CVE-2020-10137

CVE-2020-10137 affects Z-Wave devices built on Silicon Labs 700 series chips using S2. The root issue is inadequate authentication/encryption of FIND_NODE_IN_RANGE frames, enabling a remote, unauthenticated attacker to inject a frame with an invalid payload and cause a Denial of Service by blocki...

CVE-2020-10137

Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FINDNODEINRANGE frames, allowing a remote, unauthenticated attacker to inject a FINDNODEINRANGE frame with an invalid random payload, denying service by blocking the processing of upcoming...

Security Bulletin: Apache Log4j vulnerabilities impact z/Transaction Processing Facility (z/TPF) and TPF Operations Server (CVE-2021-45105, CVE-2021-45046)

Summary The Apache Log4j vulnerabilities affect the z/Transaction Processing Facility z/TPF system and TPF Operations Server. Several Java applications on the z/TPF system depend on Apache Log4j capabilities. Additionally, the 64-bit Java support in TPF Operations Server uses Apache Log4j...

CVE-2020-9061

CVE-2020-9061 affects Silicon Labs Z-Wave chipsets in 500 and 700 series (e.g., UZB-7 v7.00, ZooZ ZST10 v6.04, Aeon ZW090-A v3.95, Samsung STH-ETH-200 v6.04). The issue is a denial-of-service caused by malformed routing messages, enabling an attacker within Z-Wave radio range to disrupt devices. ...

CVE-2020-9061

Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon Labs ZW090-A version 3.95, and Samsung STH-ETH-200 version 6.04, are susceptible to denial of service via malformed routing messages...

CVE-2020-9060

Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource...

CVE-2020-9060

The CVE-2020-9060 entry concerns Silicon Labs 500-series Z-Wave chipsets using S2, with a denial-of-service/resource-exhaustion risk triggered by malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages. Concrete affected devices/versions from connected docs inclu...

CVE-2020-9059

CVE-2020-9059 affects Z-Wave devices built on Silicon Labs 500-series chipsets using S0 authentication. The root issue is uncontrolled resource consumption that can lead to battery exhaustion, with an example of Schlage BE468 (v3.42) failing open at low battery. Public sources describe multiple m...

CVE-2020-9059

Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leading to battery exhaustion. As an example, the Schlage BE468 version 3.42 door lock is vulnerable and fails open at a low battery level...

CVE-2020-9058

Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome DM501 version 4.26, and Jasco ZW4201 version 4.05, do not implement encryption or replay protection...

CVE-2020-9058

CVE-2020-9058 affects Z‑Wave devices based on Silicon Labs 500 series chipsets using CRC‑16 encapsulation and lacking encryption or replay protection. Concrete examples in the initial data include Linear LB60Z‑1 (v3.5), Dome DM501 (v4.26), and Jasco ZW4201 (v4.05). The root cause is absence of en...

CVE-2020-9057

CVE-2020-9057 covers Z-Wave devices using Silicon Labs 100/200/300 series chipsets that do not support encryption. The vulnerability stems from the Z-Wave specification for these legacy chips, allowing an attacker in radio range to take control of or cause a DoS, and to capture/replay traffic. Fi...

CVE-2020-9057

Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or cause a denial of service to a vulnerable device. An attacker can also capture and replay Z-Wave traffic. Firmware upgrades cannot direct...

Silicon Labs Z-Wave chipsets contain multiple vulnerabilities

Overview Various Silicon Labs Z-Wave chipsets do not support encryption, can be downgraded to not use weaker encryption, and are vulnerable to denial of service. Some of these vulnerabilities are inherent in Z-Wave protocol specifications. Description Z-Wave devices based on Silicon Labs chipsets...

PT-2022-9073 · Zooz +2 · Zooz Zst10 +4

Name of the Vulnerable Software and Affected Versions: ZooZ ZST10 version 6.04 ZooZ ZEN20 version 5.03 ZooZ ZEN25 version 5.03 Aeon Labs ZW090-A version 3.95 Fibaro FGWPB-111 version 4.3 Description: Z-Wave devices based on Silicon Labs 500 series chipsets using S2 are susceptible to denial of...

Important: Red Hat Security Advisory: security update of rh-sso-7/sso75 container images for IBM P/Z

A security update is now available for Red Hat Single Sign-On 7.5 container images for IBM P/Z. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Security Bulletin: The Apache Log4j (CVE-2021-44228) vulnerability affects z/TPF and TPF Operations Server

Summary The Apache Log4j vulnerability CVE-2021-44228 affects the z/Transaction Processing Facility z/TPF system and TPF Operations Server. Several Java applications on the z/TPF system depend on Apache Log4j capabilities. Additionally, the 64-bit Java support in TPF Operations Server uses Apache...

Security update for netdata (moderate)

openSUSE Security Update: Security update for netdata Announcement ID: openSUSE-SU-2021:1603-1 Rating: moderate References: 1139094 1139095 1139098 Cross-References: CVE-2018-18836 CVE-2018-18837 CVE-2018-18838 CVE-2018-18839 CVSS scores: CVE-2018-18836 NVD : 6.5...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/Transaction Processing Facility

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 that is used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-2341 DESCRIPTION: An unspecified vulnerability in Java SE related to the Networking component cou...

The vulnerability of the UNIX command shell Zsh operating systems and Mac OS allows attackers to compromise the integrity of protected information.

The vulnerability of the UNIX command shell Zsh operating systems and Mac OS lies in the improper assignment of permissions to files. Exploiting this vulnerability can allow an attacker to compromise the integrity of protected information...