SonarSource SonarQube Security Vulnerabilities

SonarSource SonarQube is an open source code quality management system from SonarSource, Switzerland. A security vulnerability exists in SonarSource SonarQube versions 10.4 and prior to 9.9.4, which stems from the fact that encrypted values generated using the Set Encryption feature may be...

CVE-2024-37637

TOTOLINK A3700R V9.1.2u.616520211012 was discovered to contain a stack overflow via ssid5g in the function setWizardCfg...

CVE-2024-37634

TOTOLINK A3700R V9.1.2u.616520211012 was discovered to contain a stack overflow via ssid in the function setWiFiEasyCfg...

PT-2024-27689 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.6165 20211012 Description: A stack overflow issue was discovered in the setWiFiBasicCfg function via the ssid parameter. This issue can potentially be exploited. Recommendations: For TOTOLINK A3700R version...

PT-2024-26940 · Apache · Apache Submarine Commons Utils

Name of the Vulnerable Software and Affected Versions: Apache Submarine Commons Utils versions 0.8.0 and later Description: The issue is related to an Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set submarine.auth.default.secret, a defau...

PT-2024-4395 · Tenda · Tenda A301

Name of the Vulnerable Software and Affected Versions: Tenda A301 version 15.13.08.12 Description: A critical issue has been identified, classified as critical, affecting the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk crypto leads to a...

kernel: netfilter: nf_tables: disallow anonymous set with timeout flag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFTSETEVAL to ensure legacy meters still work...

PT-2024-9774

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to suspicious RCU usage in the br mst set state function, which could lead to a use-after-free error. This was caused by converting br mst set state to RCU without...

GHSA-MG4X-PRH7-G4MX Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability

In Zend Framework, ZendCaptchaWord v1 and Zend\Captcha\Word v2 generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal arrayrand function. This function does not generate...

kernel: netfilter: nf_tables: disallow anonymous set with timeout flag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFTSETEVAL to ensure legacy meters still work...

kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout

A vulnerability was found in the netfilter/nftables subsystem of Linux Kernel, where a race condition caused where the garbage collector could prematurely collect elements from anonymous sets with timeouts while they were being released...

kernel: netfilter: nf_tables: disallow anonymous set with timeout flag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFTSETEVAL to ensure legacy meters still work...

PT-2024-21868

Name of the Vulnerable Software and Affected Versions Samsung Mobile Processor Exynos versions 980, 850, 1280, 1380, and 1330 Description An issue was discovered in the function slsi set delayed wakeup type, where there is no input validation check on the length of ioctl args-argsi coming from...

CVE-2024-36604

Tenda O3V2 v1.0.0.123880 was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers to execute arbitrary commands with root privileges...

Unable to generate the correct character set

Reduced entropy due to inadequate character set usage Description Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the nanoid::base62 and nanoid::base58 functions. Specifically, the base62 function used a character set of 32 symbols instead of the...

Duplicate Advisory: nano-id reduced entropy due to inadequate character set usage

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9hc7-6w9r-wj94. This link is maintained to preserve external references. Original Description Description Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the...

GHSA-2HFW-W739-P7X5 Duplicate Advisory: nano-id reduced entropy due to inadequate character set usage

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9hc7-6w9r-wj94. This link is maintained to preserve external references. Original Description Description Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the...

CVE-2024-36400

nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the nanoid::base62 and nanoid::base58 functions. Specifically, the base62 function used a character set of 32 symbols instead of the intended 62...

glibc: Out of bounds write in iconv may lead to remote code execution

An out-of-bounds write flaw was found in the ISO-2022-CN-EXT plugin for glibc's iconv library. When converting from UCS4 charset, adding certain escape charterers is required to indicate where the charset was changed to the library. During this process, iconv improperly checks the boundaries of...

CVE-2024-36400 nano-id is unable to generate the correct character set

nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the nanoid::base62 and nanoid::base58 functions. Specifically, the base62 function used a character set of 32 symbols instead of the intended 62...