Incorrect Validation

github.com/cometbft/cometbft/light is vulnerable to Incorrect Validation. The vulnerability is due to incomplete validation of the ProposerPriority field in the ValidatorSet retrieved from RPC endpoints, which can lead to inconsistencies in the proposer selection algorithm and potentially cause t...

CometBFT's state syncing validator from malicious node may lead to a chain split

Name: ASA-2024-009: State syncing validator from malicious node may lead to a chain split Component: CometBFT Criticality: Medium ACMv1.2: I:Moderate; L: Possible Affected versions: = 0.34.0, =0.37.0, = 0.38.0, = 0.38.11 Summary The state sync protocol retrieves a snapshot of the application and...

GHSA-G5XX-C4HV-9CCC CometBFT's state syncing validator from malicious node may lead to a chain split

Name: ASA-2024-009: State syncing validator from malicious node may lead to a chain split Component: CometBFT Criticality: Medium ACMv1.2: I:Moderate; L: Possible Affected versions: = 0.34.0, =0.37.0, = 0.38.0, = 0.38.11 Summary The state sync protocol retrieves a snapshot of the application and...

[SECURITY] Fedora 41 Update: lua-mpack-1.0.12-1.fc41

mpack is a small binary serialization/RPC library that implements both the msgpack and msgpack-rpc specifications...

Titan FTP Administrative Password Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/document' class MetasploitModule 'Titan FTP Administrative Password Disclosure', 'Description' = %q On Titan FTP servers prior to version 9.14.1628, an...

Samba lsa_io_privilege_set Heap Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samba lsaioprivilegeset Heap Overflow', 'Description' = %q This module triggers a heap overflow in the LSA RPC service of the Samba daemon. ,...

RPC Denial of Service targeting *nix rpcbind/libtirpc

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'RPC DoS targeting nix rpcbind/libtirpc', 'Description' = %q This module exploits a vulnerability in certain versions of rpcbind, LIBTIRPC, and...

Microsoft Windows Deployment Services Unattend Retrieval

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Windows Deployment Services Unattend Retrieval', 'Description' = %q This module retrieves the client unattend file from Windows...

Apache Rave User Information Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Rave User Information Disclosure', 'Description' = %q This module exploits an information disclosure in Apache Rave 0.20 and prior. The...

Veritas Backup Exec Server Registry Access

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Veritas Backup Exec Server Registry Access', 'Description' = %q This modules exploits a remote registry access flaw in the BackupExec Windows...

WS-2024-0016

Monero monerod is vulnerable to denial of service via memory exhaustion in its RPC service. A client that spams requests to an exposed RPC port without reading the responses causes monerod to retain those responses in memory indefinitely until the process crashes. Any node exposing its RPC port i...

Monero: Spamming highly nested JSON RPC requests cause node to disconnect from p2p network

The vulnerability allowed an attacker to remotely lock monerod from syncing with the rest of the p2p network by forging a highly nested JSON payload and spamming it through a restricted RPC interface. The Epee JSON parser was found to allow duplicated fields and set a recursion limit that was too...

GO-2023-1850 HashiCorp Consul can use cleartext agent-to-agent RPC communication in github.com/hashicorp/consul

HashiCorp Consul can use cleartext agent-to-agent RPC communication in github.com/hashicorp/consul...

EulerOS Virtualization 2.11.0 : libvirt (EulerOS-SA-2024-2202)

According to the versions of the libvirt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An off-by-one error flaw was found in the udevListInterfacesByStatus function in libvirt when the number of interfaces exceeds the...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2024:2948-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2948-1 advisory. The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes. The following security bugs were fixed: -...

CLSA-2024-1723809480 Fix of 39 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-36939 - NFS: Cleanup - add nfsclientsexit to mirror nfsclientsinit - nfs: expose /proc/net/sunrpc/nfs in net namespaces - sunrpc: add a struct rpcstats arg to rpccreateargs - nfs: make the rpcstat per net namespace - nfs: Handle error of rpcprocregist...

CBL Mariner 2.0 Security Update: kernel (CVE-1999-0656)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-1999-0656 advisory. - The ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying...

kernel: SUNRPC: Fix UAF in svc_tcp_listen_data_ready()

A vulnerability was found in the Linux kernel's SUNRPC implementation in the svctcplistendataready function, where the use-after-free vulnerability occurs when a listener socket is freed while a child socket retains a reference to it, leading to potential access of invalid memory...

kernel: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change

A memory leak flaw was found in the Linux kernel’s SunRpc filesystem sysfs. This flaw allows a local user to crash the system...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the rpctensor structure. An attacker can read arbitrary memory addresses by manipulating the data pointer. PoC from pwn import ALLOCBUFFER = 0 GETALIGNMENT = 1 GETMAXSIZE = 2 BUFFERGETBASE = 3 FREEBUFFER = 4...