kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params()

A flaw was found in the Linux kernel’s IP framework for transforming packets XFRM subsystem. This issue may allow a malicious user with CAPNETADMIN privileges to directly dereference a NULL pointer in xfrmupdateaeparams, leading to a possible kernel crash and denial of service...

kernel: xfrm: add NULL check in xfrm_update_ae_params

In the Linux kernel, the following vulnerability has been resolved: xfrm: add NULL check in xfrmupdateaeparams Normally, x-replayesn and x-preplayesn should be allocated at xfrmallocreplaystateesn... in xfrmstateconstruct..., hence the xfrmupdateaeparams... is okay to update them. However, the...

Mitsubishi Electric MELSEC WS Series Security Vulnerability

The Mitsubishi Electric MELSEC WS Series is a programmable logic controller from Mitsubishi Electric Japan. A security vulnerability exists in Mitsubishi Electric MELSEC WS Series WS0-GETH00200. An attacker could use this vulnerability to bypass authentication and disclose or tamper with programs...

Fedora 39 : python-templated-dictionary (2024-f69989e7dd)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-f69989e7dd advisory. Fixing CVE-2023-6395 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for th...

Zyxel NAS326 Operating System Command Injection Vulnerability

Zyxel NAS326 is a cloud storage NAS from China Hopkins Zyxel. An operating system command injection vulnerability exists in Zyxel NAS326 firmware version V5.21AAZF.15C0 and earlier versions, and NAS542 firmware version V5.21ABAG.12C0 and earlier versions. An attacker could exploit this...

CVE-2023-40546 Shim: out-of-bounds read printing error messages

A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a cras...

CVE-2024-0788 SUPERAntiSpyware Pro X v10.0.1260 - Kernel-level API parameters manipulation

SUPERAntiSpyware Pro X v10.0.1260 is vulnerable to kernel-level API parameters manipulation and Denial of Service vulnerabilities by triggering the 0x9C402140 IOCTL code of the saskutil64.sys driver...

Daily Habit Tracker Security Vulnerability

Daily Habit Tracker is a daily habit tracker by rems personal developer. A security vulnerability exists in the Daily Habit Tracker App version 1.0, which stems from an SQL injection vulnerability in the tracker parameters...

WordPress plugin Biteship security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

Motorola MR2600 Security Vulnerability

The Motorola MR2600 is a wireless router from Motorola, Inc. A security vulnerability exists in the Motorola MR2600 due to a command injection vulnerability in the "SaveStaticRouteIPv4Params" parameter...

Internet Bug Bounty: Denial of Service caused by HTTP/2 CONTINUATION Flood

A denial of service vulnerability was discovered in Apache Tomcat versions 11.0.0-M1 to 11.0.0-M16, 10.1.0-M1 to 10.1.18, 9.0.0-M1 to 9.0.85, and 8.5.0 to 8.5.98. The vulnerability was caused by the way Tomcat processed HTTP/2 requests that exceeded configured limits for headers. A fix was releas...

kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params()

A flaw was found in the Linux kernel’s IP framework for transforming packets XFRM subsystem. This issue may allow a malicious user with CAPNETADMIN privileges to directly dereference a NULL pointer in xfrmupdateaeparams, leading to a possible kernel crash and denial of service...

openssl: Excessive time spent checking DH keys and parameters

A vulnerability was found in OpenSSL. This security flaw occurs because the applications that use the DHcheck, DHcheckex, or EVPPKEYparamcheck functions to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an...

RHEL 8 : edk2 (RHSA-2024:0408)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0408 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware f...

GL.iNet Unauthenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'digest/md5' class MetasploitModule 'GL.iNet Unauthenticated Remote Command Execution via the logread module.', 'Description' = %q A command injection...

AZL-34880 CVE-2024-23851 affecting package kernel for versions less than 6.6.35.1-4

copyparams in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INTMAX bytes, and crash, because of a missing paramkernel-datasize check. This is related to ctlioctl...

UBUNTU-CVE-2024-23851

copyparams in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INTMAX bytes, and crash, because of a missing paramkernel-datasize check. This is related to ctlioctl...

illi Link Party! <= 1.0 - Admin+ Stored Cross-Site Scripting

Description The plugin does not sanitize and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks. PoC 1. Go to "Settings Link Party!". 2. Under "Add a New Party", enter the payload for either the "Party Name" or "Party Description":...

WordPress theme Meris security vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on servers running PHP and MySQL.WordPress theme is a theme for WordPress. A security vulnerability exists in WordPress theme Meris version 1.1.2 and earlier versions, which...

Jensen of Scandinavia Eagle 1200AC Security Vulnerability

Jensen of Scandinavia Eagle 1200AC is a router from Jensen. A security vulnerability exists in the Jensen Eagle 1200AC version V15.03.06.33en. An attacker can exploit this vulnerability to execute arbitrary commands by manipulating mac parameters...