‼ CVE-2023-25136 ‼
📖 Read
via "National Vulnerability Database".
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration; however, the vulnerability discoverer reports that "exploiting this vulnerability will not be easy."📖 Read
via "National Vulnerability Database".
🕴 MITRE Releases Tool to Design Cyber Resilient Systems 🕴
📖 Read
via "Dark Reading".
Engineers can use the Cyber Resiliency Engineering Framework Navigator to visuzalize their cyber resiliency capabilities.📖 Read
via "Dark Reading".
Dark Reading
MITRE Releases Tool to Design Cyber-Resilient Systems
Engineers can use the Cyber Resiliency Engineering Framework Navigator to visuzalize their cyber-resiliency capabilities.
🕴 How the Cloud Is Shifting CISO Priorities 🕴
📖 Read
via "Dark Reading".
The greatly expanding attack surface created by the cloud needs to be protected.📖 Read
via "Dark Reading".
Dark Reading
How the Cloud Is Shifting CISO Priorities
The greatly expanding attack surface created by the cloud needs to be protected.
🗓️ Serious security hole plugged in infosec tool binwalk 🗓️
📖 Read
via "The Daily Swig".
Path traversals could ‘void reverse engineering efforts and tamper with evidence collected’📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Serious security hole plugged in infosec tool binwalk
Path traversals could ‘void reverse engineering efforts and tamper with evidence collected’
‼ CVE-2023-24142 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24139 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24138 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24153 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24141 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24152 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24149 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24151 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24150 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24144 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24140 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24143 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24147 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24148 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34138 ‼
📖 Read
via "National Vulnerability Database".
Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24155 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24154 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW.📖 Read
via "National Vulnerability Database".