Monthly
Predictable value generation in Citrix NetScaler ADC and Gateway (CWE-342) lets unauthenticated remote attackers predict subsequent values from previously observed ones, primarily compromising integrity and availability rather than confidentiality. The vendor rates this 8.8 (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, VC:L/VI:H/VA:H), while our independent assessment sees a 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) indicating a high attack complexity because exploitation typically requires harvesting at least one prior value. Affected versions are ADC before 14.1-73.37 and 13.1-64.23 (also 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) and Gateway before 14.1-73.37 and 13.1-64.23; vendor patches are available and no public exploit identified at time of analysis.
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable. No vendor patch available.
Predictable value generation in Citrix NetScaler ADC and Gateway (CWE-342) lets unauthenticated remote attackers predict subsequent values from previously observed ones, primarily compromising integrity and availability rather than confidentiality. The vendor rates this 8.8 (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, VC:L/VI:H/VA:H), while our independent assessment sees a 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) indicating a high attack complexity because exploitation typically requires harvesting at least one prior value. Affected versions are ADC before 14.1-73.37 and 13.1-64.23 (also 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) and Gateway before 14.1-73.37 and 13.1-64.23; vendor patches are available and no public exploit identified at time of analysis.
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable. No vendor patch available.