Zuken Elmic KASAGO uses insufficient random values for TCP Initial Sequence Numbers

Overview Zuken Elmic KASAGO, TCP/IP protocol stack for embedded systems, uses its own random number generator function when generating TCP initial sequence numbers, which leads to use insufficient random values CWE-330. Zuken Elmic reported this vulnerability to JPCERT/CC to notify users of its...

PT-2023-34957 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.11 Description: The issue involves replacing 0/1 with false/true in BIC APIs. It is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack...

PT-2023-35014 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.9 Description: A potential buffer overflow issue exists in the rndis wlan component of the Linux Kernel. The issue is related to the rndis query oid function. This problem was introduced in version v2.6.35...

PT-2023-35137 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.91 Description: The issue is related to the i2c designware component in the Linux Kernel, where a potential overflow can occur due to incorrect clock multiplication. The actual impact and attack plausibili...

PT-2023-16052 · Pickplugins · Product Slider For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Product Slider for WooCommerce by PickPlugins WordPress plugin versions prior to 1.13.42 Description: The issue concerns a failure to validate and escape certain shortcode attributes, which could allow users with the contributor role and...

PT-2023-34797 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to a pci device refcount leak in the ixgbe module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2023-34816 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.15.22 through v5.15.89 Description: A race condition exists between quota rescan and disable, potentially leading to a NULL pointer dereference. The actual impact and attack plausibility have not yet been proven...

PT-2023-16362 · WordPress · Contentstudio

Name of the Vulnerable Software and Affected Versions: ContentStudio plugin for WordPress version 1.2.5 and earlier Description: The issue is related to an authorization bypass due to an unsecure token check that is susceptible to type juggling. This allows unauthenticated attackers to execute...

PT-2023-14422 · Riverbed · Riverbed Aternity

Name of the Vulnerable Software and Affected Versions: Riverbed Aternity versions prior to 12.1.4.27 Description: The issue is related to incorrect access control in the Aternity agent, allowing for local privilege escalation. There is an insufficiently protected handle to the A180AG.exe SYSTEM...

PT-2023-15337 · WordPress · Fluentauth

Name of the Vulnerable Software and Affected Versions: FluentAuth WordPress plugin versions prior to 1.0.2 Description: The issue allows an attacker to bypass IP-based blocks set by the plugin. This is possible because the plugin prioritizes getting a visitor's IP address from certain HTTP header...

PT-2023-4727 · Vim +5 · Vim +5

Name of the Vulnerable Software and Affected Versions: vim versions prior to 9.0.1331 Description: The issue is related to a heap-based buffer overflow in the vim text editor, specifically concerning the utfc ptr2len function, which can lead to an out-of-bounds operation in memory. Exploitation o...

PT-2023-33208 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.83 Description: The issue is related to a potential security problem in the xen-netfront component. It was introduced in version v2.6.24 and fixed in version v5.15.83. The actual impact and attack...

PT-2023-33152 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.12 Description: The issue is related to a NULL pointer dereference in the nilfs palloc commit free entry function. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

PT-2023-34729 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.337 Description: A memory leak issue exists in the ocfs2 stack glue init function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2023-34091 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.86 Description: The issue concerns a potential security problem in the baycom epp module of the Linux Kernel, specifically with the return type of the baycom send packet function. The actual impact and...

PT-2023-33127 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.13 Description: The issue is related to a race condition with cookie lru and use cookie. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior ...

PT-2023-33317 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.158 Description: A bounds check issue in the ASoC: ops for sx controls has been identified. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2023-33151 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.12 Description: The issue concerns the removal of used dynamic events, which may lead to security implications. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2023-14515 · Codelights · Sidebar Widgets

Name of the Vulnerable Software and Affected Versions: The Sidebar Widgets by CodeLights WordPress plugin versions 1.4 and earlier Description: The issue allows users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege use...

pgAdmin 4 vulnerable to open redirect

Overview pgAdmin 4 provided by pgAdmin Project contains an open redirect vulnerability CWE-601. SHIGA TAKUMA of BroadBand Security, Inc. and Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...