CVE-2024-37570

CVE-2024-37570 affects Mitel 6869i, firmware 4.5.0.41. The issue arises in the Manual Firmware Update page (upgrade.html), which fails to sanitize username and path parameters before appending to the busybox ftpget command, enabling $() command execution by an authenticated user. Impact is descri...

PT-2024-4345 · NetGear · Netgear Wnr614

Name of the Vulnerable Software and Affected Versions: Netgear WNR614 JNR1010V2 N300-V1.1.0.54 1.0.1 Description: The issue is related to the improper setting of the HTTPOnly flag for cookies, allowing attackers to possibly intercept and access sensitive communications between the router and...

Android Security Bulletin—June 2024Stay organized with collectionsSave and categorize content based on your preferences.

The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2024-06-05 or later from the June 2024 Android Security Bulletin in addition to all issues in this...

Seiko Solutions SkyBridge MB-A100/MB-A110 and SkyBridge BASIC MB-A130 vulnerable to OS command injection

Overview SkyBridge MB-A100/MB-A110 and SkyBridge BASIC MB-A130 provided by Seiko Solutions Inc. contain a command injection vulnerability CWE-77. Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact If the remote monitoring and...

PT-2024-4078 · Zyxel · Zyxel Nas326 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 versions prior to V5.21AAZF.17C0 Zyxel NAS542 versions prior to V5.21ABAG.14C0 Description: The command injection vulnerability in the setCookie parameter could allow an unauthenticated attacker to execute some operating system O...

RHEL 7 : microcode_ctl (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - kernel: Intel firmware update for improper isolation of shared resources CVE-2022-38090 - Incorrect...

[SECURITY] Fedora 39 Update: system76-keyboard-configurator-1.3.10-2.fc39

Application for configuration of System76 keyboard firmware...

CLSA-2024-1717086553 linux-firmware: Fix of 4 CVEs

Update iwlwifi firmware to mitigate CVE-2022-38076 for wifi adapters: Intel Wireless-AC 9560, Intel Wireless-AC 9462, Intel Wireless-AC 9461, Intel Wireless-AC 9260 - Update automatically loaded iwlwifi firmware to mitigate CVE-2022-36351, CVE-2022-27635, CVE-2022-40964 for wifi adapters: Intel...

PT-2024-4653 · D Link · D-Link Dir-1950

Name of the Vulnerable Software and Affected Versions: D-Link DIR-1950 versions up to v1.11B03 Description: The issue is related to the failure to validate SSL certificates when requesting the latest firmware version and downloading URL. This can allow attackers to perform a man-in-the-middle...

ELECOM wireless LAN routers vulnerable to OS command injection

Overview Wireless LAN routers provided by ELECOM CO.,LTD. contain an OS command injection vulnerability CWE-78. Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact If a user who can log in to the product sends a specially crafte...

CLI SSH not working after upgrade with OpenSSH vulnerability patch Error Bad SSH2 cipher spec

After Upgrading to a firmware version with OpenSSH v9.3 patched for the recent SSH vulnerabilities 12.1-55.304+ FIPS, 13.0-92.23+, 13.1-53.4+, 13.1-37.180+ FIPS, 14.1-22.16+ SSH is not working anymore. Putty throws the error: Network error: Software caused connection abort...

PT-2024-12808 · Zkteco · Zkteco-Based Oem Devices

Name of the Vulnerable Software and Affected Versions: ZKTeco-based OEM devices versions ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly other Standalone service versions 2.1.6-20200907 and possibly others Description: An SQL Injection vulnerability exists in ZKTeco-based OEM devices due to improper...

Ruijie BCR810W/BCR860 vulnerable to OS command injection

Overview Network router BCR810W/BCR860 provided by Ruijie Networks Co., Ltd. contains an OS command injection vulnerability CVE-2023-3608, CWE-78. Note that this vulnerability can only be exploited when the BCOS port of the product is connected to the Internet. JPCERT/CC has confirmed attacks...

HPESBST04649 rev.1 - HPE SAN Switches with Brocade Fabric OS (FOS), Remote Code Execution and Elevated Privileges Vulnerability

Potential Security Impact: Remote: Arbitrary Code Execution, Elevated Privileges SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE B-series SN2600B SAN Extension Switch - v9.x prior to v9.1.1d1 HPE B-series SN3600B Fibre Channel Switch - v9.x prior to v9.1.1d1 HPE B-series SN470...

Buffalo LS210D < 1.82 Multiple Vulnerabilities

Buffalo LS210D is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:buffalo:ls210dfirmware"; if...

Intel ProSet Wireless WiFi and Bluetooth Advisory - Lenovo Support US

No description provided...

Intel Ethernet Adapters and Intel Ethernet Controller I225 Advisory - Lenovo Support US

No description provided...

Unspecified Vulnerability in D-Link DAP-2622 (CNVD-2024-24414)

The D-Link DAP-2622 is a wireless access point Access Point device from China's D-Link. A security vulnerability exists in the D-Link DAP-2622 due to a stack-based buffer overflow remote code execution vulnerability in the IPv6 address of the DDP firmware update server. An attacker could exploit...

PT-2024-11572 · Nuki Home Solutions · Nuki Bridge

Name of the Vulnerable Software and Affected Versions: Nuki Bridge versions prior to 1.22.0 Nuki Bridge versions prior to 2.13.2 Description: An issue was discovered on certain Nuki Home Solutions devices, where sending a malformed HTTP verb can force a reboot of the device. Recommendations: For...

PT-2024-11567 · Nuki · Nuki Keypad +1

Name of the Vulnerable Software and Affected Versions: Nuki Keypad versions prior to 1.9.2 Nuki Fob versions prior to 1.8.1 Description: An issue was discovered on certain Nuki Home Solutions devices, where an attacker with physical access to the JTAG port may be able to connect to the device and...