SoftEtherVPN -- multiple vulnerabilities

Daiyuu Nobori reports: The SoftEther VPN project received a high level code review and technical assistance from Cisco Systems, Inc. of the United States from April to June 2023 to fix several vulnerabilities in the SoftEther VPN code. The risk of exploitation of any of the fixed vulnerabilities ...

Legacy version check should be removed to avoid double relaying message in CrossDomainMessager.sol

Lines of code Vulnerability details Impact Legacy version check should be removed to avoid double relaying message Proof of Concept In Optimism bedrock implementation, to handle the pre-bedrock migration, there is code check to make sure the transaction that finalized and relayed in pre-bedrock...

Attacker can steal CrossDomainMessenger and OptimismPortal token balances or tokens of anyone give approval for those contracts

Lines of code Vulnerability details Impact Contracts CrossDomainMessenger and OptimismPortal are part of the bridge protocol and they are responsible for sending messages between two network. they both call arbitrary address with arbitrary data that user specified and it would give attacker to...

CVE-2021-4350

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfmsendfileinemail AJAX action. This makes it possible for unauthenticated attackers to send emails usin...

CVE-2021-4350

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfmsendfileinemail AJAX action. This makes it possible for unauthenticated attackers to send emails usin...

CVE-2021-4350 Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfmsendfileinemail AJAX action. This makes it possible for unauthenticated attackers to send emails usin...

CVE-2023-24510

On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart...

CVE-2023-24510

On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart...

Code injection

On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart...

CVE-2023-24510

CVE-2023-24510 affects Arista EOS on multiple platforms. A malformed DHCP packet can cause the DHCP relay agent to restart, leading to partial denial of service of the DHCP relay service. The issue is present in EOS trains listed by Arista’s advisory and is triggered when two or more DHCP server ...

Arista EOS 安全漏洞

Arista EOS is a fully programmable, highly modular, Linux-based network operating system from Arista Corporation. A security vulnerability exists in Arista EOS, which stems from the fact that an incorrectly formatted DHCP packet may cause the DHCP relay agent to restart...

CVE-2023-24510 On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.

On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart...

CVE-2023-24510 On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.

On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart...

Vulnerability fixed in Arista series 7000 switches

Arista has fixed a vulnerability in the EOS software of several Series 7000 switches. A malicious party can exploit abuse the vulnerability to use a manipulated DHCP packet to crash and restart the DHCP relay service to crash and restart, thus creating a partial Denial-of-Service can occur. Arist...

CVE-2023-24510

On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart...

The vulnerability of the microprogramming software in Schneider Electric Easergy P40 relay protection and control devices allows a intruder to manipulate network traffic.

The vulnerability of microprogrammed software in relay protection and control devices from Schneider Electric’s Easergy P40 lies in the use of rigidly encrypted account data. Exploiting this vulnerability could allow a malicious actor to manipulate network traffic remotely...

Security Advisory 0087

Security Advisory 0087 . CSAF PDF Date: May 31, 2023 Revision | Date | Changes ---|---|--- 1.0 | May 31, 2023 | Initial release 1.1 | September 24, 2024 | Update fixed release info The CVE-ID tracking this issue: CVE-2023-24510 CVSSv3.1 Base Score: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H...

CrossDomainMessenger relayMessage Vulnerability

Lines of code Vulnerability details Impact The vulnerability allows an attacker to manipulate the sender address sender parameter when relaying a message from Layer 2 L2 to Layer 1 L1 in a cross-domain scenario. The issue arises due to the use of the L2CrossDomainMessenger contract address...

China's Mustang Panda Hackers Exploit TP-Link Routers for Persistent Attacks

The Chinese nation-state actor known as Mustang Panda has been linked to a new set of sophisticated and targeted attacks aimed at European foreign affairs entities since January 2023. An analysis of these intrusions, per Check Point researchers Itay Cohen and Radoslaw Madej, has revealed a custom...

kernel: netfilter: nf_conntrack_irc message handling issue

A flaw was found in the Linux kernel in nfconntrackirc where the message handling can be confused and it incorrectly matches on the message. An attacker could exploit this vulnerability to bypass firewall when users are using unencrypted IRC with nfconntrackirc configured...