Vulnerabilities

Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary file deletion and Elevation of Privileges.

A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could gain access and perform changes over resources exposed by the service such as configuration files where password hashes are saved or where network settings are stored.

A CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure can be triggered by leveraging a memory leak affecting the web server. A remote unauthenticated attacker can exploit this vulnerability in order to leak valid authentication tokens from the process memory associated to users currently logged to the system and bypass the authentication mechanism.

A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. Both the SHA-1 hash of the password as well as the session tokens are included as part of the URL and therefore exposed to information leakage scenarios. An attacker capable of accessing such values (e.g., victim browser, network traffic inspection) can exploit this vulnerability to leak both the password hash as well as session tokens and bypass the authentication mechanism using a pass-the-hash attack.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: avoid race between device unregistration and ethnl ops<br /> <br /> The following trace can be seen if a device is being unregistered while<br /> its number of channels are being modified.<br /> <br /> DEBUG_LOCKS_WARN_ON(lock-&gt;magic != lock)<br /> WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120<br /> CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771<br /> RIP: 0010:__mutex_lock+0xc8a/0x1120<br /> Call Trace:<br /> <br /> ethtool_check_max_channel+0x1ea/0x880<br /> ethnl_set_channels+0x3c3/0xb10<br /> ethnl_default_set_doit+0x306/0x650<br /> genl_family_rcv_msg_doit+0x1e3/0x2c0<br /> genl_rcv_msg+0x432/0x6f0<br /> netlink_rcv_skb+0x13d/0x3b0<br /> genl_rcv+0x28/0x40<br /> netlink_unicast+0x42e/0x720<br /> netlink_sendmsg+0x765/0xc20<br /> __sys_sendto+0x3ac/0x420<br /> __x64_sys_sendto+0xe0/0x1c0<br /> do_syscall_64+0x95/0x180<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> <br /> This is because unregister_netdevice_many_notify might run before the<br /> rtnl lock section of ethnl operations, eg. set_channels in the above<br /> example. In this example the rss lock would be destroyed by the device<br /> unregistration path before being used again, but in general running<br /> ethnl operations while dismantle has started is not a good idea.<br /> <br /> Fix this by denying any operation on devices being unregistered. A check<br /> was already there in ethnl_ops_begin, but not wide enough.<br /> <br /> Note that the same issue cannot be seen on the ioctl version<br /> (__dev_ethtool) because the device reference is retrieved from within<br /> the rtnl lock section there. Once dismantle started, the net device is<br /> unlisted and no reference will be found.

Cross-Site Request Forgery (CSRF) vulnerability in CompleteWebResources Page/Post Specific Social Share Buttons allows Stored XSS. This issue affects Page/Post Specific Social Share Buttons: from n/a through 2.1.

Cross-Site Request Forgery (CSRF) vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems allows Stored XSS. This issue affects TinyMCE Advanced qTranslate fix editor problems: from n/a through 1.0.0.

Cross-Site Request Forgery (CSRF) vulnerability in callmeforsox Post Thumbs allows Stored XSS. This issue affects Post Thumbs: from n/a through 1.5.

Cross-Site Request Forgery (CSRF) vulnerability in uamv Glance That allows Cross Site Request Forgery. This issue affects Glance That: from n/a through 4.9.

Cross-Site Request Forgery (CSRF) vulnerability in wibiya Wibiya Toolbar allows Cross Site Request Forgery. This issue affects Wibiya Toolbar: from n/a through 2.0.

Cross-Site Request Forgery (CSRF) vulnerability in jesseheap WP PHPList allows Cross Site Request Forgery. This issue affects WP PHPList: from n/a through 1.7.

Improper Neutralization of Input During Web Page Generation (&amp;#39;Cross-site Scripting&amp;#39;) vulnerability in Moch Amir Google Drive WP Media allows Stored XSS. This issue affects Google Drive WP Media: from n/a through 2.4.4.