Vulnerabilities in Cellular Packet Cores Part IV: Authentication

Our research reveals two significant vulnerabilities in Microsoft Azure Private 5G Core AP5GC. The first vulnerability CVE-2024-20685 allows a crafted signaling message to crash the control plane, leading to potential service outages. The second ZDI-CAN-23960 disconnects and replaces attached bas...

Linux kernel Uncontrolled Resource Consumption DoS

The vulnerability of the Linux operating system’s kernel is related to uncontrolled resource consumption. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause service failures...

Firefox Thunderbird Memory Management DoS

The vulnerabilities in web browsers Firefox and Firefox ESR, as well as the Thunderbird email client, are related to the use of memory after it is freed. Exploiting these vulnerabilities can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failure...

Go Parse DoS

The vulnerability of the Parse function in the Go programming language is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures...

dtSearch Kernel Uncontrolled Resource Consumption DoS

The vulnerability of the dtSearch component in the Linux operating system’s kernel is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and cause service failures...

FFmpeg libavutil mem.c Heap Buffer Overflow DoS

The vulnerability of the avmalloc function in the libavutil/mem.c component of the FFmpeg multimedia library is related to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause...

Libstb Heap Memory Leak Confidential Data Access

The vulnerability of the stbiloadgifmain component in the C/C++ Libstb library is related to the repeated release of memory. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Go OpenTelemetry-Go Contrib Resource Restriction DoS

The vulnerability of the set of additional tools and libraries for the Go language, designed for integration with OpenTelemetry, relates to the distribution of resources without any restrictions or regulation when adding the net.peer.sock.addr and net.peer.sock.port tags, which have unrestricted...

Oracle VM VirtualBox Core Unauthorized Access

Vulnerability of the Core component of the Oracle VM VirtualBox software. Exploitation of this vulnerability can allow an attacker to gain unauthorized access to read, modify, or delete data, as well as cause service failures...

Oracle GraalVM Enterprise Edition Concurrency DoS

The vulnerability of the Concurrency component in Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK, and the Oracle Java SE software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

MySQL InnoDB DoS

The vulnerability of the InnoDB component in the Oracle MySQL Server database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions using the MySQL protocol...

VMware vCenter Server DoS

The vulnerability of the software for managing virtual infrastructure such as VMware vCenter Server and VMware Cloud Foundation is related to an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

PyMongo BSON Handler Disclosure DoS

The vulnerability of the BSON Handler component in the PyMongo client library relates to reading data beyond the memory boundaries. Exploiting this vulnerability can allow an attacker to disclose confidential information or cause service failures...

Palo Alto Networks Cortex XDR Agent Privilege Management

The vulnerability of the Palo Alto Networks Cortex XDR Agent, which is used for network traffic analysis, network detection, and response, relates to insecure privilege management. Exploiting this vulnerability could allow attackers to trigger service failures...

Ollama Reverse DNS Rebinding

The vulnerability of Ollama’s system for running and managing large language models is related to the use of reverse DNS resolution for IP addresses. Exploiting this vulnerability could allow a remote attacker to perform a DNS Rebinding attack or cause a service failure...

Microsoft .NET platforms and DoS

The vulnerabilities of Microsoft .NET software platforms and Microsoft Visual Studio development tools stem from synchronization errors when using shared resources. Exploiting these vulnerabilities can allow a malicious actor to cause service interruptions...

LLM User Interface Code Execution

The vulnerability of the user interface of the software for running large language models LLM GPT NVIDIA ChatRTX for Windows exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code, cause service...

Cisco NX-OS LLDP DoS

The vulnerability of the LLDP protocol implementation in Cisco NX-OS and Cisco FXOS operating systems is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Ruby Rack DoS

The vulnerability of the Ruby interpreter’s Rack module interface is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

SMB Microprogramming DoS

The vulnerability of SMB microprogramming services for network interfaces and Zyxel USG and Zyxel VPN devices relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures...