CVE-2022-36311: Improper Neutralization of Input During Web Page Generation

Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models...

CVE-2022-36310: Use of Inherently Dangerous Function

Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpeed models...

CVE-2022-36308: Plaintext Storage of a Password

Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate the eNodeB over SNMP. This issue may...

PT-2022-23307

Name of the Vulnerable Software and Affected Versions Airspan AirVelocity 1500 versions prior to 15.18.00.2511 Description The issue is related to injection leading to XSS in the SNMP community field in the eNodeB's web management UI. This may also affect other AirVelocity and AirSpeed models...

DSA-5209-1 net-snmp - security update

Bulletin has no description...

PT-2022-37179 · Net Snmp · Net-Snmp

Name of the Vulnerable Software and Affected Versions: netsnmp affected versions not specified Description: The issue is related to a heap-buffer-overflow read. Technical details include the netsnmp memdup function and the file snmp api fuzzer.c. Recommendations: At the moment, there is no...

net-snmp:snmp_api_fuzzer: Heap-buffer-overflow in netsnmp_memdup

Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed Report: https://oss-fuzz.com/testcase?key=4929330605588480 Project: net-snmp Fuzzing Engine: honggfuzz Fuzz Target: snmpapifuzzer Job Type: honggfuzzasannet-snmp Platform Id: linux Crash Type:...

PT-2022-37177

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-double-free crash. The crash involves the snmp free pdu function and is triggered by the snmp api fuzzer.c file. There is no...

net-snmp:snmp_api_fuzzer: Heap-double-free in ada_fuzz_header.h

Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed Report: https://oss-fuzz.com/testcase?key=5357436638199808 Project: net-snmp Fuzzing Engine: honggfuzz Fuzz Target: snmpapifuzzer Job Type: honggfuzzasannet-snmp Platform Id: linux Crash Type:...

[SECURITY] Fedora 36 Update: net-snmp-5.9.3-1.fc36

SNMP Simple Network Management Protocol is a protocol used for network management. The NET-SNMP project includes various SNMP tools: an extensible agent, an SNMP library, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the...

Fedora: Security Advisory for net-snmp (FEDORA-2022-3af7a32fc0)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Vulnerabilities fixed in Net-SNMP

Vulnerabilities have been fixed in Net-SNMP. The vulnerabilities allow an authenticated malicious party to cause a denial-of-service or potentially execute arbitrary code execute arbitrary code with the privileges under which Net-SNMP is running. This requires malicious network traffic must be se...

Ubuntu: Security Advisory (USN-5543-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5543-1 net-snmp vulnerabilities

Yu Zhang and Nanyu Zhong discovered that Net-SNMP incorrectly handled memory operations when processing certain requests. A remote attacker could use this issue to cause Net-SNMP to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-5543-1: Net-SNMP vulnerabilities

Yu Zhang and Nanyu Zhong discovered that Net-SNMP incorrectly handled memory operations when processing certain requests. A remote attacker could use this issue to cause Net-SNMP to crash, resulting in a denial of service, or possibly execute arbitrary code...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Net-SNMP vulnerabilities (USN-5543-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5543-1 advisory. Yu Zhang and Nanyu Zhong discovered that Net-SNMP incorrectly handled memory operations when processing certain requests. A remot...

Net-SNMP DoS

The vulnerability of the Net-SNMP software suite exists due to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Improper Input Validation

net-snmp is vulnerable to improper input validation. The vulnerability exists when SETing malformed OIDs in master agent and subagent simultaneously because the inputs are not properly validated which allows an attacker to bypass validations...

Out-Of-Bounds Write

net-snmp is vulnerable to out of bounds write. The vulnerability exists due to a boundary error in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable. A remote user is able to pass a malformed OID in a SET request, trigger an out-of-bounds write and execute arbitrary code on the target...

NULL Pointer Dereference

net-snmp is vulnerable to null pointer dereference. The vulnerability exists when a malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable which allows an attacker to cause a null pointer dereference...