SUSE CVE-2023-6535

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service...

Unbreakable Enterprise kernel security update

5.15.0-201.135.6 - Revert ncsi: Propagate carrier gain/loss events to the NCSI controller Johnathan Mantey - netfilter: nftables: split async and sync catchall in two functions Pablo Neira Ayuso - netfilter: nftables: remove catchall element in GC sync path Pablo Neira Ayuso - scsi: mpt3sas: Fix...

Siemens User Management Component (UMC) Classic Buffer Overflow Vulnerability

Opcenter Quality is a quality management system QMS that enables organizations to safeguard compliance, optimize quality, reduce the cost of defects and rework, and achieve operational excellence by improving process stability. simatic pcs neo is a distributed control system DCS. the SINUMERIK...

Siemens SINUMERIK ONE and SINUMERIK-MC Denial of Service Vulnerability

SINUMERIK MC is a CNC system for customized machine solutions. SINUMERIK ONE is a digital native CNC. A denial of service vulnerability exists in Siemens SINUMERIK ONE and SINUMERIK-MC due to a failure of an affected device to methodically and correctly process specially crafted packets sent to...

FreeBSD Security Vulnerabilities

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A security vulnerability exists in FreeBSD that stems from a denial of service DOS vulnerability in which the pf4 packet filter does not properly validate TCP sequence numbers. Affected products and versions: FreeBSD...

Ubuntu 20.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-6548-3)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6548-3 advisory. It was discovered that Spectre-BHB mitigations were missing for Ampere processors. A local attacker could potentially use this to expose sensitive...

Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-6534-3)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6534-3 advisory. It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading ...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (Low Latency) vulnerabilities (USN-6549-3)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6549-3 advisory. It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain...

Design/Logic Flaw

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by modcluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because modproxycluster...

CVE-2023-5379

CVE-2023-5379 affects Undertow/AJP handling in Red Hat JBoss EAP, where an AJP request exceeding the max-header-size can cause mod_cluster to mark the backend as an error and close the TCP connection without an AJP response, enabling potential DoS via repeated oversized requests. The connected ad...

CVE-2023-5379 Undertow: ajp request closes connection exceeding maxrequestsize

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by modcluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because modproxycluster...

CVE-2023-5379

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by modcluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because modproxycluster...

USN-6549-2: Linux kernel (GKE) vulnerabilities

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service system crash. CVE-2023-37453 Lin Ma...

USN-6534-2: Linux kernel vulnerabilities

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service system crash. CVE-2023-37453 Lin Ma...

CVE-2023-46156

Affected devices improperly handle specially crafted packets sent to port 102/tcp. This could allow an attacker to create a denial of service condition. A restart is needed to restore normal operations...

CVE-2023-46285

A vulnerability has been identified in Opcenter Execution Foundation All versions V2407, Opcenter Quality All versions V2312, SIMATIC PCS neo All versions V4.1, SINEC NMS All versions V2.0 SP1, Totally Integrated Automation Portal TIA Portal V14 All versions, Totally Integrated Automation Portal...

CVE-2023-46283

A vulnerability has been identified in Opcenter Execution Foundation All versions V2407, Opcenter Quality All versions V2312, SIMATIC PCS neo All versions V4.1, SINEC NMS All versions V2.0 SP1, Totally Integrated Automation Portal TIA Portal V14 All versions, Totally Integrated Automation Portal...

CVE-2023-46156

CVE-2023-46156 affects Siemens SINUMERIK MC/ONE and a broad range of SIMATIC S7-1500 CPU family devices, where port 102/tcp handling of specially crafted packets can trigger a denial-of-service. The vulnerability is described as a Use-After-Free (CWE-416) condition with a CVSS v3 base score of 7....

PT-2023-9082 · Extreme Networks · Extreme Networks Ap410C +1

Name of the Vulnerable Software and Affected Versions: Extreme Networks IQ Engine versions prior to 10.6r1a Extreme Networks IQ Engine versions 10.6r1a through 10.6r4 before 10.6r5 Extreme Networks AP410C affected versions not specified Description: The issue arises from the ah webui service, whi...

Extreme Networks AP410C ah_webui Missing Authentication for Critical Function Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to reach critical functions on affected installations of Extreme Networks AP410C routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ahwebui service, which listens on TCP port 3009 by...