UBUNTU-CVE-2026-19742

The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers genstableiid in subsys/net/ip/ipv6.c and RFC 8981 temporary interface identifiers gentemporaryiid in subsys/net/ip/ipv6pe.c with sysrandget. That API is documented as not cryptographically secur...

CVE-2026-19742 IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key

The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers genstableiid in subsys/net/ip/ipv6.c and RFC 8981 temporary interface identifiers gentemporaryiid in subsys/net/ip/ipv6pe.c with sysrandget. That API is documented as not cryptographically secur...

EUVD-2026-109973

The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers genstableiid in subsys/net/ip/ipv6.c and RFC 8981 temporary interface identifiers gentemporaryiid in subsys/net/ip/ipv6pe.c with sysrandget. That API is documented as not cryptographically secur...

CVE-2026-19742

The Zephyr RTOS IPv6 stack is vulnerable because it uses the non-cryptographically secure sys_rand_get() to derive the secret key for RFC 7217 stable interface identifiers (IIDs) and RFC 8981 temporary IIDs. Because the underlying xoshiro128++ generator is invertible and its state is shared, an a...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via improper verification of AWS EC2 identity documents in the aws-iid process. An attacker can cause the system to accept forged identity documents by providing documents with missing or invalid...

EUVD-2007-0268

Malware in sbrugna...

PROTEAN: Federated Intrusion Detection in Non-IID Environments through Prototype-Based Knowledge Sharing

In distributed networks, participants often face diverse and fast-evolving cyberattacks. This makes techniques based on Federated Learning FL a promising mitigation strategy. By only exchanging model updates, FL participants can collaboratively build detection models without revealing sensitive...

FAAD2 ps_mix_phase Heap Buffer Overflow DoS

The vulnerability of the psmixphase function in the libfaad/psdec.c component of the Freeware Advanced Audio Decoder 2 FAAD2 decoder is related to the lack of checking for the iidindex. Exploiting this vulnerability allows an attacker to gain access to confidential data and also cause service...

PT-2021-17248

Name of the Vulnerable Software and Affected Versions: SPIRE versions prior to 0.8.5 SPIRE versions prior to 0.9.4 SPIRE versions prior to 0.10.2 SPIRE versions prior to 0.11.3 SPIRE versions prior to 0.12.1 Description: The issue arises from the improper normalization of the path provided throug...

EUVD-2019-2618

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes...

CVE-2019-10896

Wireshark CVE-2019-10896 affects DOF dissector in versions 2.4.0–2.4.13, 2.6.0–2.6.7, and 3.0.0. The root cause is improper handling of generated IID and OID bytes in epan/dissectors/packet-dof.c, which could cause a crash. The vulnerability is addressed by the DOF dissector fix in that file. Rem...

CVE-2019-10896

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes...

PT-2018-3818

Name of the Vulnerable Software and Affected Versions Freeware Advanced Audio Decoder 2 FAAD2 versions 2.8.8 Description The issue is related to a buffer over-read in the ps mix phase function of the libfaad/ps dec.c component of the Freeware Advanced Audio Decoder 2 FAAD2 audio decoder. This is...

JVN#24238648: RBB SPEED TEST App fails to verify SSL server certificates

RBB SPEED TEST App provided by IID, Inc. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Application Update to the latest version according to the information provided by the developer...

PT-2011-4269

Name of the Vulnerable Software and Affected Versions IBM Web Application Firewall versions prior to update 31.030 Description The issue allows remote attackers to bypass intended intrusion prevention by dividing a dangerous parameter value into substrings. This can be demonstrated by a SQL...

CVE-2008-0801: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in the PAXXGallery compaxxgallery 0.2 component for Mambo and Joomla! allow remote attackers to execute arbitrary SQL commands via 1 the iid parameter in a view action, and possibly 2 the userid parameter...

CVE-2007-0266

SQL injection vulnerability in boxx/ShowAppendix.asp in Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the iid parameter...

CVE-2007-0265

Multiple cross-site scripting XSS vulnerabilities in Ezboxx Portal System Beta 0.7.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the pic parameter to custom/piczoom.asp, 2 the nocatname parameter to boxx/user-upload.asp, or 3 the iid parameter to...

CVE-2007-0266: Undefined Security Weakness

SQL injection vulnerability in boxx/ShowAppendix.asp in Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the iid parameter...

CVE-2007-0265: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Ezboxx Portal System Beta 0.7.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the pic parameter to custom/piczoom.asp, 2 the nocatname parameter to boxx/user-upload.asp, or 3 the iid parameter to...