SUSE CVE-2023-6917

A vulnerability has been identified in the Performance Co-Pilot PCP package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges...

CVE-2024-38532

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

CVE-2024-38532 TEST_KEY used in example dcp_tool reference implementation

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

CVE-2024-38532

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

CVE-2024-38532 TEST_KEY used in example dcp_tool reference implementation

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

CVE-2024-38532 TEST_KEY used in example dcp_tool reference implementation

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

NXP Data Co-Processor Security Vulnerability

The NXP Data Co-Processor NXP DCP is a built-in hardware module for a SoC from NXP. A dedicated AES encryption engine used to implement encryption/decryption operations. A security vulnerability exists in NXP Data Co-Processor that originates from the selection of a test key by the dcptool...

CVE-2024-38532: Use of Hard-coded Cryptographic Key

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

PT-2024-28058 · Nxp · Nxp Data Co-Processor

Name of the Vulnerable Software and Affected Versions: NXP Data Co-Processor DCP affected versions not specified Description: The issue concerns the NXP Data Co-Processor DCP, a built-in hardware module for specific NXP SoCs that implements a dedicated AES cryptographic engine for...

CVE-2024-3043

An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier pan ID, leading to a denial of service. This packet type is not useful in production and should be used only for PHY qualification...

CVE-2024-3017

In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor RCP causes the OpenThread Border RouterOTBR application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service...

CVE-2024-3017

In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor RCP causes the OpenThread Border RouterOTBR application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service...

CVE-2024-3043

CVE-2024-3043 involves an unauthenticated IEEE 802.15.4 “co-ordinator realignment” packet that forces Zigbee nodes to change their network identifier (PAN ID), causing a denial of service. The issue is triggered by a specific packet type used for PHY qualification, not production. The documented ...

PT-2024-23357

Name of the Vulnerable Software and Affected Versions Zigbee affected versions not specified Description The issue allows an unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet to force Zigbee nodes to change their network identifier pan ID, resulting in a denial of service. This pack...

PT-2024-23221

Name of the Vulnerable Software and Affected Versions Silicon Labs multi-protocol gateway affected versions not specified Description The issue is caused by a corrupt pointer to buffered data on a multi-protocol radio co-processor RCP in a Silicon Labs multi-protocol gateway. This corruption caus...

CVE-2024-3043: Inclusion of Functionality from Untrusted Control Sphere

An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier pan ID, leading to a denial of service. This packet type is not useful in production and should be used only for PHY qualification...

CVE-2024-37679

Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp parameter...

CVE-2024-37677: Improper Access Control

An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitive information...

CVE-2024-37678

A Cross Site Scripting (XSS) vulnerability exists in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft version v.8.0 and before . This pharmaceutical management software is susceptible to a flaw that allows a remote attacker to execute arbitrary code by providing a crafted script . No sp...

CVE-2024-37681: Allocation of Resources Without Limits or Throttling

An issue the background management system of Shanxi Internet Chuangxiang Technology Co., Ltd v1.0.1 allows a remote attacker to cause a denial of service via the index.html component...