Security Vulnerabilities - CVEs Published In March 2024
Unitronics Unistream Unilogic – Versions prior to 1.35.227 -
CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device's Firmware
CVSS Score
7.5
EPSS Score
0.001
Published
2024-03-18
Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSetting function.
CVSS Score
9.8
EPSS Score
0.002
Published
2024-03-18
CWE-287: Improper Authentication may allow Authentication Bypass
CVSS Score
10.0
EPSS Score
0.001
Published
2024-03-18
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE
CVSS Score
9.8
EPSS Score
0.001
Published
2024-03-18
Unitronics Unistream Unilogic – Versions prior to 1.35.227 -
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices
CVSS Score
8.8
EPSS Score
0.001
Published
2024-03-18
Unitronics Unistream Unilogic – Versions prior to 1.35.227 -
CWE-23: Relative Path Traversal
CVSS Score
8.8
EPSS Score
0.001
Published
2024-03-18
Unitronics Unistream Unilogic – Versions prior to 1.35.227 -
CWE-22: 'Path Traversal' may allow RCE
CVSS Score
8.8
EPSS Score
0.002
Published
2024-03-18
A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.
CVSS Score
5.0
EPSS Score
0.0
Published
2024-03-18
Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the filePath parameter of formExpandDlnaFile function.
CVSS Score
4.3
EPSS Score
0.001
Published
2024-03-18
A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.
CVSS Score
7.5
EPSS Score
0.001
Published
2024-03-18