CVE-2020-27184

CVE-2020-27184 affects NPort IA5000A Series network device servers. Root cause: Telnet-based management communications lack encryption, enabling potential Man‑in‑the‑Middle interference. Practical impact: exposure of sensitive information via unencrypted traffic as described in vendor/NVD entries...

KYOCERA Printer d-COPIA253MF 路径遍历漏洞

The KYOCERA Printer d-COPIA253MF is a network device from the Turkish company KYOCERA. It provides a printing function. A path traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. An attacker could retrieve or view arbitrary files from an affected server...

USN-4904-1: Linux kernel vulnerabilities

Ben Harris discovered that the Linux kernel would strip extended privilege attributes of files when performing a failed unprivileged system call. A local attacker could use this to cause a denial of service. CVE-2015-1350 Andrey Konovalov discovered that the video4linux driver for Hauppauge HD PV...

MDR Vendor Must-Haves, Part 2: Ingestion of Network Device Data

This blog post is part of an ongoing series about evaluating Managed Detection and Response MDR providers. For more insights, check out our guide, “10 Things Your MDR Service Must Do.” There are many factors to consider when assessing which Managed Detection and Response MDR vendor is the right f...

lxc:fuzz-lxc-config-read: Crash in lxc_free_netdev

Project: https://github.com/lxc/lxc.git Detailed Report: https://oss-fuzz.com/testcase?key=5791654037553152 Project: lxc Fuzzing Engine: libFuzzer Fuzz Target: fuzz-lxc-config-read Job Type: libfuzzerubsanlxc Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff7 Crash Stat...

lxc:fuzz-lxc-config-read: Use-of-uninitialized-value in lxc_get_netdev_by_idx

Detailed Report: https://oss-fuzz.com/testcase?key=5076762997424128 Project: lxc Fuzzing Engine: libFuzzer Fuzz Target: fuzz-lxc-config-read Job Type: libfuzzermsanlxc Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: lxcgetnetdevbyidx setconfignetnic parseline...

lxc:fuzz-lxc-config-read: Use-of-uninitialized-value in lxc_free_netdev

Detailed Report: https://oss-fuzz.com/testcase?key=4983746395766784 Project: lxc Fuzzing Engine: libFuzzer Fuzz Target: fuzz-lxc-config-read Job Type: libfuzzermsanlxc Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: lxcfreenetdev lxcfreenetworks lxcconffree...

rConfig 3.9.6 - (path) Local File Inclusion (Authenticated) Vulnerability

Exploit Title: rConfig 3.9.6 - 'path' Local File Inclusion Authenticated Exploit Author: 5a65726f Vendor Homepage: https://www.rconfig.com Software Link: https://www.rconfig.com/downloads/rconfig-3.9.6.zip Version: rConfig v3.9.6 Install scripts :...

rConfig 3.9.6 Local File Inclusion

Exploit Title: rConfig 3.9.6 - 'path' Local File Inclusion Authenticated Date: 2021-03-12 Exploit Author: 5a65726f Vendor Homepage: https://www.rconfig.com Software Link: https://www.rconfig.com/downloads/rconfig-3.9.6.zip Version: rConfig v3.9.6 Install scripts :...

QEMU: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c

An infinite loop flaw was found in the e1000e NIC emulation code of QEMU. This issue occurs in the e1000ewritepackettoguest routine while processing bogus RX descriptor data transmitted by the guest. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a...

NeDi PHP Code Injection Vulnerability

NeDi is an open source software tool that discovers, maps and inventories network devices and tracks connected end nodes. NeDi 1.9C suffers from a PHP code injection vulnerability. The vulnerability can be exploited to inject PHP code into the System Files function of endpoint /System-Files.php v...

FiberHome HG6245D devices 信任管理问题漏洞

Fiber is an open source web framework written in the Go language . A trust management issue vulnerability exists in FiberHome HG6245D, which arises from the lack of an effective trust management mechanism in a network system or product, and can be exploited by an attacker to attack affected...

QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c

An assertion failure flaw was found in QEMU in the network packet processing component. This issue affects the "e1000e" and "vmxnet3" network devices. This flaw allows a malicious guest user or process to abort the QEMU process on the host, resulting in a denial of service...

Suraaj Computer RL801GW suffers from an information disclosure vulnerability

The RL801GW is a network device. The Suraaj Computer RL801GW suffers from an information disclosure vulnerability that can be exploited by an attacker to obtain sensitive information...

Weak Password Vulnerability at Network Device Logins at Riptide Networks, Inc.

Ruijie Networks Co., Ltd. is a professional network manufacturer with a full range of network equipment product lines and solutions, including switches, routers, software, security firewalls, wireless products and storage. A weak password vulnerability exists in the network equipment login of...

CVE-2020-9201

There is an out-of-bounds read vulnerability in some versions of NIP6800, Secospace USG6600 and USG9500. The software reads data past the end of the intended buffer when parsing DHCP messages including crafted parameter. Successful exploit could cause certain service abnormal...

qemu:qemu-fuzz-i386-target-generic-fuzz-e1000e: Heap-use-after-free in e1000e_write_packet_to_guest

Detailed Report: https://oss-fuzz.com/testcase?key=5163636913602560 Project: qemu Fuzzing Engine: libFuzzer Fuzz Target: qemu-fuzz-i386-target-generic-fuzz-e1000e Job Type: libfuzzerasanqemu Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x606000072fe8 Crash State:...

V-SOL Command Injection Vulnerability

V-Solution V1600D is a Gpon-enabled terminal device for connecting fiber optic trunks.V-Solution V1600D4L is a Gpon-enabled terminal device for connecting fiber optic trunks.V-Solution V1600D-MINI is a Gpon-enabled terminal device for connecting fiber optic trunks.V-Solution V1600G1 is a...

Multiple CDATA product encryption issue vulnerabilities

Shenzhen C-Data Shenzhen C-Data 72408A and so on are the products of Shenzhen C-Data Company in China.Shenzhen C-Data 72408A is a kind of terminal equipment for connecting fiber optic trunks.Shenzhen C-Data FD1002S is a kind of terminal equipment for connecting fiber optic trunks.Shenzhen C-Data...

Debian DSA-4760-1 : qemu - security update

Multiple security issues were discovered in QEMU, a fast processor emulator : - CVE-2020-12829 An integer overflow in the sm501 display device may result in denial of service. - CVE-2020-14364 An out-of-bounds write in the USB emulation code may result in guest-to-host code execution. -...