VARIoT IoT vulnerabilities database

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. Synology DiskStation Manager (DSM) There is a vulnerability in the lack of encryption of critical data.Information may be obtained. Synology DiskStation Manager (DSM) is a product of China Taiwan (DSM) and others are products of China Taiwan Synology Technology (Synology) company. Synology DiskStation Manager is an operating system for network storage servers (NAS). HTTPS (Hypertext Transfer Protocol Secure, hypertext transfer security protocol) and so on are all products. HTTPS is a network security transmission protocol, and the Debian project apt, etc. are all products of the Debian project (Debian project) cooperative organization. apt is a command-line package manager

Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Synology DiskStation Manager (DSM) is an operating system for network storage servers (NAS) developed by Synology, Taiwan. The operating system can manage data, documents, photos, music and other information. Synology DiskStation Manager (DSM) versions prior to 6.2.3-25426-2 have a security vulnerability

On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length than the BIG-IP configuration would otherwise allow. BIG-IP Contains a cryptographic vulnerability.Information may be obtained. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. There is a security vulnerability in F5 BIG-IP. Attackers can exploit this vulnerability to bypass data access restrictions and obtain sensitive information through the small IPsec key length

Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation. Winston A device contains a vulnerability related to improper permission assignment for critical resources.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Winston Privacy is a kind of hardware VPN equipment of Winston Privacy Company of the United States. No detailed vulnerability details are currently provided

On versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, when a BIG-IP system that has a virtual server configured with an HTTP compression profile processes compressed HTTP message payloads that require deflation, a Slowloris-style attack can trigger an out-of-memory condition on the BIG-IP system. BIG-IP Contains an unspecified vulnerability.Denial of service (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. F5 BIG-IP has a security vulnerability that can be exploited by an attacker to create a memory leak through HTTP compressed configuration files to trigger a denial of service

On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handling MQTT traffic through a BIG-IP virtual server associated with an MQTT profile and an iRule performing manipulations on that traffic, TMM may produce a core file. plural BIG-IP The product contains unspecified vulnerabilities.Denial of service (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. There is a security vulnerability in F5 BIG-IP, which can be exploited by an attacker to trigger a fatal error through the MQTT iRule to trigger a denial of service

IBM Resilient SOAR V38.0 could allow an attacker on the internal net work to provide the server with a spoofed source IP address. IBM X-Force ID: 190567. IBM Resilient SOAR Contains a spoofing authentication evasion vulnerability. Vendor exploits this vulnerability IBM X-Force ID: 190567 It is published as.Information may be tampered with

On BIG-IP 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, Virtual servers with a OneConnect profile may incorrectly handle WebSockets related HTTP response headers, causing TMM to restart. BIG-IP Contains an unspecified vulnerability.Denial of service (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. F5 BIG-IP has a security vulnerability that can be exploited by an attacker to trigger a fatal error through the TMM OneConnect configuration file to trigger a denial of service

On BIG-IP AFM 15.1.0-15.1.0.5, the Traffic Management Microkernel (TMM) may produce a core file while processing layer 4 (L4) behavioral denial-of-service (DoS) traffic. BIG-IP AFM Contains an unspecified vulnerability.Denial of service (DoS) It may be put into a state. F5 BIG-IP AFM is an advanced firewall product used to protect against DDos attacks from F5 Corporation of the United States. There is a security vulnerability in F5 BIG-IP AFM, which can be exploited by an attacker to trigger a fatal error through L4 Behavioral behavior, thereby triggering a denial of service

Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to perform malicious actions in which the XSS popup will affect all privileged users. Genexis Platinum-4410 Contains a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. Genexis Platinum-4410 is a wireless router of British Genexis company. Genexis Platinum-4410 P4410-V2-1.28 has a cross-site scripting vulnerability

On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel (TMM) process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile. BIG-IP LTM Is vulnerable to a resource exhaustion.Denial of service (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. F5 BIG-IP LTM has a security vulnerability that can be exploited by an attacker to trigger an overload through client-side SSL profile authentication to trigger a denial of service

On BIG-IP APM 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when multiple HTTP requests from the same client to configured SAML Single Logout (SLO) URL are passing through a TCP Keep-Alive connection, traffic to TMM can be disrupted. BIG-IP APM Contains an unspecified vulnerability.Denial of service (DoS) It may be put into a state. F5 BIG-IP APM is a set of access and security solutions from F5 Corporation of the United States. The product provides unified access to business-critical applications and networks. A security vulnerability exists in F5 BIG-IP APM that could allow an attacker to trigger a denial of service by triggering a fatal error on a single logout

SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability. Successful exploitation could lead to remote code execution in the target system. SonicWall Global VPN client There is a vulnerability in an element of an uncontrolled search path.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. SonicWall Global VPN client is a Vpn software developed by SonicWall in the United States and used in conjunction with SonicWALL firewalls. The software enables remote employees and suppliers to access the company's network

SonicWall Global VPN client version 4.10.4.0314 and earlier allows unprivileged windows user to elevate privileges to SYSTEM through loaded process hijacking vulnerability. SonicWall Global VPN client Exists in an untrusted search path vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. SonicWall Global VPN client is a Vpn software developed by SonicWall in the United States and used in conjunction with SonicWALL firewalls. The software enables remote employees and suppliers to access the company's network

On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authenticated user with administrative privileges can specify a response page with any content, including JavaScript code that will be executed when preview is opened. F5 BIG-IP ASM is a Web Application Firewall (WAF) of F5 Corporation in the United States, which provides secure remote access, protects emails, simplifies Web access control, and enhances network and application performance

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Apple Music 3.4.0 for Android. A malicious application may be able to leak a user's credentials

Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to escalate privileges while restoring files in Anti-Ransomware. Check Point ZoneAlarm Contains an unspecified vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Check Point ZoneAlarm is a network firewall program of Israel Check Point Company

Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware. Check Point ZoneAlarm Contains an unspecified vulnerability.Information may be tampered with

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 6.1.2, iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra. Processing a maliciously crafted image may lead to arbitrary code execution. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple watchOS is a smart watch operating system. Apple iPadOS is an operating system for iPad tablets. The following products and versions are affected: watchOS earlier than 6.1.2, iOS earlier than 13.3.1 and iPadOS earlier than 13.3.1, tvOS earlier than 13.3.1, macOS Catalina earlier than 10.15.3

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra. An application may be able to execute arbitrary code with system privileges. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. Apple macOS Catalina versions prior to 10.15.3 have a security vulnerability that stems from a memory corruption issue that allows applications to execute arbitrary code with system privileges