Moderate: Red Hat Security Advisory: lldpd security update

An update for lldpd is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

lldp/openvswitch: denial of service via externally triggered memory leak

A flaw was found in multiple versions of Open vSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability...

NetworkManager: Denial of Service

A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a malicious user could inject a malformed LLDP packet. NetworkManager would crash, leading to a denial of service...

Icinga 信任管理问题漏洞

Icinga is a scalable server, network resource monitoring system from Icinga, Germany. A trust management issue vulnerability exists in Icinga that stems from a flaw in TLS certificate validation...

The vulnerability of the storage manager Adaptec Maxview for industrial computers SIMATIC IPC1047, SIMATIC IPC1047E, SIMATIC IPC647D, and SIMATIC IPC647E allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the data storage manager Adaptec Maxview for industrial computers SIMATIC IPC1047, SIMATIC IPC1047E, SIMATIC IPC647D, and SIMATIC IPC647E is related to the use of a non-unique TLS certificate. Exploiting this vulnerability allows attackers to carry out “man-in-the-middle”...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird lies in improper restrictions on the displayed layers of the user interface, which allows attackers to carry out clickjacking attacks.

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to an improper limitation on the visually displayed layers of the user interface. Exploiting this vulnerability allows a remote attacker to carry out a clickjacking attack...

CVE-2024-50229 nilfs2: fix potential deadlock with newly created symlinks

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential deadlock with newly created symlinks Syzbot reported that pagesymlink, called by nilfssymlink, triggers memory reclamation involving the filesystem layer, which can result in circular lock dependencies among...

Intelligent Freenow 安全漏洞

Intelligent Freenow is a cab booking software from Intelligent. A security vulnerability exists in Intelligent Freenow version 12.10.0, which stems from the parameter DEFAULTKEYSTOREPASSWORD in the file ch/qos/logback/core/net/ssl/SSL.java that can lead to the use of hard-coded passwords...

GHSA-7JQF-V358-P8G7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-7088-4)

"The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7088-4 advisory. Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local...

USN-7088-3: Linux kernel vulnerabilities

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service system crash. CVE-2022-36402 Several security issues were discovered in the Linux kernel. An attacker could...

CLSA-2024-1730801437 openssl: Fix of CVE-2024-5535

CVE-2024-5535: Validate provided client list in ssl/ssllib.c. Clarify SSLselectnextproto documentation...

NETGEAR R8500、NETGEAR XR300、NETGEAR R7000P和NETGEAR R6400v2 安全漏洞

NETGEAR R8500 and others are products of NETGEAR USA.NETGEAR R8500 is a wireless router.NETGEAR R6400v2 is a router.NETGEAR R7000P is a wireless router. A security vulnerability exists in NETGEAR R8500 version v1.0.2.160, XR300 version v1.0.3.78, R7000P version v1.3.3.154, and R6400v2 version...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm, Inc. A security vulnerability exists in Qualcomm Chipsets that originates from a memory corruption during the initialization of the GNSS HAL process...

PT-2024-27995 · Qualcomm · Qualcomm Snapdragon Auto

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon Auto affected versions not specified Description: The issue is related to memory corruption during the GNSS HAL process initialization. Recommendations: At the moment, there is no information about a newer version that...

Malicious code in sc-meta-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e8afeccfd77a3b36e9c24aa1057807ba8f2a18972791b3cbc857e3d961e60d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Teams Deployment Guidance for App Layering or User Personalization Layer(UPL)

Microsoft Teams 2.x has changed its installation method and now installs under C:\Program Files\WindowsApps. Based on those changes this article provides the specific steps for the deployment of the Teams 2.x in an App LayeringAL or User Personalization LayerUPL environment. For the most current...

The vulnerability of the Remote Access SSL VPN function in microprogramming-based network interface devices from Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows a attacker to cause a service failure.

The vulnerability of the Remote Access SSL VPN function in microprogramming-based network interface devices of Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD is related to the absence of resource release after the expiration of its validity period. Exploiting this...

Floodlight OpenFlow Controller 安全漏洞

Floodlight OpenFlow Controller OSS is a Java-based open source enterprise SDN controller from Floodlight Open Source. A security vulnerability exists in Floodlight OpenFlow Controller version 1.2, which stems from allowing local hosts to construct fake LLDP packets, which can lead to hosts inside...

The vulnerability of the TLS function in microprogramming-based network interface controllers of Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to induce service failures.

The vulnerability of the TLS function in Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems is related to improper validation of certain types of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...