CVE-2023-23325

CVE-2023-23325 affects Zumtobel Netlink CCD Onboard firmware versions 3.74–3.79; a command-injection flaw is triggered via the NetHostname parameter. The issue originates in firmware prior to 3.80, with the fixed version being 3.80 or later. Impact details in the public record indicate high confi...

fido-device-onboard bug fix and enhancement update

An update is available for fido-device-onboard. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fido-device-onboard package provides a rust implementation of...

ABB AC500 Allocation of Resources Without Limits or Throttling (CVE-2020-24685)

An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service DoS vulnerability. Vulnerability allows attacker to stop the PLC. After stopping ERR LED flashing red, physical access to the PLC is required in order to restart the application. This...

SUSE CVE-2015-2906

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private...

SUSE CVE-2015-2908

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server...

Design/Logic Flaw

The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol udp/1024 commands interfacing directly with the target device. This, in turn, allows for...

Database Integrity Vulnerabilities in Boeing’s Onboard Performance Tool

This post is released in a co-ordinated manner with Boeing. TL;DR: Security gaps in older, unprotected Windows desktop versions of Boeing’s Onboard Performance Tool OPT could make certain Electronic Flight Bags EFB more susceptible to attack. In particular, OPT’s use of plain text configuration...

CVE-2022-31599

NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitialized pointer, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to oth...

fido-device-onboard bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

fido-device-onboard bug fix and enhancement update

An update is available for fido-device-onboard. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rock...

CVE-2020-24686 AC500 V2 webserver denial of service vulnerability

The vulnerabilities can be exploited to cause the web visualization component of the PLC to stop and not respond, leading to genuine users losing remote visibility of the PLC state. If a user attempts to login to the PLC while this vulnerability is exploited, the PLC will show an error state and...

CVE-2020-24685

An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service DoS vulnerability. Vulnerability allows attacker to stop the PLC. After stopping ERR LED flashing red, physical access to the PLC is required in order to restart the application. This...

Design/Logic Flaw

An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service DoS vulnerability. Vulnerability allows attacker to stop the PLC. After stopping ERR LED flashing red, physical access to the PLC is required in order to restart the application. This...

CVE-2020-24685 AC500 V2 unauthenticated crafter packet vulnerability

An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service DoS vulnerability. Vulnerability allows attacker to stop the PLC. After stopping ERR LED flashing red, physical access to the PLC is required in order to restart the application. This...

Intel® Server Board Onboard Video Driver Advisory

Summary: A potential security vulnerability in the Intel® Server Board Onboard Video Driver for Windows may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2020-24450 Description: Uncontrolled search pa...

CVE-2020-7590

A vulnerability has been identified in DCA Vantage Analyzer All versions V4.5 are affected by CVE-2020-7590. In addition, serial numbers 40000 running software V4.4.0 are also affected by CVE-2020-15797. Affected devices use a hard-coded password to protect the onboard database. This could allow ...

CVE-2020-7590

A vulnerability has been identified in DCA Vantage Analyzer All versions V4.5 are affected by CVE-2020-7590. In addition, serial numbers 40000 running software V4.4.0 are also affected by CVE-2020-15797. Affected devices use a hard-coded password to protect the onboard database. This could allow ...

Hardcoded credentials

A vulnerability has been identified in DCA Vantage Analyzer All versions V4.5 are affected by CVE-2020-7590. In addition, serial numbers 40000 running software V4.4.0 are also affected by CVE-2020-15797. Affected devices use a hard-coded password to protect the onboard database. This could allow ...

CVE-2020-7590

CVE-2020-7590 affects DCA Vantage Analyzer in all versions below V4.5 (with CVE-2020-15797 affecting serials

CVE-2020-7590

A vulnerability has been identified in DCA Vantage Analyzer All versions V4.5 are affected by CVE-2020-7590. In addition, serial numbers 40000 running software V4.4.0 are also affected by CVE-2020-15797. Affected devices use a hard-coded password to protect the onboard database. This could allow ...