HP DeskJet 安全漏洞

HP DeskJet is a family of printers from Hewlett-Packard HP in the United States. A security vulnerability exists in HP DeskJet that originates from a user with administrative privileges being able to create a corrupted dll file with the same name as the original dll in the HP Printer Firmware...

HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code

A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility FUU bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution. Update yo...

PT-2024-2665 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: HP Printer's Firmware Update Utility FUU bundle affected versions not specified Description: The issue is related to an uncontrolled search path element in the HP printer's Firmware Update Utility FUU bundle. A user with administrative...

BUFFALO LinkStation 200 series vulnerable to arbitrary code execution

Overview LinkStation 200 series provided by BUFFALO INC. is a network attached storage NAS. LinkStation 200 series contains an arbitrary code execution vulnerability CWE-354, CVE-2023-51073 due to insufficient verification of data authenticity during firmware update. BUFFALO INC. reported this...

OESA-2024-1315 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage function, allowing a user to trigger a heap buffer overflow via a local network. Successful...

CVE-2024-2162

CVE-2024-2162 is an OS command injection vulnerability in Kiloview NDI devices (N3, N3-s, N4, N20, N30, N40). The issue allows a low-privileged user to remotely execute arbitrary code with high privileges. Root cause is an OS command injection path exploitable over network. Affected firmware vers...

CVE-2024-2161 Use of Hard-coded Credentials in Kiloview NDI N series products API middleware

Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227...

PT-2024-21877 · Planet · Planet Igs-4215-16T2S

Name of the Vulnerable Software and Affected Versions: Planet IGS-4215-16T2S version 1.305b210528 Description: The issue is related to an information exposure vulnerability. It could allow a remote attacker to access some administrative resources due to the lack of proper management of the Switch...

PT-2024-22419 · Totolink · Totolink X2000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X2000R versions prior to V1.0.0-B20231213.1013 Description: The issue is related to a Stored Cross-site scripting XSS vulnerability. This vulnerability is located in the IP/Port Filtering section under the Firewall Page. Stored XSS i...

PT-2024-22379 · Linksys · Linksys E1000

Name of the Vulnerable Software and Affected Versions: Linksys E1000 router firmware versions v.2.1.03 and before Description: The issue is a stack-based buffer overflow vulnerability in the pc change act function, which can lead to remote code execution. Recommendations: For Linksys E1000 router...

CVE-2023-7017

Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A challenge request can be sent to the lock with a command to prepare for an update, rather than an unlock request, allowing an attacker to...

CVE-2023-7017 CVE-2023-7017

Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A challenge request can be sent to the lock with a command to prepare for an update, rather than an unlock request, allowing an attacker to...

CVE-2023-7017 CVE-2023-7017

Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A challenge request can be sent to the lock with a command to prepare for an update, rather than an unlock request, allowing an attacker to...

CVE-2023-7017

CVE-2023-7017 affects Sciener locks with BLE-based firmware updates. The vulnerability is that the firmware update mechanism does not authenticate or validate updates delivered via Bluetooth Low Energy, enabling a challenge request to be sent to the lock to prepare for an update (instead of an un...

Sciener locks firmware security vulnerability

Sciener is a smart lock firmware from Sciener. A security vulnerability exists in the Sciener locks firmware, which stems from the fact that the firmware update mechanism does not validate the firmware update request if the firmware update is passed to the lock via the Bluetooth Low Energy servic...

PT-2024-2555 · Tp Link · Tp-Link Omada Er605

Name of the Vulnerable Software and Affected Versions: TP-Link Omada er605 versions 1.0.1 through 2.2.3 Description: The issue is caused by an integer overflow in the cloud-brd binary, leading to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the conte...

HPESBHF04608 rev.1 - Certain HPE ProLiant DL/ML and MicroServer Using Certain Intel Processors, INTEL-SA-00972, 2024.1 IPU - Intel Processor Bus Lock Advisory, Remote Denial of Service Vulnerability

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL20 Gen11 - Prior to v1.4401-18-2024 HPE ProLiant MicroServer Gen11 - Prior to v1.4401-18-2024 HPE ProLiant ML30 Gen11 - Prior to v1.4401-18-2024 CVSS Scores: | C...

2024.1 IPU - Intel® Processor Return Predictions Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing a firmware update to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-38575 Description: Non-transparent sharing of return predictor targets...

CLSA-2024-1709839522 Update of linux-firmware

Update AMD CPU microcode to 2023-12-05: - Update AMD CPU microcode for processor family 19h: sig 0x00a10f11, sig 0x00a10f12, sig 0x00aa0f02; - Update AMD CPU microcode for processor family 17h: sig 0x00830f10. - tuxcare.els suffix added for each package...

CLSA-2024-1709728814 Update of linux-firmware

Update AMD CPU microcode to 2023-12-05: - Update AMD CPU microcode for processor family 19h: sig 0x00a10f12, sig 0x00aa0f02, sig 0x00aa0f01, sig 0x00a10f11; - Update AMD CPU microcode for processor family 17h: sig 0x00830f10; - Fix adding AMD CPU microcode for processor family 19h; - Fix release...