update lynx --releasever 2023.3.20240219 to updat...

CVE-2023-45735

A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device...

CVE-2023-45213

A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device...

CVE-2023-40143

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...