Stephen Fewer

يوجد خلل في آلية مصادقة الاقتران في عملية مصافحة اتصال التحكم يسمح لمهاجم عن بُعد غير مصرح له بتجاوز المصادقة والحصول على صلاحيات إدارية. تكمن المشكلة في فشل النظام في التحقق بشكل صحيح من الشهادات والرموز الواردة عند تعديل خيارات ترويسة معينة، وتحديداً داخل خدمة `vdaemon`. يمكن للمهاجم محاكاة وحدة تحكم شبكة مشروعة من خلال إنشاء اتصال DTLS باستخدام شهادة موقعة ذاتياً وإرسال طلبات مصممة خصيصاً إلى نقطة نهاية مصادقة الاقتران. يتيح الاستغلال الناجح للمهاجم تسجيل الدخول كحساب مستخدم داخلي بصلاحيات عالية (غير root)، مما يمنحه الوصول إلى NETCONF. يسمح هذا بالتلاعب ببنية SD-WAN بالكامل، بما في ذلك جداول التوجيه العالمية، ومسارات BGP، وقواعد جدار الحماية، وتوبولوجيا VPN. تم استغلال هذه الثغرة بنشاط من قبل جهات تهديد، بما في ذلك مجموعة ترعاها دولة تُعرف باسم UAT-8616، والتي استخدمتها لحقن مفاتيح SSH وتعديل التكوينات وتصعيد الصلاحيات إلى root.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة طابعات Brother MFC-L2710DW (لم يتم تحديد الإصدارات المتأثرة) الوصف يوجد عيب في البرنامج الثابت لطابعات Brother MFC-L2710DW يمكن أن يؤدي إلى الكشف عن معلومات تتعلق بالملفات والمجلدات. وقد يتيح الاستغلال الناجح لهذا العيب لمهاجم عن بُعد الوصول غير المصرح به إلى المعلومات المحمية. تتعلق هذه الثغرة الأمنية ببروتوكول «uscan» من مواصفات eSCL، مما قد يؤدي إلى الكشف عن الرقم التسلسلي للطابعة. التوصيات في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

تتعلق المشكلة بالتعقيم غير الملائم لصيغة الأقواس في دوال libpq في PostgreSQL، وتحديدًا `PQescapeLiteral()` و`PQescapeIdentifier()` و`PQescapeString()` و`PQescapeStringConn()`. وهذا يسمح لمصدر إدخال قاعدة البيانات بإجراء حقن SQL في أنماط استخدام معينة، لا سيما عندما يستخدم التطبيق ناتج الدالة لإنشاء مدخلات لـ `psql`، وهو المحطة الطرفية التفاعلية لـ PostgreSQL. وبالمثل، فإن المعالجة غير الملائمة لصيغة الأقواس في برامج الأوامر المساعدة لـ PostgreSQL تسمح لمصدر حجج سطر الأوامر بإجراء حقن SQL عندما تكون قيمة `client encoding` هي BIG5 وتكون قيمة `server encoding` واحدة من التالي: EUC TW أو MULE INTERNAL. تم استغلال هذه الثغرة الأمنية في هجمات حقيقية، بما في ذلك اختراق وزارة الخزانة الأمريكية، وتُعتبر ذات خطورة عالية.

An attacker who can execute arbitrary Operating Systems commands can bypass code signing enforcements in the kernel and execute arbitrary native code. The issue allows manipulation that leads to insufficient data authenticity verification.

Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An unauthenticated attacker can perform an out of bounds heap read in the IQ Service (TCP port 9876). This issue is related to a buffer overflow in the IQ service's memory, which can allow a remote attacker to elevate their privileges to the root level and gain full access to the device. The exploitation occurs through a TCP connection on port 9876. Recommendations: For versions prior to 2.800.0000000.8.R.20241111, update the firmware to version 2.800.0000000.8.R.20241111 to resolve the issue. As a temporary workaround, consider restricting access to the IQ Service on TCP port 9876 until the firmware update is applied.

Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An unauthenticated attacker can perform a null pointer dereference in the `DHIP Service` using the UDP port `37810`. This issue can potentially allow a remote attacker to elevate privileges to the root level and gain full access to the device. Recommendations: For versions prior to 2.800.0000000.8.R.20241111, update the firmware to version 2.800.0000000.8.R.20241111 to resolve the issue. As a temporary workaround, consider restricting access to the `DHIP Service` on UDP port `37810` until the update is applied.

Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An authenticated attacker can trigger a stack-based buffer overflow in the DHIP Service (TCP port 80). This issue allows a remote attacker to potentially execute arbitrary code. The vulnerability is related to the DHIP service and can be exploited through a connection on TCP port 80. Recommendations: For versions prior to 2.800.0000000.8.R.20241111, update the firmware to version 2.800.0000000.8.R.20241111 to resolve the issue. As a temporary workaround, consider restricting access to the DHIP service on TCP port 80 until the update is applied.

Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An unauthenticated attacker can trigger a stack-based buffer overflow in the DP Service (TCP port 3500). This issue can potentially allow a remote attacker to elevate their privileges to the root level and gain full access to the device. The vulnerability is related to a buffer overflow in the memory, which can be exploited by an attacker to gain control. Recommendations: For versions prior to 2.800.0000000.8.R.20241111, update the firmware to version 2.800.0000000.8.R.20241111 to resolve the issue. As a temporary workaround, consider restricting access to the DP Service on TCP port 3500 to minimize the risk of exploitation.

An OS command injection vulnerability exists in QNAP operating system versions due to the lack of neutralization of special elements used in the operating system command. This vulnerability could allow a remote attacker to execute arbitrary commands via a network. The issue is related to the quick.cgi file, which is used to configure uninitialized systems. There have been attempts to exploit this vulnerability, with code execution attempts targeting the '/cgi-bin/quick/quick.cgi' endpoint.

The issue allows an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). This is caused by a buffer overflow in the firmware loading module of the affected routers. Exploitation can occur through sending a specially crafted HTTP request.

The issue is related to a stack-based buffer overflow vulnerability and insufficient authorization in the web interface of the affected routers. This could allow a remote attacker to elevate privileges to the level of root, execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS).

The vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary commands using a specially crafted request. The issue could also allow an attacker to execute arbitrary code, elevate privileges, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS).

The issue is related to a buffer overflow due to the lack of validation of the length of user-supplied data when handling SOAP requests, specifically when parsing the `SOAPAction` header. This allows an attacker to execute arbitrary code in the context of root without requiring authentication. The vulnerability can be exploited by network-adjacent attackers.

The issue is related to the lack of protection for internal data in the browser, which can be exploited by a remote attacker to gain access to confidential information. In the context of Firefox, if a Sandbox content process is compromised, it can initiate an FTP download. The downloaded data can then be passed to the Chrome process with an arbitrary file length supplied by an attacker, bypassing sandbox protections and potentially allowing for a memory read of adjacent data from the privileged Chrome process, which may include sensitive data.

The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. The vulnerability is also described as a buffer data boundary operation issue, allowing a remote attacker to execute arbitrary code.

The issue is related to the destructor function for the WindowsDllDetourPatcher class, which can be exploited by malicious code to write arbitrary data to a controlled location in memory. This can bypass existing memory protections. The attack is limited to Windows operating systems. The vulnerability is associated with insufficient input validation in the destructor function of the WindowsDllDetourPatcher class in Firefox, Firefox ESR, and Thunderbird browsers, allowing a remote attacker to potentially elevate their privileges.

A directory traversal issue exists in the UploadServlet of the Remote Management component. This allows remote attackers to execute arbitrary code by sending a crafted zenworks-fileupload request. The request must include a specific directory name in the `type` parameter, a WAR filename in the `filename` parameter, and WAR content in the POST data.

The issue is related to incorrect access to objects in memory, which can cause a memory error and allow an attacker to execute arbitrary code in the context of the current user. This is a remote code execution issue.

The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted web site. This occurs because Internet Explorer improperly accesses objects in memory, potentially corrupting memory in a way that enables an attacker to execute arbitrary code in the context of the current user.

The issue is related to a use-after-free vulnerability that allows remote attackers to execute arbitrary code via a crafted web site, triggering access to a deleted object. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.