scalance_s615_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/scalance_s615_firmware/ Thu, 23 Feb 2023 14:07:26 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png scalance_s615_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/scalance_s615_firmware/ 32 32 CVE-2021-22924 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-22924/ Thu, 23 Feb 2023 14:07:26 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-22924/ libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take ‘issuercert’ into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, […]

The post CVE-2021-22924 appeared first on CVE Vulnerability.

]]> libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take ‘issuercert’ into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn’t include the ‘issuer cert’ which a transfer can setto qualify how to verify the server certificate.

The post CVE-2021-22924 appeared first on CVE Vulnerability.

]]> CVE-2022-46140 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-46140/ Thu, 23 Feb 2023 05:21:32 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-46140/ Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and retrieve debug information about the system.

The post CVE-2022-46140 appeared first on CVE Vulnerability.

]]> Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and retrieve debug information about the system.

The post CVE-2022-46140 appeared first on CVE Vulnerability.

]]> CVE-2022-46142 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-46142/ Thu, 23 Feb 2023 05:21:32 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-46142/ Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the CLI user passwords.

The post CVE-2022-46142 appeared first on CVE Vulnerability.

]]> Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the CLI user passwords.

The post CVE-2022-46142 appeared first on CVE Vulnerability.

]]> CVE-2022-46143 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-46143/ Thu, 23 Feb 2023 05:21:32 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-46143/ Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer that potentially contains previously allocated data.

The post CVE-2022-46143 appeared first on CVE Vulnerability.

]]> Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer that potentially contains previously allocated data.

The post CVE-2022-46143 appeared first on CVE Vulnerability.

]]>