H3C NX15 Firmware Flaws Rated 9.9 Have Public Exploits; Exposure Remains Unclear

·1 views

Four vulnerabilities in H3C Magic NX15 firmware V100R017 were published between 19 and 20 October 2026. Two of them, CVE-2026-112370 and CVE-2026-112371, are scored 9.9 under CVSS 3.1 and involve command injection flaws, with public exploits already available. The vendor was contacted before the disclosure. Search-engine counts on 27 October 2026 showed about 888,990 H3C-fingerprinted assets, but these figures do not isolate the NX15 model, so its real-world exposure cannot be determined from public data.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

EPA Reportedly Quietly Removing Content From Its Online Archive

A Mother Jones article reports that the Environmental Protection Agency is quietly taking down material from its web archive. The piece is linked from a Hacker News discussion that drew a small amount of attention, with eight points and no comments at the time of capture. The source text provided is limited to the link and metadata, so specifics about which documents were removed, when, and why are not confirmed here. Readers should consult the original Mother Jones report for the reporting's details and sourcing.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

GitHub Expands Enterprise App Installations, Separating Admin Scope From Repository Access

GitHub made enterprise installations for its Apps generally available on October 23, adding broader support for administrative and governance automation. The update is a reminder that installing an app at one level does not automatically grant access to every project beneath it. According to GitHub's guide, enterprise installations cover enterprise-level operations only, while organization and repository resources need separate installations. Enterprise installations also do not currently receive webhooks for enterprise-level activity. The article argues that developers should map the required operations, target resources and permissions before expanding access to resolve errors.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to pull all of Amazon's 21,000 job listings through its public search API

Amazon hosts its own careers site, and its amazon.jobs search exposes a public JSON endpoint that needs no key or login. The article notes that the reported hits count caps at 10,000, so the true total of roughly 21,441 jobs must be read from facet counts instead. Requests with result_limit above 100 return nothing, and offsets past 10,000 return an error with null jobs, which can crash naive code. Splitting searches by category or country code keeps each query under the cap, with results joined on the stable id_icims field. Date parsing and location-filter quirks are also covered, along with a third-party scraper option.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Verifying an AI-Assisted Copy-on-Write Filesystem Through Device-Level Write Comparison

The author of a from-scratch copy-on-write filesystem called singlefs faces the challenge of proving its correctness, since its on-disk format is unique and AI-generated code outpaces human review. Because self-describing headers and a reverse index let each block identify its owner and generation, the design can check where data went, but per-block checks are slow and only verify results rather than the write process. To address this, the team boots a QEMU virtual machine with write-back caching and places a write-logging filter in front of each virtual disk to record every write and flush. The program's own recorder and the externally captured device log are compared, with the rule that the program's log must be an exact prefix of the disk's log and only flushes may follow. The author notes that a check which always passes would be worthless, so the comparison gate must also be shown capable of failing.

0 comments Read more at DEV Community