CWE-684

Routery FutureNet NXR firmy Century Systems Co., Ltd. nieprawidłowo aktywują REST-API pomimo jego wyłączenia w konfiguracji fabrycznej, gdy włączony jest serwer HTTP (GUI) lub uwierzytelnianie Web. Ponieważ konfiguracja fabryczna domyślnie włącza serwer HTTP, REST-API staje się dostępne z fabrycznymi, powszechnie znanymi danymi logowania, co naraża urządzenie na nieautoryzowany dostęp z sieci.

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts redeem scripts containing a disabled opcode followed by signature opcodes. In zebra-script/src/lib.rs, p2sh_input_sigop_count used the pure-Rust script::Code::sig_op_count path, whose try_fold parser stops at disabled opcodes such as OP_CODESEPARATOR and returns only the partial count accumulated before the error. The zcashd reference implementation continues static signature-operation counting through disabled opcodes, so an attacker can broadcast P2SH spends that Zebra counts below MAX_BLOCK_SIGOPS while zcashd counts above the 20,000-operation limit. If a Zebra miner includes those transactions, Zebra validators accept the block while zcashd validators reject it, creating a consensus chain split that affects network integrity and availability without requiring the attacker to produce a block. This issue is fixed in version 4.5.0.

Podatność w systemie MESbook 20221021.03 umożliwia nieuwierzytelnionemu atakującemu zdalne tworzenie nowych kont użytkowników bez żadnej autoryzacji. Jest to poważne zagrożenie, ponieważ pozwala na przejęcie kontroli nad procesem zarządzania tożsamością w systemie klasy MES.

Podatność w oprogramowaniu RUGGEDCOM ROS umożliwia przesyłanie nieautoryzowanych pakietów przez port mirror do monitorowanej sieci. Ze względu na brak uwierzytelnienia i sieciowy wektor ataku zagrożenie jest oceniane jako krytyczne (CVSS 9.1).

Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Config import, URI scheme handler, CLI --config modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files flutter/lib/common.Dart, hbb_common/src/config.Rs and program routines parseRustdeskUri(), importConfig(). This issue affects RustDesk Client: through 1.4.5.

Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Config string generation, web console export modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program routines Config export/generation routines. This issue affects RustDesk Server Pro: through 1.7.5.

In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.

app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.

An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands.

In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes. When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been established. Any alterations to the key length, via the "keylen" parameter or the IV length, via the "ivlen" parameter, within the OSSL_PARAM array will not take effect as intended, potentially causing truncation or overreading of these values. The following ciphers and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB. For the CCM, GCM and OCB cipher modes, truncation of the IV can result in loss of confidentiality. For example, when following NIST's SP 800-38D section 8.2.1 guidance for constructing a deterministic IV for AES in GCM mode, truncation of the counter portion could lead to IV reuse. Both truncations and overruns of the key and overruns of the IV will produce incorrect results and could, in some cases, trigger a memory exception. However, these issues are not currently assessed as security critical. Changing the key and/or IV lengths is not considered to be a common operation and the vulnerable API was recently introduced. Furthermore it is likely that application developers will have spotted this problem during testing since decryption would fail unless both peers in the communication were similarly vulnerable. For these reasons we expect the probability of an application being vulnerable to this to be quite low. However if an application is vulnerable then this issue is considered very serious. For these reasons we have assessed this issue as Moderate severity overall. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because the issue lies outside of the FIPS provider boundary. OpenSSL 3.1 and 3.0 are vulnerable to this issue.

A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System (NCS) platforms could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect classification of certain types of Ethernet frames that are received on an interface. An attacker could exploit this vulnerability by sending specific types of Ethernet frames to or through the affected device. A successful exploit could allow the attacker to cause control plane protocol relationships to fail, resulting in a DoS condition. For more information, see the section of this advisory. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation.

Apache Log4j Core w wersji 2.21.0 do 2.25.3 zawiera podatność Rfc5424Layout na log injection poprzez sekwencje CRLF spowodowaną niezatwierdzonymi zmianami nazw atrybutów konfiguracyjnych istotnych dla bezpieczeństwa. Atrybut newLineEscape został skrytnie zmieniony, co spowodowało, że escaping nowych linii przestał działać dla użytkowników TCP framing (RFC 6587), narażając ich na CRLF injection, a atrybut useTlsMessageFormat został zmieniony, powodując, że użytkownicy TLS framing (RFC 5425) zostali automatycznie obniżeni do niezaramowanego TCP (RFC 6587) bez escaping newline. Użytkownicy SyslogAppender nie są dotknięci, ponieważ jego atrybuty konfiguracyjne nie zostały zmienione.

W Exim przed wersją 4.99.2 z włączoną funkcją JSON lookup może dojść do out-of-bounds heap write, gdy operator JSON napotka nieprawidłowy JSON w niezaufanym nagłówku, ze względu na błędną implementację pomijania znaku \.

A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of service from guest to host via zero length descriptor.

Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011.

Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially obtain sensitive information via crafted network traffic. (Chromium security severity: Low)

W Exim przed wersją 4.99.2 na systemach używających musl libc (nie glibc) atakujący może spowodować awarię instancji połączenia w obecności zniekształconych danych DNS w rekordach PTR. Przyczyna to osobliwość funkcji dn_expand w druku ósemkowym.

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag.