SonicWALL SonicOS Buffer Error Vulnerability

SonicWALL SonicOS is a suite of operating systems from SonicWALL, Inc. designed for SonicWall firewall appliances. A security vulnerability exists in SonicWALL SonicOS that stems from a stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint that causes the firewall to...

SonicWALL SonicOS Buffer Error Vulnerability

SonicWALL SonicOS is a suite of operating systems from SonicWALL, Inc. designed for SonicWall firewall appliances. A security vulnerability exists in SonicWALL SonicOS that stems from a stack-based buffer overflow vulnerability in the getPacketReplayData.json URL endpoint that causes the firewall...

SonicWALL SonicOS Buffer Error Vulnerability

SonicWALL SonicOS is an operating system from SonicWALL, Inc. designed for SonicWall firewall appliances. A security vulnerability exists in SonicWALL SonicOS that stems from a stack-based buffer overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoints that causes the firewall t...

PT-2023-22684 · Dotcms · Dotcms

Name of the Vulnerable Software and Affected Versions: dotCMS versions prior to 23.06 dotCMS versions prior to LTS 22.03.7 dotCMS versions prior to LTS 23.01.4 Description: A flaw in the NormalizationFilter of dotCMS does not strip double slashes // from URLs, potentially enabling bypasses for XS...

PT-2023-26863 · Sonicos · Sonicos

Name of the Vulnerable Software and Affected Versions: SonicOS affected versions not specified Description: The issue is a post-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml and ssoStats-s.wri URL endpoints, which can lead to a firewall crash. Recommendations: At...

Sophos Firewall Information Disclosure Vulnerability

Sophos Firewall is a firewall from Sophos UK. An information disclosure vulnerability exists in Sophos Firewall 19.5.3 and earlier versions, which stems from the presence of a password disclosure vulnerability that allows an attacker with email access to decrypt PDFs...

The vulnerability of the cgi-bin/login.cgi file within the Sangfor NGAF firewall allows a hacker to execute arbitrary code.

The vulnerability of the cgi-bin/login.cgi file, exposed by the Sangfor NGAF firewall mechanism, is related to errors in processing the meta-symbolic cookie file in the PHPSESSID parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially...

The vulnerability of the FortiAnalyzer network firewall’s syslog server allows a hacker to send arbitrary messages to the server.

The vulnerability of the FortiAnalyzer network switch’s syslog server is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to send arbitrary messages to the server remotely...

CVE-2023-44195

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the NetworkStack agent daemon nsagentd of Juniper Networks Junos OS Evolved allows an unauthenticated network based attacker to cause limited impact to the availability of the system. If specific packets reach...

Input validation

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the NetworkStack agent daemon nsagentd of Juniper Networks Junos OS Evolved allows an unauthenticated network based attacker to cause limited impact to the availability of the system. If specific packets reach...

Fortinet FortiOS Access Control Error Vulnerability (CNVD-2023-98189)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An Access Control Error...

The vulnerability of the parsing_xml_stasurvey() function in the software of the D-Link DAP-X1860 Wi-Fi signal booster device allows a intruder to trigger a service failure and execute arbitrary commands.

The vulnerability of the parsingXMLstasurvey function in the D-Link DAP-X1860 Wi-Fi signal booster software is related to the absence of a firewall around the SSID identifier of the access point, due to the insertion or modification of arguments during implementation. Exploiting this vulnerabilit...

CVE-2023-44195 Junos OS Evolved: Packets which are not destined to the router can reach the RE

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the NetworkStack agent daemon nsagentd of Juniper Networks Junos OS Evolved allows an unauthenticated network based attacker to cause limited impact to the availability of the system. If specific packets reach...

WordPress 6.3.2 Security Release – What You Need to Know

WordPress Core 6.3.2 was released today, on October 12, 2023. It includes a number of security fixes and additional hardening against commonly exploited vulnerabilities. While all of the vulnerabilities are of Medium severity, several of them are impactful enough to potentially allow site takeove...

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 2, 2023 to October 8, 2023)

Last week, there were 92 vulnerabilities disclosed in 88 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 37 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities ...

Mitsubishi Electric MELSEC-F Series

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION : Exploitable remotely/low attack complexity Vendor : Mitsubishi Electric Corporation Equipment : MELSEC-F Series Vulnerability : Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability may allow a remote...

CVE-2023-44981

A flaw was found in Apache ZooKeeper. Authorization bypass through user-controlled key is available iff SASL Quorum Peer authentication is enabled in ZooKeeper via quorum.auth.enableSasl=true configuration. A malicious user could bypass the authentication controller by using a non-existing instan...

SoftEther VPN DCRegister DDNS_RPC_MAX_RECV_SIZE denial of service vulnerability

Talos Vulnerability Report TALOS-2023-1736 SoftEther VPN DCRegister DDNSRPCMAXRECVSIZE denial of service vulnerability October 12, 2023 CVE Number CVE-2023-22325 SUMMARY A denial of service vulnerability exists in the DCRegister DDNSRPCMAXRECVSIZE functionality of SoftEther VPN 4.41-9782-beta,...

CVE-2023-45132

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

Design/Logic Flaw

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...