Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Nov 04

SEC Consult Vulnerability Lab Security Advisory < 20261104-0 >
=======================================================================
title: Improper device certificate validation enables AiTM attacks
product: Siemens SICAM Toolbox II device communication
vulnerable version: <V07.11
      fixed version: V07.11
         CVE number: CVE-2024-31853, CVE-2024-31854
           impact: High...

Posted by Daniel Owens via Fulldisclosure on Nov 04

The Apache Struts2 Tiles plugin version <=7.4.0 (and >=6.3.0) codebase includes a `ViewPreparer` construct, replete
with multiple ViewPreparer factories, that contains several important vulnerabilities including unsynchronised,
unbounded caches. The lack of proper synchronisation means that certain factories will create caches that race,
risking lost cache entries, corrupted internal bucket states under load (this can result in infinite...

Posted by Daniel Owens via Fulldisclosure on Nov 04

unixODBC versions <=2.3.14 contain a rude truncation of a 64-bit `SQLLEN` `buffer_length` to a 32-bit `int` without
verifying that it produces a valid, positive value. The result is later passed to `memcpy`, causing the information
system to crash or, if carefully chosen, enabling attackers to write adjacent memory under certain circumstances (e.g.,
a buffer length that wraps to a small positive integer or triggers an undersized allocation...

Posted by Daniel Owens via Fulldisclosure on Nov 04

The unixODBC driver manager library contains multiple races of importance / interest, including a set of data races in
the connection-pooling configuration state data that can cause one thread to read a half-written pool-size or timeout
value, which can lead to a variety of harmful effects, as well as a race between teardown and error-handling
functionality that can result in double-frees and use-after-frees. Other races exist within the...

Posted by Daniel Owens via Fulldisclosure on Nov 04

unixODBC versions 2.3.14 and below contain multiple heap buffer overflows, underflows, and over-reads. Attackers who
can influence various arguments passed thereto can trigger the heap-based buffer overflows inside of the unixODBC
driver manager itself, potentially corrupting the shared heap state across connections, crash the driver manager
(thereby causing denial of service conditions, multi-tenant data loss, and such related issues,...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
Apache Struts2 Core version 7.4.0 and below attempt to prevent arbitrary code execution via Object-Graph Navigation
Language (OGNL) through several different mechanisms but only in a cursory fashion -- the libraries only guard against
immediate calls evaluated by the OGNL engine via `SecurityMemberAccess`, but an allowed call that, instead, accepts
nested arguments and, itself, invokes reflection internally executes outside of the...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
The Apache Struts2 Core 7.4.0 and below performs session token comparisons cryptographically insecure early-exit
comparison functions (e.g., `!=`, `memcmp`, byte-by-byte loops with `break`) that return as soon as the first
mismatched byte is encountered. The execution time of the comparison is therefore proportional to the number of
leading bytes that match, creating a measurable timing side-channel. Importantly, this...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
The Apache Struts2 Spring Plugin opens a Spring `ApplicationContex` via a try-with-resources block and, outside of said
block, then continues to use the closed resource, resulting in an uncaught `IllegalStateException`. This particular
issue prevents proper functionality and indicates poor code quality and code review standards and processes, while not
being, itself, otherwise excessively meaningful for a production environment...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
Apache Struts2 Core version 7.4.0 and below fails to properly prevent integer overflows, causing wrap-arounds and other
issues on a downstream forced casting into types smaller than `BigInteger`. Importantly, this finding underscores why
all applications using Struts and other such platforms should perform their own input validation checks and not blindly
assume that the upstream Struts2 code has done as such, but the finding also...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
Apache Struts2 Core version 7.4.0 and below's `FetchMetadataInterceptor`, `CoepInterceptor`, and `CoopInterceptor` each
compare their `exemptedPaths` configuration -- a per-interceptor-reference, administrator-supplied set of paths
intended to exempt specific actions from the corresponding cross-origin protection -- against
`HttpServletRequest.getContextPath()`. `getContextPath()` is fixed for the entire deployed web...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
The Apache Struts2 REST Plugin's (version 7.4.0 and below) `ContentTypeInterceptor.intercept(ActionInvocation)` only
deserialises a request body and enforces the `struts.rest.content.maxLength` bound when
`HttpServletRequest#getContentLength()` returns a positive value. `getContentLength()` returns `-1` whenever the
`Content-Length` header is absent, which normal and appropriate for any Hypertext Transfer Protocol (HTTP)...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
The Apache Struts2 REST Plugin's `DefaultContentTypeHandlerManager.getHandlerForResponse(HttpServletRequest,
HttpServletResponse)` splits the `Accept` header on commas and passes each resulting token directly to
`findHandler(String)` without trimming leading or trailing whitespace. `findHandler(String)` only retries a trimmed
lookup when a token contains a semicolon (`;`), so a token that merely carries a leading space has no...

Posted by Daniel Owens via Fulldisclosure on Nov 01

As of the current versions of the Apache Struts2 JSON Plugin (e.g., version 7.4.0 and the 7.5.0 snapshot dated 28
October 2026), attackers can bypass the element-count limit purported to protect Object deserialisation added to said
code as part of the WW-5618 and S2-072 "hardening controls". Please note that this vulnerability and the attack string
is different than the previously reported bypass against the JSON array...

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in NETGEAR
RAX120 (Nighthawk AX12) firmware V1.2.5.18, the WiFi 6 consumer router from
NETGEAR (United States), built on the Qualcomm IPQ8074 platform. The
administrative web plane of this firmware generation is a lighttpd server
fronting the vendor's DNI-framework CGI handler /usr/sbin/net-cgi (an
aarch64, musl, stripped image; the handler binary measures 1,042,120 bytes
and...

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in the
Raritan PX3 PDU G4, firmware version 4.3.14, the intelligent rack power
distribution unit from Raritan, a Legrand company (United States). A
low-privilege authenticated session converts one diagnostics request into
operating-system command execution in the product's web-service context,
because the hostname validation that is supposed to gate the ping and
traceroute...

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in NUUO
Crystal Server 3.19.0.85, the video management and NVR server software from
NUUO Inc. of Taipei (Taiwan), distributed as the Crystal virtual-machine
appliance: an Ubuntu-based OVA whose web tier is a lighttpd server fronting
a PHP application, with .php requests dispatched to /usr/bin/php-cgi through
lighttpd's fastcgi mapping. The product sits in the management plane...

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa
MAR-2000 series industrial 4G/LTE cellular router, firmware image
FWR_MAR2000_V1.0_Build_15010909, from Moxa Inc. (Taiwan). An authenticated
administrator converts one saved monitoring-condition field into recurring,
product-scheduled arbitrary command execution, because the thread that
implements the scenario ping condition builds its command line from the...

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa
MAR-2000 series industrial 4G/LTE cellular router, firmware image
FWR_MAR2000_V1.0_Build_15010909, from Moxa Inc. (Taiwan). An authenticated
administrator converts one stored VPN address field into arbitrary command
execution as the identity of the product's model process, because the IPsec
model manages the tunnel's addresses and routes by interpolating...

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa
MAR-2000 series industrial 4G/LTE cellular router, firmware image
FWR_MAR2000_V1.0_Build_15010909, from Moxa Inc. (Taiwan). An authenticated
administrator converts one stored configuration field into arbitrary command
execution as the identity of the product's model process, because the
Executer model builds the launch command of an operator program as a shell...

Posted by fulldisclosure on Oct 28

Am 21.10.26 um 07:23 schrieb jose:

that is the CVE for the OOM RCE vulnerability in fpm and mod_php. Sure
you got the right on?

Best regards,
Marius