306 matches found
gardyn
概要 2025年2月、私はGardyn Home 4.0デバイスに対してセキュリティ調査を実施しました。調査中に、私は複数の脆弱性と不十分なセキュリティ慣行を発見しました。これらの脆弱性を悪用することにより、攻撃者はGardynデバイスへのシステムレベルアクセスを獲得し、それを足がかりとして、接続先のローカルエリアネットワークに対するさらなる攻撃を仕掛ける可能性があります。また、攻撃者はこのアクセスを利用してデバイスの通常動作に影響を及ぼすこともでき、デバイス内で栽培されている植物やデバイス自体に損害を与える可能性があります。...
gardyn-hack
概要 2025年2月、私はGardyn Home 4.0デバイスに対してセキュリティ調査を実施しました。調査中に、複数の脆弱性と不十分なセキュリティ慣行を発見しました。これらの脆弱性を悪用することで、攻撃者はGardynデバイスへのシステムレベルアクセスを取得し、それを足場に、接続されているローカルエリアネットワークに対するさらなる攻撃を仕掛ける可能性があります。また、攻撃者はこのアクセスを利用してデバイスの通常動作に影響を与える可能性があり、デバイス内で栽培されている植物やデバイス自体に損害を与えることも含まれます。...
Silent plaintext persistence via unresolved callable database name in encryption schema map
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ipmr: Do not call mrmfcusesdev for unres entries syzbot discovered that calling mrmfcusesdev for unres entries could cause a crash 1. This is because c-mfcun.res.minvif/c-mfcun.res.maxvif aliases “struct skbuffhead unresolved”,...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Of: overlay: Early call to callchangesetinit When ofoverlayfdtapply fails, the changeset may be partially applied. It is still expected that the caller will call ofoverlayremove to clean up this partial state. However,...
CVE-2026-82778
creationtimestamp| type| source ---|---|--- 2026-09-10 08:46:05+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518...
CVE-2026-84732
Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow...
CVE-2026-80825
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated...
CGA-5Q3M-WJR7-9XMF
Bulletin has no description...
CVE-2026-84119
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...
EUVD-2026-68744
netipv6sendns in subsys/net/ip/ipv6nbr.c allocates a transmit netpkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pendingqueue is already non-empty an NS is already outstanding, the function appends the data packet and...
CVE-2026-80560
In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restoresigcontext copies the whole supervision register SR from the signal frame and only clears SPRSRSM before the value is reloaded into the hardware SR through E...
CVE-2026-10582
Hugo versions 0.91.0 through 0.165.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the security.http.urls allowlist. The allowlist validates only the URL text itself—checking configured patterns and canonicalised IPv4 forms—but never resolves the hostname nor inspects the ...
CVE-2026-10582
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...
CVE-2026-72016
In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Fix NULL kobject warning in cpuhpsmtenable On arm64, when booting with maxcpus greater than the number of present CPUs e.g., QEMU -smp cpus=4,maxcpus=8, some CPUs are marked as 'present' but have not yet been...
CVE-2026-18193
creationtimestamp| type| source ---|---|--- 2026-08-13 22:35:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hki666jzgvts7 2026-08-20 06:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtile75tiu2u...
CVE-2026-8384
A flaw was found in Eclipse Jetty. An attacker could craft a specially formed HTTP Uniform Resource Identifier URI that, when processed by Jetty, results in an unresolved path. While Jetty itself is not directly affected, web applications relying on Jetty to provide resolved paths may be confused...
CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation
cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...