SUSE CVE-2022-29204

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. T...

PT-2023-35125 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.92 Description: A NULL pointer issue was found in the skb segment list function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

VMware ESXi OpenSLP heap overflow

Added: 02/10/2023 Background VMware ESXi is a bare metal hypervisor. Problem A heap overflow vulnerability in the OpenSLP service could allow an attacker on the same network segment to execute arbitrary commands. Resolution Upgrade to a fixed version referenced in VMSA-2021-0002 or disable the SL...

PT-2023-13260 · Unknown · User Identity Module

Name of the Vulnerable Software and Affected Versions: User Identity Module affected versions not specified Description: The issue is related to memory corruption in the User Identity Module due to an integer overflow that leads to a buffer overflow. This occurs when a segment is received via qmi...

PT-2023-13032 · Cypress · Cypress Bluetooth Mesh Sdk

Name of the Vulnerable Software and Affected Versions: Cypress Bluetooth Mesh SDK version BSA0107 05.01.00-BX8-AMESH-08 Description: The issue is related to a buffer overflow that can allow the execution of arbitrary code remotely. It is caused by an out-of-bound write vulnerability during mesh...

Prilex modification now targeting contactless credit card transactions

Prilex is a singular threat actor that has evolved from ATM-focused malware into unique modular PoS malware—actually, the most advanced PoS threat we have seen so far, as described in a previous article. Forget about those old memory scrapers seen in PoS attacks. Prilex goes beyond these, and it...

The vulnerability of the nilfs_attach_log_writer function (fs/nilfs2/segment.c) in the Linux kernel’s BPF component allows a attacker to cause a service failure.

The vulnerability of the nilfsattachlogwriter function located in segment.c of fs/nilfs2 in the Linux kernel’s BPF component is related to a memory leak. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2023-21860: Improper Access Control

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: Internal Operations. Supported versions that are affected are 7.4.38 and prior, 7.5.28 and prior, 7.6.24 and prior and 8.0.31 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to...

CVE-2023-22406

A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service DoS. In a segment-routing scenario with OSPF as IGP, when a peer interface continuously flap...

Ubuntu 22.10 : Linux kernel vulnerabilities (USN-5793-1)

The remote Ubuntu 22.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5793-1 advisory. It was discovered that the iouring subsystem in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free...

CVE-2022-47662

GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault /stack overflow due to infinite recursion in MediaGetSample isomedia/media.c:662...

CVE-2022-47662

GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault /stack overflow due to infinite recursion in MediaGetSample isomedia/media.c:662...

CVE-2022-47662

Removed by vendor...

CVE-2022-47662

GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 is affected by a vulnerability causing a segment fault (stack overflow) from an infinite recursion in Media_GetSample (isomedia/media.c:662). The issue enables local exploitation leading to a crash; no in‑document exploit details are provided. Mitigations in ...

CVE-2022-47662: Uncontrolled Recursion

GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault /stack overflow due to infinite recursion in MediaGetSample isomedia/media.c:662...

CVE-2022-47662

GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault /stack overflow due to infinite recursion in MediaGetSample isomedia/media.c:662...

CVE-2022-47208

The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication...

Command injection

The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication...

CVE-2022-47208: Improper Neutralization of Special Elements used in an OS Command

The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication...

CVE-2022-47208

The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication...