01os (>=0.0.1 <=0.0.14), 0b1-protocol (>=0.1.0 <=0.1.3) +43116 more potentially affected by CVE-2024-30251 via aiohttp (>=0.13.1 <=3.9.3)

aiohttp PYPI version =0.13.1, =0.0.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.1, =0.1.2, =0.1.3 - 1942pyc =7.0.1 and more Source cves: CVE-2024-30251 Source advisory: OSV:GHSA-5M98-QGG9-WH84...

org.open-metadata:openmetadata-dist (>=0.12.1 <=DEMO_BETA1), org.open-metadata:openmetadata-k8s-operator (>=1.12.0 <=1.13.0-snapshot) +2 more potentially affected by CVE-2024-28848 via org.open-metadata:openmetadata-service (>=DEMO_BETA1 <=1.2.3)

org.open-metadata:openmetadata-service MAVEN version =DEMOBETA1, =0.12.1, =1.12.0, =1.10.0, =1.13.0-snapshot - org.open-metadata:openmetadata-ui =0.12.1.preview Source cves: CVE-2024-28848 Source advisory: OSV:GHSA-5XV3-FM7G-865R...

org.open-metadata:openmetadata-dist (>=0.12.1 <=DEMO_BETA1), org.open-metadata:openmetadata-k8s-operator (>=1.12.0 <=1.13.0-snapshot) +2 more potentially affected by CVE-2024-28253 via org.open-metadata:openmetadata-service (>=DEMO_BETA1 <=1.3.0)

org.open-metadata:openmetadata-service MAVEN version =DEMOBETA1, =0.12.1, =1.12.0, =1.10.0, =1.13.0-snapshot - org.open-metadata:openmetadata-ui =0.12.1.preview Source cves: CVE-2024-28253 Source advisory: OSV:GHSA-7VF4-X5M2-R6GR...

01os (>=0.0.1 <=0.0.14), 0b1-protocol (>=0.1.0 <=0.1.3) +43009 more potentially affected by CVE-2023-49082 via aiohttp (>=0.13.1 <=3.8.6)

aiohttp PYPI version =0.13.1, =0.0.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.1, =0.1.2, =0.1.3 - 1942pyc =7.0.1 and more Source cves: CVE-2023-49082 Source advisory: OSV:PYSEC-2023-251...

couchbase-mcp-server (>=0.3.1rc2 <=0.5.0), couchbase-sqlalchemy (=1.0.3) +4 more potentially affected by CVE-2023-45875 via couchbase (>=4.1.8 <=4.5.0)

couchbase PYPI version =4.1.8, =0.3.1rc2, =0.2.2.dev0, =1.0.2 - pyxi-azdo-analytics =0.0.1 - pyxi-couchbase-client =0.0.10 Source cves: CVE-2023-45875 Source advisory: OSV:PYSEC-2023-235...

Buffer overflow

The Texas Instruments TI WiLink WL18xx MCP driver does not limit the number of information elements IEs of type XCCEXT1IEID or XCCEXT2IEID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code...

CVE-2023-29468

The vulnerability CVE-2023-29468 affects TI WiLink WL18xx MCP driver in WILINK8-WIFI-MCP8 versions 8.5_SP3 and earlier. The root cause is that the driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_EXT_2_IE_ID parsed in a management frame, allowing a spe...

mcp-2.mm-stream.nl Cross Site Scripting vulnerability OBB-3447334

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

F5 Big-IP Create Administrative User

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'unixcrypt' class MetasploitModule 'F5 Big-IP Create Admin User', 'Description' = %q This creates a local user with a username/password and root-level privileges...

PT-2023-33475 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.19 Description: The issue allows sleep in qed mcp trace dump. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.9 and fixed in Linux Kernel version v6.0.19...

PT-2025-40216

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.4.182+ 202104120910+6d1da174272d.61x Description The Linux kernel contains a flaw within the qed driver related to the qed mcp trace dump function. The qed mcp cmd and union function can cause delays exceeding ...

Metasploit Weekly Wrap-Up

A sack full of cheer from the Hacking Elves of Metasploit It is clear that the Metasploit elves have been busy this season: Five new modules, six new enhancements, nine new bug fixes, and a partridge in a pear tree are headed out this week! Partridge nor pear tree included. In this sack of goodie...

F5 Big-IP Gather Information from MCP Datastore

This module gathers various interesting pieces of data from F5's "mcp" datastore, which is accessed via /var/run/mcp using a proprietary protocol. Adapted from: https://github.com/rbowes-r7/refreshing-mcp-tool/blob/main/mcp-getloot.rb Module Options msf use post/linux/gather/f5lootmcp msf...

ds-mcp (>=1.0.9 <=1.0.11) potentially affected by CVE-2022-32213 via llhttp (=1.0.1)

llhttp NPM version =1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on llhttp and may be impacted: - ds-mcp =1.0.9, =1.0.11 Source cves: CVE-2022-32213 Source advisory: OSV:GHSA-5689-V88G-G6RV...

CVE-2021-45445

Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop...

CVE-2021-45445

Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop...

Design/Logic Flaw

Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop...

CVE-2021-45445

Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop...

CVE-2021-45445

CVE-2021-45445 affects Unisys ClearPath MCP TCP/IP Networking Services versions 59.1, 60.0 and 62.0. The connected documents describe a vulnerability that triggers an infinite loop in the networking services component, leading to denial of service (availability impact). The CVSS data in the initi...

Unisys ClearPath MCP 代码问题漏洞

Unisys ClearPath MCP is an operating system from Unisys, Inc. A code issue vulnerability exists in Unisys ClearPath MCP TCP IP Networking Services that stems from an infinite loop error in the product. An attacker could cause a denial of service via this vulnerability. The following products and...