Etcd Gateway TLS endpoint validation only confirms TCP reachability

Vulnerability type Cryptography Workarounds Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail Secure endpoint validation is performed by the etcd gateway start command when the --discovery-srv fla...

Etcd Gateway TLS endpoint validation only confirms TCP reachability

Vulnerability type Cryptography Workarounds Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail Secure endpoint validation is performed by the etcd gateway start command when the --discovery-srv fla...

Password of talk conversations can be bruteforced

None...

Cross-Site Request Forgery (CSRF)

github.com/casdoor/casdoor is vulnerable to Cross-Site Request Forgery. The vulnerability exists due to the lack of endpoint validation in /api/set-password, which allows an attacker to change a user's password using a crafted url...

GSD-2023-1002294 usb: xhci: Check endpoint is valid before dereferencing it

usb: xhci: Check endpoint is valid before dereferencing it This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.304 by commit...

GSD-2023-1002269 usb: xhci: Check endpoint is valid before dereferencing it

usb: xhci: Check endpoint is valid before dereferencing it This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.271 by commit...

GSD-2023-1002109 usb: xhci: Check endpoint is valid before dereferencing it

usb: xhci: Check endpoint is valid before dereferencing it This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.90 by commit...

GSD-2023-1001975 usb: xhci: Check endpoint is valid before dereferencing it

usb: xhci: Check endpoint is valid before dereferencing it This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...

PT-2023-35370 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.304 Description: The issue concerns the xhci component of the Linux Kernel, where an endpoint is not properly validated before being dereferenced. This could potentially lead to security vulnerabilities,...

PT-2023-34856 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.165 Description: The issue concerns the xhci component of the Linux Kernel, where an endpoint is not properly validated before being dereferenced. This could potentially lead to security vulnerabilities,...

PT-2023-9427 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the xhci component in the Linux kernel, where a NULL pointer dereference can occur when the host controller is not responding, causing a kernel panic. This...

Input validation

A vulnerability in the web management interface of the Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient validation of user-supplied parameters for...

kernel: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts

A vulnerability was found in the thrustmasterinterrupts function in the Linux kernel's HID Thrustmaster driver. This issue arises from a lack of validation for the actual number of endpoints, leading to a slab-out-of-bounds read when the code accesses the endpoint array...

CVE-2022-22235

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based, attacker to cause Denial of Service DoS. A PFE crash will happen when a GPRS Tunnel Protocol GTP packet is...

PT-2022-28253 · Etcd · Etcd

Name of the Vulnerable Software and Affected Versions: etcd affected versions not specified Description: The issue is related to authentication in the etcd gateway. It only authenticates endpoints detected from DNS SRV records and does so only once. If an endpoint changes its authentication...

Lark Technologies: Normal User is able to EXPORT Feature Usage Statistics

A vulnerability was found where certain Lark endpoints did not properly validate user permissions, allowing a low-privileged user to generate and download usage statistics information. We thank @aishkendle for reporting this to our team...

U.S. General Services Administration: Account takeover through multistage CSRF at https://autochoice.fas.gsa.gov/AutoChoice/changeQAOktaAnswer and ../AutoChoice/changePwOktaAnswer

Hi, Account takeover is possible through CSRF vulnerability at 'Change Security Question/Answer' & ' Change Password'. The endpoints - https://autochoice.fas.gsa.gov/AutoChoice/changeQAOktaAnswer & https://autochoice.fas.gsa.gov/AutoChoice/changePwOktaAnswer both are vulnerable to CSRF attack...

Command Injection

tomato is susceptible to command injection. The vulnerability exists because it fails to validate an endpoint /api/exec to prevent an attacker from malicious code injection through it...

Missing Authentication

github.com/etcd-io/etcd does not perform TLS authentication. When starting a gateway for endpoints provided in the --endpoints flag, it does not handle the endpoints validation...

New Relic: Ability to run monitors' jobs of other accounts and to read these jobs content (including the secure credentials values)

@skavans identified an endpoint for testing Synthetics monitors. Without proper validation, this could allow monitors from other accounts to run on your account with knowledge of the monitor's ID: POST /accounts//monitors/monitor/recheck.json?monitorId= HTTP/1.1 Host: synthetics.newrelic.com...