CVE-2021-27853 L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers

Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers...

Vulnerabilities in Layer 2 Network Security Controls Affecting Cisco Products: September 2022

On September 27, 2022, the following vulnerabilities affecting Cisco products were disclosed by Cert/CC as part of VU855201, titled L2 network security controls can be bypassed using VLAN 0 stacking and/or 802.3 headers "https://kb.cert.org/vuls/id/855201": CVE-2021-27853: Layer 2 network filteri...

多款Cisco产品安全漏洞

Cisco IOS and others are products of Cisco Corporation.Cisco IOS is a set of operating systems developed for its network devices.Cisco IOS XE Software is an operating system.Cisco Small Business is a switch.Cisco IOS XE Software is an operating system.Cisco Small Business is a switch. Cisco IOS...

PT-2022-4863 · Cisco · Cisco Ios +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to the implementation of the Ethernet encapsulation protocol, specifically concerning the combination of headers. This could allow ...

PT-2022-9877 · Cisco · Cisco Ios +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows Layer 2 network filtering capabilities, such as IPv6 RA guard, to be bypassed. This can be achieved by using LLC/SNAP headers with...

多款Cisco产品安全漏洞

Cisco NX-OS Software and others are products of Cisco Corporation.Cisco NX-OS Software is a set of data center-grade operating system software used by switches.Cisco IOS is an operating system developed for its network devices.Cisco IOS XE Software is an operating system.Cisco IOS XE Software is...

PT-2022-9876 · Ieee +1 · 802.2 +3

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue allows Layer 2 network filtering capabilities, such as IPv6 RA guard, to be bypassed. This can be achieved by using specific combinations of VLAN 0 headers, LLC/SNAP...

PT-2022-9878 · Ieee +1 · 802.2 +3

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows Layer 2 network filtering capabilities, such as IPv6 RA guard, to be bypassed. This can be achieved by utilizing LLC/SNAP headers with...

多款Cisco产品安全漏洞

Cisco NX-OS Software and others are products of Cisco Corporation.Cisco NX-OS Software is a set of data center-grade operating system software used by switches.Cisco IOS is an operating system developed for its network devices.Cisco IOS XE Software is an operating system.Cisco IOS XE Software is...

Security Bulletin: Vulnerability in Transport Layer Security Protocol Used in IBM System Networking Ethernet Switches (CVE-2011-3389)

Abstract Earlier versions of the Transport Layer Security TLS protocol are affected by a publicly disclosed vulnerability that could allow information disclosure if an attacker is carrying out a man-in-the-middle attack. Customers can avoid the vulnerability by following workarounds recommended b...

Frontier 安全漏洞

Frontier is an EtherCompatible layer for Substrate. It is used to run unmodified Ethernet Dapps. Frontier has a security vulnerability that stems from the fact that the worst-case weight is always used as the block weight for all cases...

DEBIAN-CVE-2022-37026

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS...

UBUNTU-CVE-2022-37026

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS...

Ericsson Erlang 授权问题漏洞

Ericsson Erlang is a general-purpose concurrency-oriented programming language from Ericsson, Sweden. A security vulnerability exists in Erlang versions prior to 23.3.4.15, 24.x up to 24.3.4.2, and 25.x up to 25.0.2, which stems from bypassing client authentication in certain client-side...

SUSE SLES15 Security Update : libcontainers-common (SUSE-SU-2022:3312-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3312-1 advisory. libcontainers-common was updated: - common component was updated to 0.44.0. - storage component was updated to 1.36.0. - image...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: heap overflow in nftseteleminit CVE-2022-34918 kernel: vulnerability of buffer overflow in nftsetdescconcatparse CVE-2022-2078 For more details about the security issues, including the...

ALSA-2022:6610 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: heap overflow in nftseteleminit CVE-2022-34918 kernel: vulnerability of buffer overflow in nftsetdescconcatparse CVE-2022-2078 For more details about the security issues, including the...

ForgeRock LDAP connector 安全漏洞

The ForgeRock LDAP connector is a connector from ForgeRock USA, Inc. It enables you to integrate synchronization services with LDAP v3 servers. A security vulnerability exists in ForgeRock LDAP connector versions prior to 1.5.20.9, which stems from a vulnerability that allows unauthenticated acce...

PT-2022-23094

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.0 through 2.9.0 TensorFlow versions 2.8.0 through 2.8.0 TensorFlow versions 2.7.0 through 2.7.1 Description The issue occurs when the Conv2D function is given an empty input and valid...

The Global DDoS Threat Landscape – September 2022

Every month in this space, we will post the State of the Global DDoS Threat Landscape blog on behalf of the Imperva Threat Research team. As DDoS attacks become more frequent, varied, and sophisticated, it is critical that we regularly communicate the Imperva Threat Research team’s findings and...