(0Day) Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Important: Red Hat Security Advisory: linux-firmware security update

An update for linux-firmware is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2024-45038 Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware

Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic device firmware is subject to a denial of serivce vulnerability in MQTT handling, fixed in version 2.4.1 of the...

CVE-2024-45038 Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware

Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic device firmware is subject to a denial of serivce vulnerability in MQTT handling, fixed in version 2.4.1 of the...

Multiple vulnerabilities in ELECOM wireless LAN routers and access points

Overview Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below. Cross-site scripting vulnerability due to an improper processing of input values in easysetup.cgi and menu.cgi CWE-79 - CVE-2024-34577, CVE-2024-42412 Missing...

JVN#24885537: Multiple vulnerabilities in ELECOM wireless LAN routers and access points

Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below. Cross-site scripting vulnerability due to an improper processing of input values in easysetup.cgi and menu.cgi CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score...

BUFFALO wireless LAN routers and wireless LAN repeaters vulnerable to OS command injection

Overview Wireless LAN routers and wireless LAN repeaters provided by BUFFALO INC. contain an OS command injection vulnerability CWE-78. Yoshiki Mori and Masaki Kubo of National Institute of Information and Communications Technology, Cybersecurity Research Laboratory reported this vulnerability to...

JVN#12824024: BUFFALO wireless LAN routers and wireless LAN repeaters vulnerable to OS command injection

Wireless LAN routers and wireless LAN repeaters provided by BUFFALO INC. contain an OS command injection vulnerability CWE-78. Impact If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS...

Rockwell Automation 5015 - AENFTXT

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : 5015 - AENFTXT Vulnerability : Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a denial-of-service...

Important: Red Hat Bug Fix Advisory: linux-firmware bug fix and enhancement update

An update for linux-firmware is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Bug Fixes and Enhancements: Update linux-firmware to include QAT402XX firmware...

PT-2024-5749 · Tp Link · Tp-Link Re365

Name of the Vulnerable Software and Affected Versions: TP-Link RE365 version V1 180213 Description: The issue is related to a buffer overflow vulnerability due to the lack of length verification for the USER AGENT field in /usr/bin/httpd. This vulnerability can be exploited by attackers to cause...

ROS-20240815-17

A vulnerability in the fwupd daemon for managing firmware update installation on Linux-based systems is related to saving an automatically generated password in /etc/fwupd/redfish.conf without proper restrictions. Exploitation of the vulnerability could allow an attacker acting remotely to gain...

OPENSUSE-SU-2024:14266-1 kernel-firmware-all-20240809-1.1 on GA media

These are all security issues fixed in the kernel-firmware-all-20240809-1.1 package on the GA media of openSUSE Tumbleweed...

HPESBHF04695 rev.1 - Certain HPE StoreEasy Servers Using Certain Intel Processors, INTEL-SA-01100, 2024.3 IPU - Intel Xeon Processor Advisory, Local Escalation of Privilege Vulnerability

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE StoreEasy 1660 Storage - Prior to v2.2008-07-2024 HPE StoreEasy 1860 Storage - Prior to v2.2008-07-2024 HPE StoreEasy 1670 Storage - Prior to v2.2005-27-2024 HPE StoreEasy...

Intel Ethernet Controllers and Adapters Advisory - Lenovo Support US

No description provided...

CVE-2024-6788

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...

CVE-2024-6788

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...

CVE-2024-6788

CVE-2024-6788 affects Phoenix Contact CHARX SEC family (CHARX SEC-3000/3050/3100/3150). A remote unauthenticated attacker can abuse the LAN firmware-update feature to reset the low-privilege user “user-app” password to the default. Root cause is described as insecure default resource initializati...

CVE-2024-6788 Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...

CVE-2024-6788 Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...