Zyxel patches two critical vulnerabilities

Zyxell has released a security advisory for multiple buffer overflow vulnerabilities. Exploitation of these vulnerabilities could allow an unauthenticated attacker to cause denial-of-service DoS conditions and even a remote code execution on the affected Zyxell firewalls. Affected users should...

HPESBHF04451 rev.1 - Certain HPE SimpliVity Servers Using Certain Intel Processors, INTEL-SA-00717, 2023.1 IPU - BIOS Advisory, Local Escalation of Privileges

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant XL170r Gen10 Server - Prior to OmniStack Firmware version 20230502 HPE SimpliVity 190r Gen10 Server - Prior to OmniStack Firmware version 20230502 HPE SimpliVity...

CVE-2023-28386

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrar...

CVE-2023-28386

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrar...

PT-2023-8776 · Dell · Dell Precision Bios +1

Name of the Vulnerable Software and Affected Versions: Dell PowerEdge 14G server BIOS versions prior to 2.18.1 Dell Precision BIOS versions prior to 2.18.2 Description: The issue is related to an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit thi...

Qrio Smart Lock Q-SL2 vulnerable to authentication bypass by capture-replay

Overview Qrio Smart Lock Q-SL2 provided by Qrio, inc. contains an authentication bypass by capture-replay vulnerability CWE-294. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

JVN#48687031: Qrio Smart Lock Q-SL2 vulnerable to authentication bypass by capture-replay

Qrio Smart Lock Q-SL2 provided by Qrio, inc. contains an authentication bypass by capture-replay vulnerability CWE-294. Impact An attacker may analyze the product's communication data and perform unintended operations under certain conditions. Solution Update the firmware and related products...

Exploit for Missing Authentication for Critical Function in Cisco Spa112_Firmware

RancidCrisco Minimum Viable PoC for CVE-2023-20126 This is th...

Moderate: Red Hat Bug Fix Advisory: linux-firmware bug fix and enhancement update

An update for linux-firmware is now available for Red Hat Enterprise Linux 8. For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section...

Snap One OvrC Cloud (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Snap One Equipment: OvrC Cloud, OvrC Pro Devices Vulnerabilities: Improper Input Validation, Observable Response Discrepancy, Improper Access Control, Cleartext Transmission of Sensitive Information,...

Netgear Routers' Flaws Expose Users to Malware, Remote Attacks, and Surveillance

As many as five security flaws have been disclosed in Netgear RAX30 routers that could be chained to bypass authentication and achieve remote code execution. "Successful exploits could allow attackers to monitor users' internet activity, hijack internet connections, and redirect traffic to...

Vulnerabilities in SICK FTMg

SICK found multiple security vulnerabilities in the SICK FTMg device. If exploited, these potentially allow a remote unauthenticated attacker to impact the availabiltiy or confidentaility of the FTMg device. Currently SICK is not aware of any public exploits specifically targeting any of the...

PT-2023-3477 · Wavlink · Wavlink Wl-Wn531Ax2

Name of the Vulnerable Software and Affected Versions: WAVLINK WL-WN531AX2 versions prior to 2023526 Description: The issue is related to client-side enforcement of server-side security, which may allow an attacker with administrative privilege to execute OS commands with the root privilege. This...

PT-2023-16564 · Canon · I-Sensys C1127I +14

Name of the Vulnerable Software and Affected Versions: Satera LBP660C Series versions 11.04 and earlier Satera LBP620C Series versions 11.04 and earlier Satera MF740C Series versions 11.04 and earlier Satera MF640C Series versions 11.04 and earlier Color imageCLASS LBP660C Series versions 11.04 a...

PT-2023-16566 · Canon · C1127If +13

Name of the Vulnerable Software and Affected Versions: Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series versions 11.04 and earlier Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C versions 11.04 and earlier i-SENSYS LBP660C...

CVE-2023-30356

Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmware...

CVE-2023-30356

Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmware...

CVE-2022-21162

Uncontrolled search path for the IntelR HDMI Firmware Update tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-21162

Uncontrolled search path for the IntelR HDMI Firmware Update tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-40971

Incorrect default permissions for the IntelR HDMI Firmware Update Tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access...