NIP-04 parsing amplifies malformed ciphertext memory use

The NIP-04 decryption parser split attacker-controlled content on every ?iv= separator and collected all resulting segments before checking that the message had the expected two parts. It also Base64-decoded the complete IV text before checking that it represented the required 16-byte AES-CBC IV....

MiracleLinux 8 : fwupd-1.5.9-1.el8.ML.1 (AXSA:2022-2904:01)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-2904:01 advisory. grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled CVE-2020-14372 grub2: Use-after-free in rmmod...

PT-2024-7286 · Zyxel · Zyxel Vmg8825-T50K

Name of the Vulnerable Software and Affected Versions: Zyxel VMG8825-T50K firmware versions through 5.50ABOM.8C0 Description: The issue is related to an improper restriction of operations within the bounds of a memory buffer in the parameter type parser, which could allow an authenticated attacke...