Various Mitsubishi Electric products Security breach

Mitsubishi Electric FR Configurator2 and others are products of Mitsubishi Electric, Japan.Mitsubishi Electric FR Configurator2 is an inverter drive configuration application.Mitsubishi Electric GT Designer3 is an inverter interface programming software. Mitsubishi Electric GT Designer3 is a HMI...

RHCOS 4 : OpenShift Container Platform 4.12.9 (RHSA-2023:1408)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1408 advisory. - capnproto: out of bounds read when handling a list of lists. CVE-2022-46149 Note that Nessus has not tested for this issue but has instead...

opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics

A memory exhaustion flaw was found in the otelgrpc handler of open-telemetry. This flaw may allow a remote unauthenticated attacker to flood the peer address and port and exhaust the server's memory by sending multiple malicious requests, affecting the availability of the system...

VulnCheck KEV: CVE-2023-34048

VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution...

The vulnerability of the Slurm resource manager lies in the insufficient implementation of message integrity during transmission to the communication channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks.

The vulnerability of the Slurm resource manager is related to the insufficient implementation of message integrity during transmission through the communication channel. Exploiting this vulnerability allows a malicious actor to modify RPC traffic in such a way that message checksums are bypassed...

Apache Dubbo code issue vulnerability (CNVD-2024-02173)

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A security vulnerability exists in...

SUSE CVE-2023-49935

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect agains...

Apache Dubbo 代码问题漏洞

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A security vulnerability exists in...

GHSA-6PQX-V9G4-5HC8 Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request

A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request...

CVE-2023-48887

A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request...

Jupiter Security Vulnerabilities

Jupiter is a very good performance, lightweight distributed services framework. A security vulnerability exists in Jupiter v1.3.1, which stems from a deserialization vulnerability that allows an attacker to execute arbitrary commands by sending a crafted RPC request...

NettyRpc Security Vulnerability

NettyRpc is a lightweight distributed RPC framework. A security vulnerability exists in NettyRpc v1.2, which stems from the presence of a deserialization vulnerability that allows an attacker to execute arbitrary commands by sending a crafted RPC request...

PT-2023-30999 · Jupiter · Jupiterx

Name of the Vulnerable Software and Affected Versions: Jupiter version 1.3.1 Description: A deserialization vulnerability allows attackers to execute arbitrary commands via sending a crafted RPC request. Recommendations: For Jupiter version 1.3.1, consider disabling the deserialization...

samba: smbd allows client access to unix domain sockets on the file system as root

A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call RPC services like SAMR LSA or SPOOLSS, which Samba initiates o...

samba: infinite loop in mdssvc RPC service for spotlight

An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function slunpackloop did not validate a field in the network packet that contains the count of elements in an array-like...

The vulnerability of the `clntudp_call` function in the `sunrpc/clnt_udp.c` component of the GNU C Library allows a attacker to compromise data integrity.

The vulnerability of the clntudpcall function in the sunrpc/clntudp.c component of the GNU C Library library relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

samba: infinite loop in mdssvc RPC service for spotlight

An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function slunpackloop did not validate a field in the network packet that contains the count of elements in an array-like...

kernel: SUNRPC: double free xprt_ctxt while still in use

A flaw was addressed in the Linux kernel’s SUNRPC implementation affecting deferred RPC request handling. When an RPC request is deferred, the internal rqxprtctxt pointer is moved from the active service request to a deferred request structure. Under certain rare conditions where a request is...

kernel: rxrpc: Fix timeout of a call that hasn't yet been granted a channel

A NULL pointer dereference flaw was found in the Linux kernel's RxRPC/AFS networking stack. When making an AFS call, the call timer can expire before a connection is assigned if the call gets stalled waiting for a connection. This causes a NULL pointer dereference in rxrpcalloctxbuf when attempti...

USN-6467-2 krb5 vulnerability

USN-6467-1 fixed a vulnerability in Kerberos. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.04. Original advisory details: Robert Morris discovered that Kerberos did not properly handle memory access when processing RPC data through kadmind,...