CVE-2015-0228

The luawebsocketread function in luarequest.c in the modlua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service child-process crash by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function...

CVE-2015-0228

The luawebsocketread function in luarequest.c in the modlua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service child-process crash by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function...

CVE-2015-0228

The luawebsocketread function in luarequest.c in the modlua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service child-process crash by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function...

CVE-2015-0228

The luawebsocketread function in luarequest.c in the modlua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service child-process crash by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function...

CVE-2015-0228: Improper Input Validation

The luawebsocketread function in luarequest.c in the modlua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service child-process crash by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function...

Insufficiently random session id in Java SockJS client

Session id generation in the Java SockJS client is not sufficiently secure and could allow a user to send messages to another user’s session. Note that this only affects users of the Java SockJS client, which generates its own session id. It does not affect browser clients even if they’re...

openSUSE Security Update : apache2 (openSUSE-2015-191)

apache2 was updated to fix one security issue. This security issue was fixed : - CVE-2015-0228: Modlua websocket DoS bnc918352. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2015-19...

netty: DoS via memory exhaustion during data aggregation

A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service...

netty: DoS via memory exhaustion during data aggregation

A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service...

CVE-2015-0228

The luawebsocketread function in luarequest.c in the modlua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service child-process crash by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function...

CVE-2015-1482

Ansible Tower aka Ansible UI before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to socket.io/1/...

Authentication flaw

Ansible Tower aka Ansible UI before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to socket.io/1/...

CVE-2015-1482

Ansible Tower (aka Ansible UI) before 2.0.5 is vulnerable to an authentication bypass via a websocket connection to socket.io/1/, enabling remote attackers to obtain sensitive information. Root cause: missing/weak auth on the Socket.IO endpoint. Affected product and version: Ansible Tower prior t...

CVE-2015-1482

Ansible Tower aka Ansible UI before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to socket.io/1/...

CVE-2015-1482: Exposure of Sensitive Information to an Unauthorized Actor

Ansible Tower aka Ansible UI before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to socket.io/1/...

PT-2015-1594

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.7 through 2.4.12 Description The issue is related to the lua websocket read function in the mod lua module, which allows remote attackers to cause a denial of service by sending a crafted WebSocket Ping frame...

PT-2015-5318

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 2.0.5 Description The issue allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to "socket.io/1/". Recommendations For versions prior to 2.0.5, update to...

Asterisk DoS

Crash on empty WebSocket frame. File descriptor leak on incompatible codecs...

Oracle Fusion Middleware Security Service Information Disclosure (January 2015 CPU) (BEAST)

The version of Oracle HTTP Server installed on the remote host is affected by an information disclosure vulnerability, known as BEAST, in the SSL 3.0 and TLS 1.0 protocols due to a flaw in the way the initialization vector IV is selected when operating in cipher-block chaining CBC modes. A...

[ MDVSA-2015:018 ] asterisk

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:018 http://www.mandriva.com/en/support/security/ Package : asterisk Date : January 8, 2015 Affected: Business Server 1.0 Problem Description: Updated asterisk packages fix security vulnerability: Double free...