CVE-2024-32883 MCUboot Injection attack of unprotected TLV values

MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV tag-length-value structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part...

CVE-2024-32883 MCUboot Injection attack of unprotected TLV values

MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV tag-length-value structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part...

CVE-2024-32883

MCUboot is affected by an issue where unprotected TLV entries can be injected into a signed image, because the protected/unprotected TLV distinction is not enforced. This can allow an attacker to influence dependency indications or boot records, potentially causing a processed image to be rejecte...

CVE-2024-32883 MCUboot Injection attack of unprotected TLV values

MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV tag-length-value structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part...

PT-2024-19509 · Setor Informatica · Setor Informatica Sistema Inteligente Para Laboratorios

Name of the Vulnerable Software and Affected Versions: Setor Informatica Sistema Inteligente para Laboratorios S.I.L. version 388 Description: The issue is related to a remote code execution RCE vulnerability. It can be triggered via a crafted POST request using the hmsg parameter. Recommendation...

PT-2024-19510 · Setor Informatica · Setor Informatica Sistema Inteligente Para Laboratorios

Name of the Vulnerable Software and Affected Versions: Setor Informatica Sistema Inteligente para Laboratorios S.I.L. version 388 Description: The issue is related to a remote code execution RCE vulnerability. It can be triggered via a crafted POST request to the hprinter parameter...

PT-2024-29942

Name of the Vulnerable Software and Affected Versions Tenda W9 version 1.0.0.74456 Description A critical vulnerability has been found in the function formwrlSSIDset of the file /goform/wifiSSIDset. The manipulation of the argument ssidIndex leads to a stack-based buffer overflow. It is possible ...

SUSE CVE-2024-32879

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed b...

CVE-2024-28241

The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which...

CVE-2024-28240

The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy ta...

CVE-2024-28241

The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which...

CVE-2024-28241 GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder

The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which...

CVE-2024-28240 GLPI-Agent's MSI package installation permits local users to change Agent configuration

The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy ta...

CVE-2024-28240

GLPI-Agent (Windows MSI install) is affected by CVE-2024-28240. A local user can cause denial of service by replacing the GLPI server URL or disabling the agent service, and if the Deploy task is installed, can trigger privilege escalation by configuring a malicious server with its own deploy tas...

PT-2024-22356 · Unknown +1 · Glpi Agent +1

Name of the Vulnerable Software and Affected Versions: GLPI Agent versions prior to 1.7.2 Description: A local user can modify the GLPI-Agent code or used DLLs to modify agent logic and potentially gain higher privileges. Recommendations: For versions prior to 1.7.2, upgrade to GLPI-Agent 1.7.2 t...

PT-2024-29496

Name of the Vulnerable Software and Affected Versions Tenda 4G300 version 1.01.42 Description A critical issue was found, affecting the function sub 422AA4. The manipulation of the argument year/month/day/hour/minute/second leads to a stack-based buffer overflow. This issue can be exploited...

PT-2024-24509 · Shenzhen Libituo Technology Co. · Lbt-T300-T400

Name of the Vulnerable Software and Affected Versions: Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 version 3.2 Description: A Buffer Overflow issue allows a local attacker to execute arbitrary code via the vpn client ip variable of the config vpn pptp function in the rc program. This enabl...

PT-2024-4001 · Portainer +1 · Portainer +1

Name of the Vulnerable Software and Affected Versions: Portainer versions prior to 2.20.0 Description: The issue is related to the use of open redirects in the Portainer container management platform. This could allow an attacker to redirect a user to an arbitrary site. The problem is associated...

PT-2024-29521 · Tenda · Tenda 4G300

Name of the Vulnerable Software and Affected Versions: Tenda 4G300 version 1.01.42 Description: A critical issue affects the function sub 429A30. The manipulation of the argument list1 leads to a stack-based buffer overflow. The attack may be initiated remotely. The vendor was contacted about thi...

PT-2024-5123 · Tenda · Tenda W30E

Name of the Vulnerable Software and Affected Versions: Tenda W30E versions 1.0 through 1.0.1.25 Description: A critical issue has been found in the function fromWizardHandle of the file /goform/WizardHandle, which is related to a stack-based buffer overflow. The manipulation of the argument PPW c...