CVE-2024-32006: Insufficient Session Expiration

A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.2 SP2. The affected application does not expire the user session on reboot without logout. This could allow an attacker to bypass Multi-Factor Authentication...

Siemens SINEMA Remote Connect security vulnerability

Siemens SINEMA Remote Connect is a remote management platform from Siemens, Germany. The platform supports efficient and secure remote access to globally distributed machines and ensures secure management of VPN channels between control centers, service engineers and installed equipment. An...

Siemens SINEMA Remote Connect Server Authorization Issue Vulnerability

Siemens SINEMA Remote Connect Server is a remote network management platform from Siemens, Germany. The platform is used to remotely access, maintain, control and diagnose the underlying network. A session fixation vulnerability exists in Siemens SINEMA Remote Connect Server due to a failure of t...

Siemens Industrial Products

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2024-9670 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager versions prior to 1.3.1-9346-10 Description: The issue is related to the WiFi Connect MAC Filter component of the Synology Router Manager, which fails to properly neutralize input during web page generation, leading to...

MAL-2024-10225 Malicious code in mobileye-8-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e7b3a006f16102113625364a266a513016fe138d66a4008fc548e6df97c1a9a8 The OpenSSF Package Analysis project identified 'mobileye-8-connect' @ 7.7.8 npm as malicious. It is considered malicious because: - The package...

Malicious code in mobileye-8-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e7b3a006f16102113625364a266a513016fe138d66a4008fc548e6df97c1a9a8 The OpenSSF Package Analysis project identified 'mobileye-8-connect' @ 7.7.8 npm as malicious. It is considered malicious because: - The package...

OESA-2024-2120 mozjs78 security update

SpiderMonkey is the code-name for Mozilla Firefox's C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fixes: A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 5.0.20 LTS, 12.0.3 LTS and 12.3.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported...

Unspecified Vulnerability in IBM Sterling Connect:Direct Web Services (CNVD-2024-43190)

IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. A security vulnerability exists in IBM Sterling Connect:Direct Web Services that stems from the use of default credentials. No details of the vulnerability are...

CVE-2024-39747

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses default credentials for potentially critical functionality...

PT-2024-28661 · Ibm · Ibm Sterling Connect:Direct Web Services

Name of the Vulnerable Software and Affected Versions: IBM Sterling Connect:Direct Web Services versions 6.0 through 6.3 Description: The issue concerns the use of default credentials for potentially critical functionality in IBM Sterling Connect:Direct Web Services. This could pose a significant...

IBM Sterling Connect:Direct Web Services security vulnerability

IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. A security vulnerability exists in IBM Sterling Connect:Direct Web Services that stems from the use of default credentials. No details of the vulnerability are...

CVE-2024-35133

IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL...

CVE-2021-4442

In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity tests to TCPQUEUESEQ Qingyu Li reported a syzkaller bug where the repro changes RCV SEQ after restoring data in the receive queue. mprotect0x4aa000, 12288, PROTREAD = 0 mmap0x1ffff000, 4096, PROTNONE,...

CVE-2021-4442

In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity tests to TCPQUEUESEQ Qingyu Li reported a syzkaller bug where the repro changes RCV SEQ after restoring data in the receive queue. mprotect0x4aa000, 12288, PROTREAD = 0 mmap0x1ffff000, 4096, PROTNONE,...

CVE-2021-4442

CVE-2021-4442 – The Linux kernel TCP stack vulnerability described as: a syzkaller repro could cause RCV_SEQ to be advanced after data restoration in the receive queue, enabling an out-of-order or invalid sequence handling when TCP_QUEUE_SEQ is used on non-empty queues. The connected documents (A...

CVE-2021-4442 tcp: add sanity tests to TCP_QUEUE_SEQ

In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity tests to TCPQUEUESEQ Qingyu Li reported a syzkaller bug where the repro changes RCV SEQ after restoring data in the receive queue. mprotect0x4aa000, 12288, PROTREAD = 0 mmap0x1ffff000, 4096, PROTNONE,...

Apache 2.x HTTP Server Mod_auth_openidc DoS

The vulnerability of the authentication and authorization module for the Apache 2.x HTTP server, Modauthopenidc, is related to the installation of OIDCStripCookies and the provision of a created cookie file. After that, the NULL pointer is reassigned, resulting in a segmentation error. Exploiting...

Unspecified Vulnerability in IBM App Connect Enterprise Certified Container

IBM App Connect Enterprise is an operating system from International Business Machines IBM, Inc. that combines existing industry-trusted IBM Integration Bus technology with IBM App Connect Professional and new cloud-native IBM App Connect Enterprise combines existing industry-trusted IBM...