PT-2024-38176 · Totolink · Totolink Lr1200Gb

Name of the Vulnerable Software and Affected Versions: TOTOLINK LR1200 version 9.3.1cu.2832 Description: A problem was found in the file /etc/shadow.sample, which leads to the use of a hard-coded password. The complexity of an attack is rather high, and the exploitability is told to be difficult...

CVE-2024-7155

A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557B20221024 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. It is possible to launch the attack on the local...

TOTOLINK A3300R 安全漏洞

The TOTOLINK A3300R is a wireless router manufactured by China's Gion Electronics TOTOLINK. The TOTOLINK A3300R is vulnerable to a hard-coded password vulnerability that originates from the use of hard-coded passwords in the /etc/shadow.sample file. No details of the vulnerability are provided at...

Webinar: Securing the Modern Workspace: What Enterprises MUST Know about Enterprise Browser Security

The browser is the nerve center of the modern workspace. Ironically, however, the browser is also one of the least protected threat surfaces of the modern enterprise. Traditional security tools provide little protection against browser-based threats, leaving organizations exposed. Modern...

SUSE SLES12 Security Update : shadow (SUSE-SU-2024:2603-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2603-1 advisory. - CVE-2013-4235: Fixed a race condition when copying and removing directory trees bsc916845. Tenable has extracted the preceding description...

SUSE: Security Advisory (SUSE-SU-2024:2603-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Photon OS 3.0: Shadow PHSA-2023-3.0-0705

An update of the shadow package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-3.0-0705. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Shadow PHSA-2024-5.0-0182

An update of the shadow package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-0182. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

kernel: KVM: s390: vsie: fix race during shadow creation

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: fix race during shadow creation Right now it is possible to see gmap-private being zero in kvms390vsiegmapnotifier resulting in a crash. This is due to the fact that we add gmap-private == kvm after creation:...

SUSE-SU-2024:2603-1 Security update for shadow

This update for shadow fixes the following issues: - CVE-2013-4235: Fixed a race condition when copying and removing directory trees bsc916845...

Photon OS 4.0: Shadow PHSA-2023-4.0-0415

An update of the shadow package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-4.0-0415. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 4.0: Shadow PHSA-2023-4.0-0399

An update of the shadow package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-4.0-0399. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 4.0: Shadow PHSA-2023-4.0-0536

An update of the shadow package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-4.0-0536. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2024-38806 UAA Failure to Remove Shadow User’s Access

Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40.17.0 , potentially resulting in users retaining access rights they should not have. This can allow them to perform operations beyond their...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Linux Linux_Kernel

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the...

Security Bulletin: Security vulnerabilities may affect Ubuntu packages that are shipped with IBM CICS TX Advanced.

Summary Security vulnerabilities may affect Ubuntu packages that are shipped with IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the issues. Vulnerability Details CVEID:CVE-2023-4641 DESCRIPTION: shadow-maint shadow-utils could allow a local authenticated attacker to obtain sensitive...

kernel: KVM: NULL pointer dereference in kvm_mmu_invpcid_gva

A flaw was found in KVM. With shadow paging enabled if INVPCID is executed with CR0.PG=0, the invlpg callback is not set, and the result is a NULL pointer dereference. This flaw allows a guest user to cause a kernel oops condition on the host, resulting in a denial of service...

CVE-2024-39483 KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked When requesting an NMI window, WARN on vNMI support being enabled if and only if NMIs are actually masked, i.e. if the vCPU is already handling an NMI. KVM's ABI fo...

SQLite before 3.25.3 when the FTS3 extension is enabled encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

...

SQLite before 3.25.3 when the FTS3 extension is enabled encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases) aka Magellan.

...