‼ CVE-2023-34971 ‼
📖 Read
via "National Vulnerability Database".
An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to decrypt the data using brute force attacks via unspecified vectors.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2425 build 20230609 and laterQTS 5.1.0.2444 build 20230629 and laterQTS 4.5.4.2467 build 20230718 and laterQuTS hero h5.1.0.2424 build 20230609 and laterQuTS hero h4.5.4.2476 build 20230728 and later📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46884 ‼
📖 Read
via "National Vulnerability Database".
A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time. This could have lead to memory corruption or a potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40706 ‼
📖 Read
via "National Vulnerability Database".
There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40707 ‼
📖 Read
via "National Vulnerability Database".
There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40708 ‼
📖 Read
via "National Vulnerability Database".
The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40710 ‼
📖 Read
via "National Vulnerability Database".
An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34972 ‼
📖 Read
via "National Vulnerability Database".
A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to read the contents of unexpected sensitive data via unspecified vectors.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2425 build 20230609 and laterQTS 5.1.0.2444 build 20230629 and laterQuTS hero h5.1.0.2424 build 20230609 and later📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40709 ‼
📖 Read
via "National Vulnerability Database".
An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b📖 Read
via "National Vulnerability Database".
🕴 Ransomware With an Identity Crisis Targets Small Businesses, Individuals 🕴
📖 Read
via "Dark Reading".
TZW is the latest version of Adhubllka, which has been active since 2019 but has gone largely unreported due to its lower ransom demands.📖 Read
via "Dark Reading".
Dark Reading
Ransomware With an Identity Crisis Targets Small Businesses, Individuals
TZW is the latest version of Adhubllka, which has been active since 2019 but has gone largely unreported due to its lower ransom demands.
⚠ S3 Ep149: How many cryptographers does it take to change a light bulb? ⚠
📖 Read
via "Naked Security".
Latest episode - listen now! Full transcript inside...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-40895 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4420 ‼
📖 Read
via "National Vulnerability Database".
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on the communication between the LMS5xx and the Client, and potentially manipulate the data being transmitted.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40899 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFilterCfg.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40893 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40900 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4419 ‼
📖 Read
via "National Vulnerability Database".
The LMS5xx uses hard-coded credentials, which potentially allow low-skilledunauthorized remote attackers to reconfigure settings and /or disrupt the functionality of the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40896 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40902 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40897 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter mac at /goform/GetParentControlInfo.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40894 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetStaticRouteCfg.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40892 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter schedStartTime and schedEndTime at /goform/openSchedWifi.📖 Read
via "National Vulnerability Database".