Input validation

A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host system via forged update packages...

CVE-2023-36650

A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host system via forged update packages...

CVE-2023-36650

CVE-2023-36650 concerns ProLion CryptoSpike 3.0.15P2, where a missing integrity check in the software’s update system allows an attacker to run OS commands as root on the host via forged updates. The vulnerability affects the update mechanism (update system) and the root-level impact is described...

PT-2023-7875 · Phoenix Contact · Fc 350 Pci Eth +4

Name of the Vulnerable Software and Affected Versions: PHOENIX CONTACT classic line PLCs affected versions not specified AXC 1050 AXC 1050 XC AXC 3050 FC 350 PCI ETH Description: The issue allows an unauthenticated remote attacker to modify some or all applications on a PLC due to a lack of code...

PT-2023-25654 · Prolion · Prolion Cryptospike

Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: A missing integrity check in the update system allows attackers to execute OS commands as the root Linux user on the host system via forged update packages. Recommendations: For ProLion...

Buildroot BR_NO_CHECK_HASH_FOR data integrity vulnerability

Talos Vulnerability Report TALOS-2023-1845 Buildroot BRNOCHECKHASHFOR data integrity vulnerability December 5, 2023 CVE Number CVE-2023-43608 SUMMARY A data integrity vulnerability exists in the BRNOCHECKHASHFOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted...

Rocky Linux 8 : nodejs:20 (RLSA-2023:7205)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:7205 advisory. - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return ...

CVE-2023-28802

An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149...

Input validation

An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149...

CVE-2023-28802 Disable Zscaler using machine tunnel restart

An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149...

CVE-2023-28802

Zscaler Client Connector for Windows is affected by CVE-2023-28802 due to improper validation of integrity check values. An authenticated user can disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. Affected versions are prior to 4.2.0.149. Remediation: upgrade to 4.2.0....

CVE-2023-28802 Disable Zscaler using machine tunnel restart

An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149...

PT-2023-21978

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector versions prior to 4.2.0.149 Description An issue with improper validation of integrity check values in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service...

CVE-2023-5984

A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in full control over the device...

CVE-2023-5984

Affected products: Schneider Electric PowerLogic ION8650 and ION8800. Vulnerability: CWE-494 Download of Code Without Integrity Check allows a modified firmware to be uploaded during a firmware update initiated by an authorized admin. Impact: could result in full control over the device due to un...

CVE-2023-5984

A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in full control over the device...

Schneider Electric ION8650 and ION8800 Security Vulnerabilities

The Schneider Electric ION8650 and Schneider Electric ION8800 are both next-generation outlet and switchboard meters for utility network monitoring from Schneider Electric France. A security vulnerability exists in the Schneider Electric ION8650 and ION8800 that stems from the presence of a code...

CVE-2023-28002

An improper validation of integrity check value vulnerability CWE-354 in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesyst...

Input validation

An improper validation of integrity check value vulnerability CWE-354 in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.2 all versions, 7.0 all versions, 2.0 all versions VMs may allow a local attacker with admin privileges...

CVE-2023-28002

CVE-2023-28002 affects Fortinet FortiOS/ FortiGate VM where an improper validation of the integrity check value (CWE-354) can allow a local admin to boot a malicious image and bypass filesystem integrity checks. Affected: FortiOS/ FortiGate VM images on versions 7.2.0–7.2.3, 7.0.0–7.0.12, 6.4 (al...