FXC wireless LAN routers "AE1021PE" and "AE1021" vulnerable to OS command injection Critical

Overview "AE1021PE" and "AE1021" provided by FXC Inc. are information outlet-based wireless LAN routers. "AE1021PE" and "AE1021" contain an OS command injection vulnerability CWE-78. JPCERT/CC has confirmed the communication which exploits this vulnerability. Ryu Kuki, Takayuki Sasaki, and...

PT-2023-24337

Name of the Vulnerable Software and Affected Versions Supermicro X11 and M11 based devices with firmware versions up to 3.17.02 Description A web server in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation allows remote unauthenticated users to...

PT-2023-8803

Name of the Vulnerable Software and Affected Versions Supermicro X11 and M11 based devices versions prior to 3.17.02 Description The web interface in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation allows remote authenticated users to execute...

SUSE: Security Advisory (SUSE-SU-2023:4655-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BIOS Image Parsing Function Vulnerabilities (LogoFAIL) - Lenovo Support US

No description provided...

SUSE-SU-2023:4665-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode to 20231030 bsc1215831: - CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. - CVE-2021-46774: Insufficient...

SUSE-SU-2023:4664-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode to 20231030 bsc1215831: - CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. - CVE-2021-46774: Insufficient...

SUSE-SU-2023:4660-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode to 20231030 bsc1215831: - CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. - CVE-2021-46774: Insufficient...

SUSE-SU-2023:4655-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode to 20231030 bsc1215831: - CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. - CVE-2021-46774: Insufficient...

PT-2023-7332 · Zyxel · Zyxel Nas326 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 version V5.21AAZF.14C0 Zyxel NAS542 version V5.21ABAG.11C0 Description: A command injection issue exists in the web server of the Zyxel NAS326 and NAS542 firmware due to the lack of neutralization of special elements used in...

RLSA-2023:7189 Moderate: fwupd security update

The fwupd packages provide a service that allows session software to update device firmware. Security Fixes: fwupd: world readable password in /etc/fwupd/redfish.conf CVE-2022-3287 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

Franklin Electric Fueling Systems Colibri

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : Franklin Electric Fueling Systems Equipment : Colibri Vulnerability : Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could...

PT-2023-7436 · Phoenix · Phoenix Securecore Technology

Name of the Vulnerable Software and Affected Versions: Phoenix SecureCore Technology version 4 Description: The issue is related to improper input validation in the processing of user-supplied splash screens during system boot. This could potentially allow an attacker to cause a denial-of-service...

Synology Router Manager (SRM) 1.2.x < 1.2.5-8227-11, 1.3.x < 1.3.1-9346-8 Multiple Vulnerabilities (Synology-SA-23:16) - Remote Known Vulnerable Versions Check

Synology Router Manager SRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Synology Router Manager (SRM) 1.2.x < 1.2.5-8227-11, 1.3.x < 1.3.1-9346-8 Multiple Vulnerabilities (Synology-SA-23:16) - Unreliable Remote Version Check

Synology Router Manager SRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WAGO PFC200 Series

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 2.7 ATTENTION : low attack complexity Vendor : WAGO Equipment : PFC200 Series Vulnerability : Externally Controlled Reference to a Resource in Another Sphere 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker with...

PT-2023-26612 · Tenda · Tenda Ac6 +3

Name of the Vulnerable Software and Affected Versions: Tenda AC19 version 1.0 Tenda AC18 affected versions not specified Tenda AC9 version 1.0 Tenda AC6 versions 1.0 through 2.0 Description: A Buffer Overflow issue allows a remote attacker to execute arbitrary code via the formSetCfm function in...

PT-2023-7597 · NetGear · Netgear Orbi Rbr750

Name of the Vulnerable Software and Affected Versions: Netgear Orbi RBR750 versions prior to V7.2.6.21 Description: The issue is related to a stack-based buffer overflow in the /usr/sbin/httpd process. It is also associated with the strlcpy function, which can cause a buffer overflow when handlin...

Multiple vulnerabilities in ELECOM and LOGITEC routers

Overview Multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION contain multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2023-43752 Inadequate Encryption Strength CWE-326 - CVE-2023-43757 CVE-2023-43752 Chuya Hayakawa of 00One, Inc. reported this vulnerabilit...

CVE-2023-5984

A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in full control over the device...