USN-7922-5 linux-iot vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Cryptographic API; - ACPI drivers; - InfiniBand drivers; - Media drivers; - Network drivers; - Pin controllers...

CVE-2023-43961

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

CVE-2021-27367

Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2022-33939

CENTUM VP / CS 3000 controller FCS CP31, CP33, CP345, CP401, and CP451 contains an issue in processing communication packets, which may lead to resource consumption. If this vulnerability is exploited, an attacker may cause a denial of service DoS condition in ADL communication by sending a...

CVE-2020-7563

A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules see notification for details which could cause corruption of data, a crash, or code execution when uploading a specially crafted...

CVE-2020-7487

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M241, M251, and M258 controllers...

CVE-2020-7537

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium see security notifications for affected versions, that could cause denial of service when a specially crafted Read Physical Memo...

CVE-2020-12294

Insufficient control flow management in some IntelR ThunderboltTM controllers may allow an authenticated user to potentially enable denial of service via local access...

CVE-2020-12289

Out-of-bounds write in some IntelR ThunderboltTM controllers may allow an authenticated user to potentially enable denial of service via local access...

CVE-2020-12292

Improper conditions check in some IntelR ThunderboltTM controllers may allow an authenticated user to potentially enable denial of service via local access...

CVE-2020-24496

Insufficient input validation in the firmware for IntelR 722 Ethernet Controllers before version 1.4.3 may allow a privileged user to potentially enable denial of service via local access...

CVE-2020-24497

Insufficient Access Control in the firmware for IntelR E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable denial of service via local access...

CVE-2020-24493

Insufficient access control in the firmware for the IntelR 700-series of Ethernet Controllers before version 8.0 may allow a privileged user to potentially enable denial of service via local access...

CVE-2021-41017

Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests...

The vulnerability of Ruckus Virtual SmartZone’s microprogrammed software controllers, related to bypassing the relative path, allows a intruder to load arbitrary files and gain unauthorized access to confidential information.

The vulnerability of Ruckus Virtual SmartZone wireless network controller’s microprogramming software relates to the exploitation of a relative path. Exploiting this vulnerability allows an attacker to upload arbitrary files and gain unauthorized access to confidential information...

The vulnerability of Siemens Sinumerik programmable logic controllers’ software lies in the ability to bypass the authentication process by using an alternative path or channel. This allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of Siemens Sinumerik programmable logic controllers lies in the ability to bypass the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected informati...

The vulnerability in the software development environment of Totally Integrated Automation Portal (Portal TIA) and the software for simulating and testing the operation of Siemens S7 controllers arises from incorrect restrictions on XML references to external objects. This allows attackers to access arbitrary files.

The vulnerability of the software development environment of Totally Integrated Automation Portal Portal TIA and the software for simulating and testing the operation of Siemens S7 controllers is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerabilit...

CVE-2017-20212: Improper Limitation of a Pathname to a Restricted Directory

FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitrary files through unverified input parameters. Attackers can exploit the /var/www/data/controllers/api/xml.php readFile function to access...

USN-7922-4: Linux kernel (Raspberry Pi) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Cryptographic API; - ACPI drivers; - InfiniBand drivers; - Media drivers; - Network drivers; - Pin controllers...