946 matches found
Software Defined Radio Attack Tool: RFCrack
RFCrack is my personal RF test bench, it was developed for testing RF communications between any physical device that communicates over sub Ghz frequencies. IoT devices, Cars, Alarm Systems etc… Testing was done with the Yardstick One on OSX, but RFCrack should work fine in linux. Current support...
“Storage connection failure” alarm during the backup jobs with storage integration activity.
Challenge The alarm " Storage connection failure" is displayed in Veeam ONE when performing either of the following activities in Veeam Backup & Replication: Backup from Storage Snapshots Restore from Storage Snapshots While both Backup from Storage Snapshots and Restore from Storage Snapshots bo...
openstack-aodh: Aodh can be used to launder Keystone trusts
A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious us...
Moderate: Red Hat Security Advisory: openstack-aodh security update
An update for openstack-aodh is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
The vulnerability in the Vivint Sky Control Panel web application lies in the lack of authentication for critical functions. This allows a malicious individual to activate or deactivate the security system and alter other security settings.
The vulnerability of the Vivint Sky Control Panel web application is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to enable and disable the alarm system and modify other security settings via the web interface the default por...
Debian DSA-3953-1 : aodh - security update
Zane Bitter from Red Hat discovered a vulnerability in Aodh, the alarm engine for OpenStack. Aodh does not verify that the user creating the alarm is the trustor or has the same rights as the trustor, nor that the trust is for the same project as the alarm. The bug allows that an authenticated us...
DEBIAN-CVE-2017-12440
Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...
CVE-2017-12440
Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...
UBUNTU-CVE-2017-12440
Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...
CVE-2017-12440
Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...
iSmartAlarm CubeOne Remote Command Execution
Credits: Ilia Shnaidman + @0x496c on Twitter + Source: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/ Vendor: ============= iSmartAlarm, inc. Product: =========================== iSmartAlarm cube - All iSmartAlarm is one of the...
openSUSE Security Update : the Linux Kernel (openSUSE-2017-716) (Stack Clash)
The openSUSE Leap 42.2 kernel was updated to 4.4.72 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be...
Importing Veeam ONE Monitor alarms
Challenge You need to import all alarms with their default values into Veeam ONE Monitor. Solution 1. Obtain the full list of alarms for version 9.0 here or for version 9.5 here. 2. Open Veeam ONE Monitor and navigate to the Alarm Management node. 3. Right-click on the container you wish to impor...
Arbitrary File Upload Vulnerability in Dahua Alarm Operation and Management Platform Devices
Dahua Alarm Center Management Platform is a comprehensive system solution centered on alarm reception and processing. Arbitrary file upload vulnerability exists in the device/emap/gis/bitmap/modify.jsp page of Dahua alarm operation and management platform. It allows an attacker to upload a webshe...
SQL Injection Vulnerability in Multiple Parameters of Multiple Files of Dahua Alarm Operation and Management Platform Devices
Dahua Alarm Center Management Platform is a comprehensive system solution centered on alarm reception and processing. Dahua alarm operation and management platform equipment attachmentclearTempFile.action file of bean.recId parameter, attachmentgetAttList.action file of bean.recId parameter,...
Orphaned Snapshot Alarm - Change Suppression Settings
Challenge Correct over frequent triggering of Snapshot alarm Cause Depending on environment and when data is pulled alarm can trigger at non specified interval. Solution Within Monitor, go to the Alarm Management tab, and locate the 'Orphaned VM Backup Snapshot' alarm I just search 'orphaned in t...
Veeam ONE and Automation Services
Challenge The suggestions below leverage the functionality of Veeam ONE in order to automate some administration tasks. Cause To be able to use the steps below, make sure you are using Veeam Availability Suite 8 or newer version. Solution VM with no backup 1. Create VM backup alarm in Veeam ONE...
Android System Clock Alert Elimination Vulnerability
Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Consortium. A security vulnerability exists in the Android System Clock Alert. The vulnerability is caused by the system-level Intent mechanism "com.android.deskclock.ALARMDISMISS" in...
Unspecified Vulnerability in Vivint SkyControl Panel
Vivint SkyControl Panel is a control panel interface for centralized smart home management from Vivint USA. A security vulnerability exists in Vivint SkyControl Panel version 1.1.1.9926. A remote attacker can exploit the vulnerability to enable and disable the alarm system and change other securi...
