CLSA-2023-1688678110 Fix CVE(s): CVE-2021-33582

SECURITY UPDATE: String hashing algorithm collisions - debian/patches/0021-CVE-2021-33582-pre.patch: gracefully handle lookup on zero-sized tables - debian/patches/0022-CVE-2021-33582.patch: replace ad-hoc algorithm with seeded djb2 and use it when hashing - CVE-2021-33582 Enable the internal cun...

Apache Tomcat - Fix for CVE-2023-24998 was incomplete

The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded...

CVE-2023-37239

Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program...

CVE-2023-37239

Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program...

Format string

Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program...

CVE-2023-37239

Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program...

CVE-2023-37239

The CVE-2023-37239 entry describes a format-string vulnerability in the distributed file system of Huawei/HarmonyOS. Multiple connected sources (Red Hat, NVD, PRION, CVE lists, CNNVD, and others) corroborate a vulnerability where exploitation (by bypassing SELinux) can crash the target program, i...

CVE-2023-37239

Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program...

CVE-2023-37239: Exposure of Sensitive Information to an Unauthorized Actor

Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program...

Milesight UR32L buffer error vulnerability

The Milesight UR32L is a 4G industrial router from China-based Milesight. A security vulnerability exists in the Milesight UR32L version v32.3.0.5, which stems from the use of an insecure sprintf pattern. An attacker could exploit the vulnerability to cause a buffer overflow via a specially craft...

PT-2023-5146 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is caused by a buffer overflow vulnerability in the firewall handler set function of the Milesight UR32L router's firmware. This vulnerability can be exploited by a remote attacker to...

PT-2023-25847 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: distributed file system affected versions not specified Description: The issue is a format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program...

CVE-2023-27390

creationtimestamp| type| source ---|---|--- 2023-07-05 20:22:03+00:00| seen| https://t.me/cibsecurity/65994...

Huawei HarmonyOS security vulnerabilities

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a security vulnerability that originates from a formatted string vulnerability in the distributed file system. An attacker coul...

Progress Software MOVEit Transfer UserProcessPassChangeRequest SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software MOVEit Transfer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the human.aspx endpoint. A crafted request can trigger execution of SQ...

Fclicense demon Code Execution

The vulnerability of the Fclicense demon in the FortiOS operating system is related to the use of uncontrolled format strings. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created requests...

Samsung Mobile Devices Improper Input Validation Vulnerability

Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic...

K000135262: Apache Tomcat vulnerability CVE-2023-28709

Security Advisory Description The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameter...

CVE-2023-27866

IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511...

CVE-2023-27866

CVE-2023-27866 affects IBM Informix JDBC Driver versions 4.10 and 4.50, with a remote code execution risk via JNDI injection when the LDAP URL in the Connect String is not verified. Affected software: Informix JDBC 4.10.x and 4.50.x. Root cause: unverified LDAP URL enabling JNDI injection. Impact...