4046 matches found
CVE-2023-39827
Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the ruleinfo parameter in the formAddMacfilterRule function...
Tenda A18 Buffer Error Vulnerability
Tenda A18 is an AC1200 dual-band Wi-Fi repeater from Tenda, China. A security vulnerability exists in Tenda A18 version V15.13.07.09, which originates from a stack overflow vulnerability in the parameter ruleinfo of the function formAddMacfilterRule...
PT-2023-27124
Name of the Vulnerable Software and Affected Versions Tenda A18 version 15.13.07.09 Description A stack overflow issue was discovered in the formAddMacfilterRule function via the rule info parameter. Recommendations For Tenda A18 version 15.13.07.09, consider disabling the formAddMacfilterRule...
Linux Netfilter Heap Buffer Overflow DoS
The vulnerability of the nftimmediatedeactivate function in the net/netfilter/nftimmediate.c file of the netfilter network interface layer in the Linux operating system is related to improper handling during rule creation. Exploiting this vulnerability could allow an attacker to cause service...
CVE-2023-22843
CVE-2023-22843 is a stored XSS vulnerability in Nozomi Guardian/CMC where an authenticated administrator can inject JavaScript into Threat Intelligence rule definitions (yara content; limited HTML for packet/STYX), which then executes in other users’ sessions. Impact includes unauthorized actions...
Nozomi Networks Guardian Cross-Site Scripting Vulnerability
Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, USA. Nozomi Networks Guardian suffers from a cross-site scripting vulnerability that originates from an authenticated attacker with administrator access who can inject malicious JavaScript code into the...
DEBIAN-CVE-2023-4147
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTARULECHAINID. This flaw allows a local user to crash or escalate their privileges on the system...
UBUNTU-CVE-2023-4147
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTARULECHAINID. This flaw allows a local user to crash or escalate their privileges on the system...
clamav:clamav_dbload_YARA_fuzzer: Heap-use-after-free in yr_parser_lookup_loop_variable
Detailed Report: https://oss-fuzz.com/testcase?key=5162821265260544 Project: clamav Fuzzing Engine: afl Fuzz Target: clamavdbloadYARAfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x6020000003b0 Crash State: yrparserlookuploopvariable...
CVE-2023-38707
Rejected reason: This CVE has been rejected because of CNA rule 7.4.7: 7.4.7 CNAs SHOULD NOT assign CVE IDs to vulnerabilities in products that are not publicly available or licensable. The repository with the vulnerable code is private, and therefore the product is not publicly available...
protocol-http1 environmental issue vulnerability
protocol-http1 is a low-level implementation of HTTP/1. An environmental issue vulnerability exists in protocol-http1 versions prior to 0.15.1, which stems from an RFC rule violation by Falcon, leading to HTTP request smuggling and firewall bypass issues...
CVE-2023-20215
A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked. This vulnerability is due to improper detection of malicious...
CVE-2023-20215
CVE-2023-20215 affects Cisco AsyncOS for Cisco Secure Web Appliance. The vulnerability lies in the scanning engines’ handling of certain content-encodings (deflate, and by default lzma/brotli in some cases), enabling an unauthenticated, remote attacker to bypass an explicit block rule and cause t...
CVE-2023-20215: Exposure of Sensitive Information Through Data Queries
A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked. This vulnerability is due to improper detection of malicious...
UBUNTU-CVE-2023-3777
A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. When nftablesdelrule is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain...
Cisco Secure Web Appliance Content Encoding Filter Bypass Vulnerability
A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked. This vulnerability is due to improper detection of malicious...
CVE-2023-26430
Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We...
Authorization Rule Misconfiguration
spring-security-config is vulnerable to Authorization Rule Misconfiguration. The vulnerability exists due to the lack of validation in the RequestMatcher of AbstractRequestMatcherRegistry.java when the application uses the requestMatchersString function with multiple servlets, one of them being...
Authorization
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...
CVE-2023-34035
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...