- ZDI-24-297: Linux Kernel nft_exthdr_sctp_eval Stack-based Buffer Overflow Information Disclosure Vulnerability
- ZDI-24-298: Linux Kernel nft_exthdr_tcp_eval Stack-based Buffer Overflow Information Disclosure Vulnerability
- ZDI-24-299: Linux Kernel nft_exthdr_ipv6_eval Stack-based Buffer Overflow Information Disclosure Vulnerability
Big changes in my home server
For a long time I was using Proxmox as my server OS. On it I had few VMs. One with Arch Linux (I’m using it as my daily OS through RDP), another one with Home Assistant, another one for media (Jellyfin app, Calibre, etc). And some created ad-hoc when needed for testing. But from some time I was thinking about big change. And finally it happened during this week.
Read more Big changes in my home server
Multiple advisories in March 2024 release of the Cisco IOS XR Software Security Advisory Bundled Publication
- Cisco IOS XR Software SSH Privilege Escalation Vulnerability (Security Impact Rating: High)
- Cisco IOS XR Software DHCP Version 4 Server Denial of Service Vulnerability (Security Impact Rating: Medium)
- Cisco IOS XR Software SNMP Management Plane Protection ACL Bypass Vulnerability (Security Impact Rating: Medium)
- Cisco IOS XR Software Layer 2 Services Denial of Service Vulnerability (Security Impact Rating: High)
- Cisco IOS XR Software MPLS and Pseudowire Interfaces Access Control List Bypass Vulnerabilities (Security Impact Rating: Medium)
- Cisco IOS XR Software Authenticated CLI Secure Copy Protocol and SFTP Denial of Service Vulnerability (Security Impact Rating: Medium)
- Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers PPPoE Denial of Service Vulnerability (Security Impact Rating: High)
cURL and libcurl Vulnerability Affecting Cisco Products: October 2023
On October 11, 2023, cURL released Version 8.4.0 of the cURL utility and the libcurl library. This release addressed two security vulnerabilities:
- CVE-2023-38545 – High Security Impact Rating (SIR)
- CVE-2023-38546 – Low SIR
This advisory covers CVE-2023-38545 only. For more information about this vulnerability, see the cURL advisory.
This advisory is available at the following link:
Security Impact Rating: High
CVE: CVE-2023-38545
Nice Linear eMerge E3-Series
1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available
- Vendor: Nice
- Equipment: Linear eMerge E3-Series
- Vulnerabilities: Path traversal, Cross-site scripting, OS command injection, Unrestricted Upload of File with Dangerous Type, Incorrect Authorization, Exposure of Sensitive Information to an Authorized Actor, Insufficiently Protected Credentials, Use of Hard-coded Credentials, Cross-site Request Forgery, Out-of-bounds Write