51 matches found
Updated minidlna packages fix security vulnerabilities
It was discovered that minidlna does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue CVE-2020-12695. Minidlna before versions 1.3.0 allows remote code execution...
Debian DLA-2489-1 : minidlna security update
It was discovered that missing input validation in minidlna, a lightweight DLNA/UPnP-AV server could result in the execution of arbitrary code. In addition minidlna was susceptible to the 'CallStranger' UPnP vulnerability. For Debian 9 stretch, these problems have been fixed in version...
[SECURITY] [DLA 2489-1] minidlna security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-2489-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz December 10, 2020 https://wiki.debian.org/LTS -...
Debian DSA-4806-1 : minidlna - security update
It was discovered that missing input validation in minidlna, a lightweight DLNA/UPnP-AV server could result in the execution of arbitrary code. In addition minidlna was susceptible to the'CallStranger' UPnP vulnerability. C Tenable Network Security, Inc. The descriptive text and package checks in...
Debian: Security Advisory (DSA-4806-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 4806-1] minidlna security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4806-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 07, 2020 https://www.debian.org/security/faq -...
EulerOS Virtualization 3.0.6.6 : wpa_supplicant (EulerOS-SA-2020-2477)
According to the version of the wpasupplicant package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request...
EulerOS 2.0 SP5 : wpa_supplicant (EulerOS-SA-2020-2276)
According to the version of the wpasupplicant package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a deliver...
Huawei EulerOS: Security Advisory for wpa_supplicant (EulerOS-SA-2020-2276)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS Virtualization for ARM 64 3.0.2.0 : wpa_supplicant (EulerOS-SA-2020-1981)
According to the version of the wpasupplicant package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a...
Exploit for Incorrect Default Permissions in Ui Unifi_Controller
This is a PoC exploit for CVE-2020-12695, a vulnerability in the CallStranger protocol. The exploit is implemented in Python and uses the upnpy library for UPnP communication. The script is designed to simulate data exfiltration, bypassing DLP Data Loss Prevention systems, and can also be used to...
Authorization Bypass
hostapd is vulnerable to authorization bypass. The vulnerability exists as the Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription...
WS-2020-0410
In OpenHome’s ohNet UPnP stack, versions jenkins-ohNet-Nightly-Publish-360 through ohNet1.30.3936 are vulnerable to the CallStranger vulnerability. An attacker can send a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, by...
Updated gssdp/gupnp packages fix security vulnerability
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. CVE-2020-12695...
MGASA-2020-0304 Updated gssdp/gupnp packages fix security vulnerability
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. CVE-2020-12695...
Security Advisory - CallStranger Vulnerability in UPnP Protocol
There is an vulnerability in UPnP protocol that does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, named CallStranger. The UPnP function of Huawei product is enabled only on the LAN side and ...
CVE-2020-12695
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. Mitigation To mitigate this flaw, close of...
ALPINE-CVE-2020-12695
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue...
DEBIAN-CVE-2020-12695
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue...
CVE-2020-12695
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue...