13610 matches found
CVE-2023-41273
CVE-2023-41273 is a heap-based buffer overflow affecting several QNAP OS lines (QTS, QuTS hero, QuTScloud). The vulnerability allows an authenticated administrator to execute code over the network. Affected/fixed versions include QTS 5.1.2.2533 build 20230926 and later; QuTS hero h5.1.2.2534 buil...
CVE-2023-39303 QTS, QuTS hero, QuTScloud
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578...
CVE-2023-39303
CVE-2023-39303 describes an improper authentication vulnerability in QNAP OSes (QTS, QuTS hero, QuTScloud) that could allow network-based compromise of the system. Affected products include QTS 5.1.3.2578+ (build 20231110 and later), QuTS hero h5.1.3.2578+ (build 20231110 and later), and QuTSclou...
CVE-2023-39302
CVE-2023-39302 is an OS command injection vulnerability in several QNAP OS versions. Affected products include QTS, QuTS hero, and QuTScloud. The root cause is command execution via the network by an authenticated administrator. Impact is described as high in CVSS terms; exploitation requires net...
CVE-2023-28807
In Zscaler Internet Access ZIA a mismatch between Connect Host and Client Hello's Server Name Indication SNI enables attackers to evade network security controls by hiding their communications within legitimate traffic...
Code injection
In Zscaler Internet Access ZIA a mismatch between Connect Host and Client Hello's Server Name Indication SNI enables attackers to evade network security controls by hiding their communications within legitimate traffic...
CVE-2023-28807 Bypass of ZIA domain fronting detection module through evasion technique
In Zscaler Internet Access ZIA a mismatch between Connect Host and Client Hello's Server Name Indication SNI enables attackers to evade network security controls by hiding their communications within legitimate traffic...
[SECURITY] Fedora 39 Update: dnsmasq-2.89-7.fc39
Dnsmasq is lightweight, easy to configure DNS forwarder and DHCP server. It is designed to provide DNS and, optionally, DHCP, to a small network. It can serve the names of local machines which are not in the global DNS. The DHCP server integrates with the DNS server and allows machines with...
Juniper Junos OS Vulnerability (JSA75735)
The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA75735 advisory. - A Heap-based Buffer Overflow vulnerability in the Routing Protocol Daemon RPD of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based...
CVE-2023-6200
A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution. Mitigation The remote attack is potentially possible in the local network only. It is...
CVE-2023-38317
OpenNDS
EulerOS 2.0 SP11 : perl (EulerOS-SA-2024-1110)
According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Perl before 5.38.2, Sparseunipropstring in regcomp.c can write to unallocated space because a property name associated with a \p... regular...
EulerOS 2.0 SP11 : shim (EulerOS-SA-2024-1129)
According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary:...
UBUNTU-CVE-2023-46343
In the Linux kernel before 6.5.9, there is a NULL pointer dereference in sendacknowledge in net/nfc/nci/spi.c...
[SECURITY] Fedora 38 Update: openssh-9.0p1-18.fc38
SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...
CVE-2023-35835
The CVE-2023-35835 issue affects SolaX Pocket WiFi (versions 3–3.001.02) where the device exposes a WiFi access point for initial configuration that lacks network authentication and remains active after setup, paired with an unauthenticated ModBus interface and a web-based configuration utility. ...
CVE-2023-35836
The CVE-2023-35836 issue affects SolaX Pocket WiFi versions 3 through 3.001.02. A nearby attacker (RF range) can capture a plaintext copy of the device’s network configuration, including the Wi‑Fi PSK, during setup or reconfiguration. This enables further access to the target’s Wi‑Fi networks. Re...
What to do with that fancy new internet-connected device you got as a holiday gift
Welcome to 2024! The Threat Source newsletter is back after our winter break. When I wasnt spending my downtime chasing around my toddler, one of my main projects was to upgrade the internet connection at my house. My ISP started offering Gigabit speeds and a 60 GHz connection, which was appealin...
Free access to ThreatDown Application Block: Elevate your Windows security at no cost
Malwarebytes continues to add value to its ThreatDown Bundles with the inclusion of Application Block as free for all ThreatDown Nebula accounts excluding Mobile only accounts. Users dont need to activate this new feature: the policy has been enabled in their account by default. For as many...
