JumpServer Security Vulnerability

Jumpserver is an open source bastion machine from Hangzhou Feizhiyun Information Technology Co. in China. A security vulnerability exists in JumpServer versions prior to 3.8.0 that stems from allowing an attacker to bypass password brute force protection by spoofing arbitrary IP addresses...

CVE-2023-5538

The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

The vulnerability of the ICMPv6 network protocol implementation in Junos QFX5K routers allows a attacker to cause a service failure.

The vulnerability of the ICMPv6 network protocol implementation in Junos QFX5K routers lies in the execution of a loop with an unavailable exit condition when processing WAV/AVI format files. Exploiting this vulnerability allows a remote attacker to cause service failures...

The vulnerability of the TCP/IP protocol implementation in the Windows operating system allows a hacker to cause a service failure.

The vulnerability of the TCP/IP protocol implementation in the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

USN-6431-2: iperf3 vulnerability

USN-6431-1 fixed a vulnerability in iperf3. This update provides the corresponding update for Ubuntu 22.04 LTS and Ubuntu 23.04. Original advisory details: It was discovered that iperf3 did not properly manage certain inputs, which could lead to a crash. A remote attacker could possibly use this...

CVE-2023-45579

Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and...

The vulnerability of the TCP/IP protocol implementation in the Windows operating system allows a hacker to cause a service failure.

The vulnerability of the TCP/IP protocol implementation in the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the communication protocol implementation for microprogrammed router software ER2000, related to the introduction or modification of arguments, allows a perpetrator to execute arbitrary code.

The vulnerability of the communication protocol implementation for Connected IO microprogramming software is related to the exploitation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by injecting arguments into the IP table command...

PT-2023-5980 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a denial-of-service vulnerability in the implementation of the TCP/IP protocol in the Windows operating system, caused by insufficient input validation. This can all...

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent, as well as Acronis Cyber Protect 15, stems from the use of unlimited IP addresses. This leads to an increase in the surface area for attacks, allowing attackers to gain unauthorized access to the system.

The vulnerability of backup and data recovery software on computers and servers involves Acronis Agent and Acronis CyberProtect 15 data protection software. This vulnerability is related to the use of an unlimited IP address, which increases the scope of possible attacks. Exploiting this...

The vulnerability of the ipv4_send_dest_unreach() function in the net/ipv4/route.c module of the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the ipv4senddestunreach function in the net/ipv4/route.c module of the Linux kernel is related to the assignment of a null pointer. Exploitation of this vulnerability could allow an attacker to cause a service failure...

glibc: potential use-after-free in getaddrinfo()

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nssgethostbyname2r and nssgetcanonnamer hooks without...

Linux kernel 代码问题漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service vulnerability exists in the Linux kernel, which stems from a NULL pointer dereference flaw found in the ipv4 stack, which can be exploited by a local attack...

USN-6416-1 linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle vulnerabilities

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service excessive CPU consumption. CVE-2023-1206 Daniel Trujillo, Johannes Wikner, and Kaveh Razavi...

UBUNTU-CVE-2023-42756

A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSETCMDADD and IPSETCMDSWAP can lead to a kernel panic due to the invocation of ipsetput on a wrong set. This issue may allow a local user to crash the system...

CVE-2023-20187

A vulnerability in the Multicast Leaf Recycle Elimination mLRE feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause the affected device to reload, resulting in a denial of service DoS condition. This...

F5 BIG-IP AFM Security Vulnerability

F5 BIG-IP AFM is an advanced firewall product from F5 USA for protection against DDos attacks. A security vulnerability exists in the F5 BIG-IP AFM Clients that stems from a vulnerability that allows an attacker to trick clients into sending IP traffic outside of the VPN tunnel...

The vulnerability of the Clario antivirus software client’s VPN client relates to the lack of protection for transmitted data. This allows a hacker to send arbitrary IP traffic as plain text beyond the VPN tunnel.

The vulnerability of the Clario antivirus software’s VPN client lies in the lack of protection for transmitted data. Exploiting this vulnerability allows a malicious actor to send arbitrary IP traffic as plain text outside the VPN tunnel...

PT-2023-5095 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient protection of service data in the implementation of the TCP/IP protocol in Windows operating systems. This can allow an attacker to gain unauthorized...

PT-2023-23104 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 4.0 through 4.4.2 IBM Aspera Faspex versions 5.0 through 5.0.5 Description: The issue allows a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request. Recommendations: For IBM...