Cloudflare’s recent 502 Bad Gateway outage blamed on bad software

By Waqas If you are visiting a website and it is displaying “502 Bad Gateway” error it is not your fault but an issue with Cloudflare. Cloudflare, the world's largest "Content Delivery Network" CDN on the internet has suffered a service disruption causing “502 Bad Gateway” error on thousands of...

F5 Networks BIG-IP : F5 TMUI and iControl Rest vulnerability (K64855220)

High volume of malformed analytics report requests leads to instability in restjavad process. This causes issues with both iControl REST and some portions of TMUI. The attack requires an authenticated user with any role.CVE-2019-6634 Note: The No Access user role istechnicallya role, but a user...

Finding Beauty in the IT Architecture

I have a confession to make. I’m a sucker for good architecture. Visiting places like Singapore, London, Rome, Buenos Aires, and New York City, I quickly find myself gravitating towards beautiful archways, spires, and even the voids used in designing some of the world’s most amazing buildings. I...

Than Mirai botnet and BrickerBot more powerful IOT killer app still appeared. Behind the developer was actually a 14-year-old Sao years! - Vulnerability warning-the black bar safety net

! A new malicious program is through the destruction of the IOT device firmware and let them completely into“bricks”, which is similar in 2017, the destruction of millions of devices BrickerBot malicious programs. This malicious program is known as Silex, which by destroying the IOT devices of th...

The vulnerability of the h5ls content analysis program arises from buffer overflows during the processing of command-line parameters, allowing attackers to cause service interruptions.

The vulnerability of the h5ls content analysis program arises due to buffer overflows during the processing of command-line parameters. Exploiting this vulnerability can allow an attacker to cause a service failure by entering a specially crafted sequence of data in the command line...

The vulnerability of the virtio_pci_remove handler’s implementation in the Astra Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the virtiopciremove handler in the Astra Linux operating system’s kernel the loaded module drivers/virtio/virtiopci.ko is related to a memory release error. In the virtiopciprobe function, memory is allocated for vpdev, but the memory is not released in the virtiopciremove...

The vulnerability of the __GI_getenv function in the editing and Ogg-file checking software oggz allows a perpetrator to cause a service failure.

The vulnerability of the GIgetenv function name=0x7ffff7b94ac7 “TH”, name@entry=0x7ffff7b94ac5 “PATH” in the editing and checking tool for Ogg files from the oggz-tools package is related to buffer overflow vulnerabilities. Exploiting this vulnerability can allow an attacker to cause a service...

The vulnerability in the implementation of the ddb_open handler in the kernel of the Astra Linux operating system allows a hacker to cause a service failure.

The vulnerability in the implementation of the ddbopen handler in the kernel of the Astra Linux operating system the loaded module is drivers/media/pci/ddbridge/ddbridge.ko is related to a memory leak. In the ddbopen function, a call is made to the ddbsiminorinode array, which contains 32 element...

MSC800 affected by hard-coded credentials vulnerability

The ICS-CERT reported a security vulnerability that affects MSC800 versions before 4.0. The MSC800 uses hard-coded credentials, which potentially allow low-skilled remote attackers to reconfigure settings and /or disrupt the functionality of the device. Currently SICK is not aware of any public...

The vulnerability of the built-in software in Intel NUC Kits stems from insufficient input data validation. This allows attackers to gain access to protected information, cause system failures, or enhance their privileges.

The vulnerability of the built-in software in the Intel NUC Kit is related to insufficient testing of input data. Exploiting this vulnerability can allow attackers to access protected information, cause service failures, or increase their privileges...

The vulnerability of the microprogrammed logic controller Modicon, related to errors in buffer boundary control in memory, allows a intruder to cause a service failure.

The vulnerability of the microprogrammed programmable logic controller Modicon is related to errors in buffer boundary control in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially crafted Modbus packet...

The vulnerability of the FFmpeg multimedia library, related to overflow in dynamic memory buffers, allows attackers to cause a service failure or execute arbitrary code.

The vulnerability of the FFmpeg multimedia library is related to overflow of the dynamic memory buffer. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code using a specially crafted file or stream...

The vulnerability of the extract_status_code function in the Keepalived network traffic balancing system, which allows a attacker to cause a service failure

The vulnerability of the extractstatuscode function in the keepalived network traffic balancing system’s lib/html.c file is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the tftp_receive_packet function in the libcurl library, which relates to writing beyond the buffer boundary, allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the tftpreceivepacket function in the libcurl library is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the microprogrammed programmable logic controller Modicon, related to unprocessed exceptions, allows a intruder to trigger a service failure.

The vulnerability of the microprogrammed logic controller Modicon is related to unprocessed exceptions. Exploiting this vulnerability can allow a malicious actor to cause malfunctions by sending invalid parameters to the controller using the Modbus protocol...

Telegram messaging service hit by massive DDoS attack

By Waqas It is unclear why Telegram was targeted or who was behind the DDoS attack. The popular privacy-focused instant messaging application service Telegram has suffered a massive DDoS attack in which its service in the United States and several other countries has been disrupted, the company h...

Design/Logic Flaw

SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

CVE-2019-0314

SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

The vulnerability of DHCP and TFTP services provided by Cisco Small Business 300 Series router microprogramming systems allows a attacker to induce a service failure.

The vulnerability of DHCP and TFTP services provided by Cisco Small Business 300 Series routers is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted DHCP packets...

The vulnerability of the wpa_supplicant component of the EAP-PWD protocol in wireless communication devices certified by WPA allows attackers to compromise the integrity and confidentiality of data, as well as cause service failures. This vulnerability is related to incorrect authentication procedures.

The vulnerability of the wpasupplicant component of the EAP-PWD protocol in wireless communication devices certified for WPA is related to the failure of the EAP-PWD authentication process without obtaining a password. Exploiting this vulnerability allows an attacker to compromise the integrity a...