6468 matches found
This Week in Spring - February 4th, 2025
Hi, Spring fans! Welcome to another installment of This Week in Spring! It's February 4th, 2025, as I write this. We are ten days away from Valentine's day, and about a month away from Devnexus. Lots to look forward to, in both the short term and the long term! Let's dive right into this week's...
This Week in Spring - January 14th, 2025
Hi, Spring fans, and greetings from the island of St. Barths! Salut depuis l'île de Saint-Barthélemy! I'm on a bit of PTO and have been bouncing around from one beach to another with my family. I just landed on a winning combination for a beach: warm water, a restaurant/bar, and some for-pay seat...
This Year in Spring - December 31st, 2024
Hi Spring fans! Happy New Year! And welcome to another installment of This Year in Spring! The year that was... I write this edition from a desk overlooking the beautiful jungle of Martinique, a beautiful island nation in the French Caribbean. I’m sipping some rhum martinique , enjoying the...
free-mcp-excel (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-53924 via pycel (1.0.0b30)
pycel PYPI version 1.0.0b30 is affected by a known vulnerability. The following packages have a transitive dependency on pycel and may be impacted: - free-mcp-excel =0.1.2, =0.1.3 Source cves: CVE-2024-53924 Source advisory: SNYK:PYTHON-PYCEL-10050519...
PT-2024-6947
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a deadlock in the Linux kernel's mcp251x component. The mcp251x hw wake function is called with the mcp lock mutex held, which disables the interrupt handler and...
Malicious code in story-mcp-hub (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e663c654e00b0eb9bdfecb5446b4c56d8f8799ef600619c3f0577bd30863476b Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Malicious code in mcp-xyz (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e4d411df043997ef0429e5915d45bcddf0e361d525c4f471e32c861e9a3553fd Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2025-3471 Malicious code in story-mcp-hub (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e663c654e00b0eb9bdfecb5446b4c56d8f8799ef600619c3f0577bd30863476b Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2025-4223 Malicious code in mcp-xyz (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e4d411df043997ef0429e5915d45bcddf0e361d525c4f471e32c861e9a3553fd Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Buffer overflow
The Texas Instruments TI WiLink WL18xx MCP driver does not limit the number of information elements IEs of type XCCEXT1IEID or XCCEXT2IEID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code...
CVE-2023-29468: Buffer Copy without Checking Size of Input
The Texas Instruments TI WiLink WL18xx MCP driver does not limit the number of information elements IEs of type XCCEXT1IEID or XCCEXT2IEID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code...
CVE-2023-29468
The vulnerability CVE-2023-29468 affects TI WiLink WL18xx MCP driver in WILINK8-WIFI-MCP8 versions 8.5_SP3 and earlier. The root cause is that the driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_EXT_2_IE_ID parsed in a management frame, allowing a spe...
mcp-2.mm-stream.nl Cross Site Scripting vulnerability OBB-3447334
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2025-40166
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the mcp-2221 driver within the Linux kernel. The issue occurs when a device is plugged or unplugged without allowing the mcp init work function to...
F5 Big-IP Create Administrative User
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'unixcrypt' class MetasploitModule 'F5 Big-IP Create Admin User', 'Description' = %q This creates a local user with a username/password and root-level privileges...
PT-2023-33475 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.19 Description: The issue allows sleep in qed mcp trace dump. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.9 and fixed in Linux Kernel version v6.0.19...
PT-2025-40216
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.4.182+ 202104120910+6d1da174272d.61x Description The Linux kernel contains a flaw within the qed driver related to the qed mcp trace dump function. The qed mcp cmd and union function can cause delays exceeding ...
Metasploit Weekly Wrap-Up
A sack full of cheer from the Hacking Elves of Metasploit It is clear that the Metasploit elves have been busy this season: Five new modules, six new enhancements, nine new bug fixes, and a partridge in a pear tree are headed out this week! Partridge nor pear tree included. In this sack of goodie...
F5 Big-IP Gather Information from MCP Datastore
This module gathers various interesting pieces of data from F5's "mcp" datastore, which is accessed via /var/run/mcp using a proprietary protocol. Adapted from: https://github.com/rbowes-r7/refreshing-mcp-tool/blob/main/mcp-getloot.rb Module Options msf use post/linux/gather/f5/lootmcp msf...
