Threats tagged 'ghsa-v2w8-x348-r25p'

P-Net versions prior to 1.0.4 have a vulnerability where the Application Relationship of an RPC session is released improperly when a request fragment uses a different data representation (endianness) than the first fragment. This causes the application to not recognize that the Application Relationship has ended, leaving resources referencing cleared structures. An attacker with adjacent network access who has observed the connection's activity UUID, which is sent in cleartext in every RPC request, can connect in place of the original host using a single PDU.