CVE-2024-40619

CVE-2024-40619 affects Rockwell Automation GuardLogix/ControlLogix 5580 PLCs. The vulnerability arises from an improper check for unusual or exceptional conditions in handling CIP packets received over the network, causing a major nonrecoverable fault and denial-of-service. Affected products incl...

CVE-2024-40619 Rockwell Automation GuardLogix/ControlLogix 5580 Controller denial-of-service Vulnerability via Malformed Packet Handling

CVE-2024-40619 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service...

CVE-2024-7515

Summary of CVE-2024-7515 (Rockwell Automation): A denial‑of‑service via input validation flaw in PTP management handling affects Rockwell Automation devices: CompactLogix 5380, Compact GuardLogix 5380, ControlLogix 5580, and GuardLogix 5580 (and related 5069/1756 series). The root cause is improp...

CVE-2024-7515 Rockwell Automation ControlLogix/GuardLogix 5580 and CompactLogix/Compact GuardLogix® 5380 Controller Denial-of-Service Vulnerability via Input Validation

CVE-2024-7515 IMPACT A denial-of-service vulnerability exists in the affected products. A malformed PTP management packet can cause a major nonrecoverable fault in the controller...

Apache MINA SSHD Security Bypass Vulnerability

Apache MINA SSHD is a pure Java library from the U.S. Apache Apache Foundation that supports both client-side and server-side SSH protocols. A security bypass vulnerability exists in Apache MINA SSHD versions prior to 2.12.0, which can be exploited by an attacker to drop certain packets from a...

PT-2024-30568 · Russh · Russh

Name of the Vulnerable Software and Affected Versions: russh versions prior to 0.44.1 Description: The issue arises from allocating an untrusted amount of memory based on the length specified in an SSH packet, which can be set to any value by a client. This allows any unauthenticated user to caus...

kernel: net: bridge: xmit: make sure we have at least eth header len bytes

A vulnerability was found in the Linux kernel in the net: bridge component, where the xmit function in the bridge device could trigger an uninitialized value error if a short skb less than the required ETHHLEN bytes is sent. This condition could cause unexpected behavior due to insufficient check...

Rockwell Automation GuardLogix/ControlLogix 5580 Controller

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : ControlLogix 5580, GuardLogix 5580 Vulnerability : Improper Check for Unusual or Exceptional Conditions 2. RISK EVALUATION Successful exploitation of this...

Improper Validation Of Integrity Check Value

org.apache.sshd, sshd-common is vulnerable for Improper Validation Of Integrity Check Value. The vulnerability is due to the possibility of packet interception, where an attacker can intercept traffic between the client and server and drop certain packets from the stream, potentially downgrading ...

CVE-2024-42740

CVE-2024-42740 affects TOTOLINK X5000r, version 9.1.0cu.2350_b20230313. The vulnerability is an OS command injection in the file /cgi-bin/cstecgi.cgi within the function setLedCfg . Authenticated attackers can send malicious packets to execute arbitrary commands. Public documents confirm affected...

CVE-2024-42738

The CVE-2024-42738 issue affects TOTOLINK X5000r (version 9.1.0cu.2350_b20230313). It is an OS command injection in the /cgi-bin/cstecgi.cgi function setDmzCfg, exploitable by authenticated attackers who can send malicious packets to execute arbitrary commands. The vulnerability’s impact is high ...

The vulnerability of the Packet Forwarding Engine (PFE) module in Juniper Networks’ Junos OS on SRX Series devices allows a hacker to cause a service failure.

The vulnerability of the Packet Forwarding Engine PFE module in Juniper Networks’ Junos OS on SRX Series devices is related to the use of uncontrolled format strings. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

CVE-2024-42738

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands...

CVE-2024-42739

CVE-2024-42739 affects TOTOLINK X5000r (firmware v9.1.0cu.2350_b20230313). The vulnerability is an OS command injection in /cgi-bin/cstecgi.cgi within setAccessDeviceCfg. Authenticated attackers can send crafted packets to execute arbitrary commands, with network access and high impact (C/H/I/A =...

CVE-2024-42737

The CVE-2024-42737 vulnerability affects TOTOLINK X5000r (version 9.1.0cu.2350_b20230313) where the CGI endpoint /cgi-bin/cstecgi.cgi contains an OS command injection in the delBlacklist function. An attacker can send a malicious packet to execute arbitrary commands on the affected device. The is...

CVE-2024-42736

CVE-2024-42736 affects TOTOLINK X5000r (v9.1.0cu.2350_b20230313). The vulnerability is an OS command injection in the addBlacklist function in /cgi-bin/cstecgi.cgi. Authenticated attackers can send malformed packets to execute arbitrary commands. Public documents from multiple sources corroborate...

RADIUS Protocol CVE-2024-3596

...

CLSA-2024-1723495305 Fix of 19 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-42068 - bpf: Take return from setmemoryro into account with bpfproglockro CVE-url: https://ubuntu.com/security/CVE-2024-42079 - gfs2: Fix NULL pointer dereference in gfs2logflush CVE-url: https://ubuntu.com/security/CVE-2024-42226 - usb: xhci: prevent...

CLSA-2024-1723494706 Fix of 19 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-42068 - bpf: Take return from setmemoryro into account with bpfproglockro CVE-url: https://ubuntu.com/security/CVE-2024-42079 - gfs2: Fix NULL pointer dereference in gfs2logflush CVE-url: https://ubuntu.com/security/CVE-2024-42226 - usb: xhci: prevent...

CVE-2024-42747

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands...