Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
805 results · page 5 of 17
Mar 17, 2025CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2025-29911 · Other software · nasa · reported by GitHubHigh 8.9
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_AOS_ProcessSecurity` function of CryptoLib versions 1.3.3 and prior. This vulnerability allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a maliciously crafted AOS frame with an insufficient length. The vulnerability lies in the function `Crypto_AOS_ProcessSecurity`, specifically during the processing of the Frame Error Control Field (FECF). The affected code attempts to read from the `p_ingest` buffer at indices `current_managed_parameters_struct.max_frame_size - 2` and `current_managed_parameters_struct.max_frame_size - 1` without verifying if `len_ingest` is sufficiently large. This leads to a heap buffer overflow when `len_ingest` is smaller than `max_frame_size`. As of time of publication, no known patched versions exist.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2025-29910 · Other software · nasa · reported by GitHubMedium 5.5
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A memory leak vulnerability was identified in the `crypto_handle_incrementing_nontransmitted_counter` function of CryptoLib versions 1.3.3 and prior. This vulnerability can lead to resource exhaustion and degraded system performance over time, particularly in long-running processes or systems processing large volumes of data. The vulnerability is present in the `crypto_handle_incrementing_nontransmitted_counter` function within `crypto_tc.c`. The function allocates memory using `malloc` without ensuring the allocated memory is always freed. This issue can lead to resource exhaustion, reduced system performance, and potentially a Denial of Service (DoS) in environments where CryptoLib is used in long-running processes or with large volumes of data. Any system using CryptoLib, especially those handling high-throughput or continuous data streams, could be impacted. As of time of publication, no known patched versions are available.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2025-29909 · Other software · nasa · reported by GitHubHigh 8.9
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, a heap buffer overflow vulnerability in CryptoLib's `Crypto_TC_ApplySecurity()` allows an attacker to craft a malicious TC frame that causes out-of-bounds memory writes. This can result in denial of service (DoS) or, under certain conditions, remote code execution (RCE). Any application or system that relies on CryptoLib for Telecommand (TC) processing and does not strictly validate incoming TC frames is at risk. This includes satellite ground stations or mission control software where attackers can inject malformed frames. A patch is available at commit c7e8a8745ff4b5e9bd7e500e91358e86d5abedcc.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Incorrect string encoding vulnerability in NASK - PIB BotSense allows injection of an additional field separator character or value in the content of some fieldCVE-2025-1774 · Other software · NASK - PIB · reported by cvd@cert.plMedium 6.3
Incorrect string encoding vulnerability in NASK - PIB BotSense allows injection of an additional field separator character or value in the content of some fields of the generated event. A field with additional field separator characters or values can be included in the "extraData" field.This issue affects BotSense in versions before 2.8.0.
- Product
- BotSense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2025CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.CVE-2025-30022 · Other software · Cmsol · reported by MITREMedium 6.8
CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.
- Product
- Auto Atendimento
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files.CVE-2025-26167 · Other software · reported by MITREHigh 7.5
Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function.CVE-2024-55272 · Other software · reported by MITREHigh 7.5
An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cellCVE-2024-55456 · Other software · Sammycage · reported by MITREMedium 6.5
lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell
- Product
- Lunasvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system levCVE-2025-0781 · Other software · FlightGear · reported by cve@gitlab.comHigh 8.6
An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level.
- Product
- SimGear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.CVE-2024-57724 · Other software · Sammycage · reported by MITREMedium 6.5
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.
- Product
- Lunasvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.CVE-2024-57723 · Other software · Sammycage · reported by MITREMedium 6.5
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.
- Product
- Lunasvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create.CVE-2024-57722 · Other software · Sammycage · reported by MITREHigh 7.5
lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create.
- Product
- Lunasvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.CVE-2024-57721 · Other software · Sammycage · reported by MITREMedium 6.5
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.
- Product
- Lunasvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.CVE-2024-57720 · Other software · Sammycage · reported by MITREMedium 6.5
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.
- Product
- Lunasvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0.CVE-2024-57719 · Other software · Sammycage · reported by MITREMedium 6.5
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0.
- Product
- Lunasvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.CVE-2024-24429 · Other software · Open5gs · reported by MITREHigh 8.6
A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.
- Product
- Open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025A reachable assertion in the ogs_kdf_hash_mme function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.CVE-2024-24432 · Other software · Open5gs · reported by MITREMedium 5.3
A reachable assertion in the ogs_kdf_hash_mme function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
- Product
- Open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025A reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.CVE-2024-24430 · Other software · Open5gs · reported by MITREHigh 7.5
A reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
- Product
- Open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcellularsecurity.orgcellularsecurity.org
Jan 22, 2025Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler.CVE-2023-37023 · Other software · Open5gs · reported by MITREHigh 8.6
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. A packet missing its `MME_UE_S1AP_ID` field causes Open5gs to crash; an attacker may repeatedly send such packets to cause denial of service.
- Product
- Open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025A reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.CVE-2024-24428 · Other software · Open5gs · reported by MITREHigh 7.5
A reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.
- Product
- Open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025A reachable assertion in the amf_ue_set_suci function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.CVE-2024-24427 · Other software · Open5gs · reported by MITREHigh 7.5
A reachable assertion in the amf_ue_set_suci function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
- Product
- Open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to executCVE-2024-24421 · Computers, phones & browsers · Linuxfoundation · reported by MITRECritical 9.8
A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via a crafted NAS packet.
- Product
- Magma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) are susceptible to an assertion-based crash when an oversized NAS packetCVE-2023-37029 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) are susceptible to an assertion-based crash when an oversized NAS packet is received. An attacker may leverage this behavior to repeatedly crash the MME via either a compromised base station or via an unauthenticated cellphone within range of a base station managed by the MME, causing a denial of service.
- Product
- Magma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39795 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the `ftp_max_sessions` POST parameter.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39794 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the `ftp_port` POST parameter.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39793 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the `ftp_name` POST parameter.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39790 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists within the `ftp_max_sessions` POST parameter.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39789 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists within the `ftp_port` POST parameter.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39788 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists within the `ftp_name` POST parameter.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39787 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A directory traversal vulnerability exists within the `disk_part` POST parameter.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39786 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A directory traversal vulnerability exists within the `adddir_name` POST parameter.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39785 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the adddir_name POST parameter.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39784 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the disk_part POST parameter.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39602 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39360 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 14, 2025An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39280 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Wavlink AC3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 30, 2024iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability.CVE-2024-11946 · Other software · iXsystems · reported by zdi-disclosures@trendmicro.comMedium 6.5
iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the use of an insecure protocol to deliver updates. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-25668.
- Product
- TrueNAS CORE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtruenas.comzerodayinitiative.com
Dec 30, 2024iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability.CVE-2024-11944 · Other software · iXsystems · reported by zdi-disclosures@trendmicro.comHigh 8.8
iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tarfile.extractall method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-25626.
- Product
- TrueNAS CORE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtruenas.comzerodayinitiative.com
Dec 19, 2024An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message.CVE-2024-54984 · Other software · reported by MITRECritical 9.8
An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message. NOTE: this is disputed by the supplier.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message.CVE-2024-54983 · Other software · reported by MITRECritical 9.8
An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024An issue in Quectel BC25 with firmware version BC25PAR01A06 allows attackers to bypass authentication via a crafted NAS message.CVE-2024-54982 · Other software · reported by MITRE
An issue in Quectel BC25 with firmware version BC25PAR01A06 allows attackers to bypass authentication via a crafted NAS message. NOTE: Quectel disputes this because the issue is in the chipset supply chain and is not localized to one or more Quectel products.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN).CVE-2024-54130 · Other software · nasa-jpl · reported by GitHubCritical 9.2
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A segmentation fault occurs with ION-DTN BPv7 software version 4.1.3 when a bundle with a Destination Endpoint ID (EID) set to dtn:none is received. This causes the node to become unresponsive to incoming bundles, leading to a Denial of Service (DoS) condition. This vulnerability is fixed in 4.1.3s.
- Product
- ION-DTN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN).CVE-2024-54129 · Other software · nasa-jpl · reported by GitHubCritical 9.2
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A vulnerability exists in the version ION-DTN BPv7 implementation version 4.1.3 when receiving a bundle with an improper reference to the imc scheme with valid Service-Specific Part (SSP) in their Previous Node Block. The vulnerability can cause ION to become unresponsive. This vulnerability is fixed in 4.1.3s.
- Product
- ION-DTN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A reachable assertion in the ogs_nas_emm_decode function of Open5GS v2.7.0 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet with a zCVE-2024-24431 · Other software · open5gs · reported by MITREHigh 7.5
A reachable assertion in the ogs_nas_emm_decode function of Open5GS v2.7.0 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet with a zero-length EMM message length.
- Product
- open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcellularsecurity.orgopen5gs.org
Nov 15, 2024An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoCVE-2024-24449 · Other software · openairinterface · reported by MITREMedium 6.5
An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted InitialUEMessage message sent to the AMF.
- Product
- cn5g_amf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcellularsecurity.orgopenairinterface.org
Oct 22, 2024An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgCVE-2024-26519 · Other software · casa_systems · reported by MITRECritical 9
An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgi component.
- Product
- ntc-221_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TM subsystem (crypto_tm.c).CVE-2024-44912 · Other software · Nasa · reported by MITREHigh 7.5
NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TM subsystem (crypto_tm.c).
- Product
- Cryptolib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvisionspace.com
Sep 27, 2024NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TC subsystem (crypto_tc.c).CVE-2024-44911 · Other software · Nasa · reported by MITREHigh 7.5
NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TC subsystem (crypto_tc.c).
- Product
- Cryptolib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvisionspace.com
Sep 27, 2024NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the AOS subsystem (crypto_aos.c).CVE-2024-44910 · Other software · Nasa · reported by MITREHigh 7.5
NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the AOS subsystem (crypto_aos.c).
- Product
- Cryptolib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvisionspace.com
Sep 27, 2024In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic laptopCVE-2024-46859 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough. Not all panasonic laptops have this many SINF array entries, for example the Toughbook CF-18 model only has 10 SINF array entries. So it only supports the AC+DC brightness entries and mute. Check that the SINF array has a minimum size which covers all AC+DC brightness entries and refuse to load if the SINF array is smaller. For higher SINF indexes hide the sysfs attributes when the SINF array does not contain an entry for that attribute, avoiding show()/store() accessing the array out of bounds and add bounds checking to the probe() and resume() code accessing these.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.