PT-2023-5756 · Mbed Tls +1 · Mbed Tls +1

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 3.2.x through 3.4.x Description: The issue is related to a buffer overflow in Mbed TLS, which can lead to remote code execution. This occurs due to a heap-based buffer overflow vulnerability in the implementation of TLS and...

A malicious user can spam ghost deposits to DoS the LayerZeroEndpoint messaging layer

Lines of code Vulnerability details Impact There can be many deposits that will strain the messaging layer, especially in chains that do not cost much to send a transaction. Proof of Concept The entry point of the bridge is callOutSignedAndBridge in BranchBridgeAgent.sol. This function will pack...

python: TLS handshake bypass

Python ssl.SSLSocket is vulnerable to a bypass of the TLS handshake in certain instances for HTTPS servers and other server-side protocols that use TLS client authentication such as mTLS. This issue may result in a breach of integrity as its possible to modify or delete resources that are...

python: TLS handshake bypass

Python ssl.SSLSocket is vulnerable to a bypass of the TLS handshake in certain instances for HTTPS servers and other server-side protocols that use TLS client authentication such as mTLS. This issue may result in a breach of integrity as its possible to modify or delete resources that are...

Analysis and Config Extraction of Lu0Bot, a Node.js Malware with Considerable Capabilities

Nowadays, more malware developers are using unconventional programming languages to bypass advanced detection systems. The Node.js malware Lu0Bot is a testament to this trend. By targeting a platform-agnostic runtime environment common in modern web apps and employing multi-layer obfuscation,...

The vulnerability of the Layer 2 Tunneling Protocol (L2TP) implementation in the Cisco IOS XE operating system allows a hacker to induce a service failure.

The vulnerability of the Layer 2 Tunneling Protocol L2TP implementation in the Cisco IOS XE operating system is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the ril component in MediaTek’s microprogramming software allows attackers to enhance their privileges.

The vulnerability of MediaTek’s microprogramming software relates to reading data outside the buffer in memory. Exploiting this vulnerability can allow an attacker to gain access to confidential information...

GLSA-202310-02 : NVIDIA Drivers: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202310-02 NVIDIA Drivers: Multiple Vulnerabilities - NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape or IOCTL in which user-mo...

PT-2023-5869 · Qualcomm · Qualcomm Data Modem

Name of the Vulnerable Software and Affected Versions: Qualcomm Data Modem affected versions not specified Description: The issue is related to a cryptographic problem in the Data Modem due to improper authentication during the TLS handshake. This can allow a remote attacker to gain read, modify,...

PT-2023-9463 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the handling of transhdrlen in the ip,6 append data function. Including transhdrlen in the length is a problem when the packet is partially filled, as it can...

What Is mTLS? The Essential Guide You Can’t Afford to Miss

Intro: mTLS — The Unsung Hero of Cybersecurity Picture this: You're a secret agent on a high-stakes mission. You have a briefcase full of confidential information that you need to hand over securely. Sure, you could pass it to another agent, but how do you know you can trust them? Here's where mT...

CVE-2023-20227

A vulnerability in the Layer 2 Tunneling Protocol L2TP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain L2TP packets. An attacker could explo...

Design/Logic Flaw

A vulnerability in the Layer 2 Tunneling Protocol L2TP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain L2TP packets. An attacker could explo...

CVE-2023-20227

A vulnerability in the Layer 2 Tunneling Protocol L2TP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain L2TP packets. An attacker could explo...

CVE-2023-20227

CVE-2023-20227 concerns Cisco IOS XE Software, specifically the Layer 2 Tunneling Protocol (L2TP) DoS vulnerability. The issue stems from improper handling of certain L2TP packets in the L2TP feature, enabling an unauthenticated, remote attacker to trigger a device reload and thus a denial of ser...

Cisco IOS XE Software Layer 2 Tunneling Protocol Denial of Service Vulnerability

A vulnerability in the Layer 2 Tunneling Protocol L2TP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain L2TP packets. An attacker could explo...

CVE-2023-41332

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with policy.cilium.io/proxy-visibility annotations in Cilium = v1.13 or io.cilium.proxy-visibility annotations in Cilium...

Code injection

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with policy.cilium.io/proxy-visibility annotations in Cilium = v1.13 or io.cilium.proxy-visibility annotations in Cilium...

Specific Cilium configurations vulnerable to DoS via Kubernetes annotations

Impact In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with - policy.cilium.io/proxy-visibility annotations in Cilium = v1.13 - io.cilium.proxy-visibility annotations in Cilium = v1.12 causes the Cilium agent to segfault on the node to which the workload is...

PT-2023-8586 · Unknown +1 · Freeswitch +1

Name of the Vulnerable Software and Affected Versions: FreeSWITCH versions prior to 1.10.11 Description: The issue is related to incorrect handling of exceptional states in the FreeSWITCH software-defined telecom stack, which can lead to a Denial of Service DoS when handling DTLS-SRTP for media...