4771 matches found
Incorrect authorization vulnerability in OMRON Sysmac Studio
Overview Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability CWE-863, CVE-2024-49501. OMRON Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC coordinated with OMRON Corporation for the JVN advisory...
PT-2024-33520 · Samsung · Galaxy S24
Name of the Vulnerable Software and Affected Versions: Galaxy S24 versions prior to Firmware update Sep-2024 Release Description: The issue is related to an out-of-bounds write in the Battery Full Capacity node, allowing local attackers to write out-of-bounds memory. System privilege is required...
PT-2024-12203 · Waybox · Waybox Wb-2024-002 +2
Name of the Vulnerable Software and Affected Versions: Waybox WB-2024-001 Waybox WB-2024-002 Waybox WB-2024-003 Description: A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700. Recommendations: For Waybox WB-2024-001, update to the latest firmware to mitigate...
PT-2024-8258 · NetGear · Netgear R6400 +2
Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.78 Netgear R7000P version 1.3.3.154 Netgear R6400 v2 version 1.0.4.128 Description: The issue is related to a buffer overflow in the geniepppoe.cgi script of Netgear router firmware, specifically when handling the...
REST-APIs unintentionally enabled in Century Systems FutureNet NXR series routers
Overview FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial factory default configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server GUI or Web...
Hikvision network camera security enhancement to prevent cleartext transmission of Dynamic DNS credentials
Overview Multiple network cameras provided by Hangzhou Hikvision Digital Technology Co., Ltd. support two Dynamic DNS services, DynDNS and NO-IP.The user can select which to use on the GUI configuration page. Both the services provide their APIs accessible via HTTP and HTTPS, but old firmware...
JVN#11779839: Hikvision network camera security enhancement to prevent cleartext transmission of Dynamic DNS credentials
Multiple network cameras provided by Hangzhou Hikvision Digital Technology Co., Ltd. support two Dynamic DNS services, DynDNS and NO-IP. The user can select which to use on the GUI configuration page. Both the services provide their APIs accessible via HTTP and HTTPS, but old firmware versions of...
LevelOne WBR-6012 Web Application denial of service vulnerability
Talos Vulnerability Report TALOS-2024-2001 LevelOne WBR-6012 Web Application denial of service vulnerability October 30, 2024 CVE Number CVE-2024-33623 SUMMARY A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6. A specially crafted HTTP...
PT-2024-7559 · D Link · D-Link Dsl-6740C
Name of the Vulnerable Software and Affected Versions: D-Link DSL-6740C version 6.TR069.20211230 Description: The issue is related to the use of weak password requirements in the D-Link DSL-6740C router's software component. This could allow a remote attacker to escalate their privileges. The...
PT-2024-9329 · Lorex · Lorex 2K Indoor Wi-Fi Security Camera
Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An unauthenticated attacker can perform a null pointer dereference in the DHIP Service using the UDP port 37810. This issue can potentially allow ...
Security Bulletin: NVIDIA ConnectX and BlueField - October 2024
NVIDIA has released a firmware update for NVIDIA ConnectX and BlueField Data Processing Unit. To protect your system, download and install this firmware update from the NVIDIA Enterprise Support Portal. Go to NVIDIA Product Security. Details This section provides a summary of potential...
PT-2024-9304 · Lorex · Lorex 2K Indoor Wi-Fi Security Camera
Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An authenticated attacker can trigger a stack-based buffer overflow in the DHIP Service TCP port 80. This issue allows a remote attacker to...
PT-2024-9330 · Lorex · Lorex 2K Indoor Wi-Fi Security Camera
Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An unauthenticated attacker can perform an out of bounds heap read in the IQ Service TCP port 9876. This issue is related to a buffer overflow in...
PT-2024-9302 · Lorex · Lorex 2K Indoor Wi-Fi Security Camera
Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An unauthenticated attacker can trigger a stack-based buffer overflow in the DP Service TCP port 3500. This issue can potentially allow a remote...
The vulnerability of the Seamless Firmware Update Handler component in Intel microprogramming systems arises from synchronization errors when using shared resources, allowing attackers to trigger a service failure.
The vulnerability of the Seamless Firmware Update Handler component in Intel microprogramming systems arises due to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to cause a service failure...
ABB多款产品 数据伪造问题漏洞
ABB Relion Protection Relays and others are products of ABB Switzerland.ABB Relion Protection Relays are a compact, multifunctional solution for utility and industrial power distribution systems.ABB REX610 is a flexibly configurable all-in-one protection relay.ABB REX615 is ABB REX615 is a flexib...
CVE-2024-48544
Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive information by analyzing the code and data within the APK file...
CVE-2024-48542
Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information by analyzing the code and data within the APK file...