SUSE SLES11 Security Update : openvpn (SUSE-SU-2017:1642-1)

This update for openvpn fixes the following issues : - It was possible to trigger an assertion by sending a malformed IPv6 packet. That issue could have been abused to remotely shutdown an openvpn server or client, if IPv6 and --mssfix were enabled and if the IPv6 networks used inside the VPN wer...

SUSE-SU-2017:1642-1 Security update for openvpn

This update for openvpn fixes the following issues: - It was possible to trigger an assertion by sending a malformed IPv6 packet. That issue could have been abused to remotely shutdown an openvpn server or client, if IPv6 and --mssfix were enabled and if the IPv6 networks used inside the VPN were...

Denial Of Service (DoS)

activemq-client is vulnerable to denial of service DoS attacks. The vulnerability is possible because it exposes a remote shutdown command in the ActiveMQConnection class, allowing the attacker to use it to launch the attack...

Debian DLA-913-1 : activemq security update

It was found that Apache ActiveMQ exposed a remote shutdown command in the ActiveMQConnection class. An attacker could use this flaw to achieve denial of service on a client. For Debian 7 'Wheezy', these problems have been fixed in version 5.6.0+dfsg-1+deb7u3. We recommend that you upgrade your...

[SECURITY] [DLA 913-1] activemq security update

Package : activemq Version : 5.6.0+dfsg-1+deb7u3 CVE ID : CVE-2015-7559 Debian Bug : 860866 It was found that Apache ActiveMQ exposed a remote shutdown command in the ActiveMQConnection class. An attacker could use this flaw to achieve denial of service on a client. For Debian 7 "Wheezy", these...

CVE-2015-7559

It was found that the Apache ActiveMQ client exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client...

ActiveMQ: DoS in client via shutdown command

It was found that the Apache ActiveMQ client exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client...

WinPower 4.9.0.4 - Local Privilege Escalation

WinPower 4.9.0.4 - Local Privilege Escalation // Exploit Title: WinPower V4.9.0.4 Privilege Escalation // Date: 29-11-2016 // Software Link: http://www.ups-software-download.com/ // Exploit Author: Kacper Szurek // Contact: http://twitter.com/KacperSzurek // Website: http://security.szurek.pl/ //...

WinPower 4.9.0.4 - Local Privilege Escalation

// Exploit Title: WinPower V4.9.0.4 Privilege Escalation // Date: 29-11-2016 // Software Link: http://www.ups-software-download.com/ // Exploit Author: Kacper Szurek // Contact: http://twitter.com/KacperSzurek // Website: http://security.szurek.pl/ // Category: local / 1. Description UPSmonitor...

Buffalo NAS Remote Shutdown

The Buffalo NAS device includes a web interface located at its IP address. A shutdown of the device can be initiated without confirmation by loading the endpoint /shutdown.html on this address. This shutdown powers off the device, requiring physical access to restart. The shutdown webpage has no...

EAP: missing authorization check for Monitor/Deployer/Auditor role when shutting down server

It was found that JBoss EAP did not properly authorize a user performing a shut down. A remote user with the Monitor, Deployer, or Auditor role could use this flaw to shut down the EAP server, which is an action restricted to admin users...

Western Digital My Cloud Command Injection

Exploit Title: Western Digital My Cloud Command Injection Vendor Homepage: http://www.wdc.com Firmware tested: 04.01.03-421 and 04.01.04-422 for the Personal Cloud devices Firmware link: http://download.wdc.com/nas/sq-040104-422-20150423.deb.zip Exploit Author: James Sibley absane ; twitter =...

Western Digital My Cloud 04.01.03-421, 04.01.04-422 - Command Injection Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Western Digital My Cloud Command Injection Vendor Homepage: http://www.wdc.com Firmware tested: 04.01.03-421 and 04.01.04-422 for the Personal Cloud devices Firmware link:...

Western Digital My Cloud 04.01.03-421/04.01.04-422 - Command Injection

Exploit Title: Western Digital My Cloud Command Injection Vendor Homepage: http://www.wdc.com Firmware tested: 04.01.03-421 and 04.01.04-422 for the Personal Cloud devices Firmware link: http://download.wdc.com/nas/sq-040104-422-20150423.deb.zip Exploit Author: James Sibley absane ; twitter =...

[SECURITY] [DSA 3330-1] activemq security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3330-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 07, 2015 https://www.debian.org/security/faq -...

DEBIAN-CVE-2014-3576

The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service shutdown via a shutdown command...

Apple iOS v8.0.2 - Silent Contact DoS Vulnerability

Document Title: =============== Apple iOS v8.0.2 - Silent Contact DoS Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1333 View: https://www.youtube.com/watch?v=drf0TpEoIl0 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1324 Release Date:...

Series of Vulnerabilities Found in Schneider Electric SCADA Products

UPDATE–There are several unpatched, remotely exploitable vulnerabilities in a number of Schneider Electric’s SCADA products, one of which could be used to perform a shutdown of the SCADA server. Another of the vulnerabilities is an authentication bypass that could give an attacker access to...

Thomson Cablemodem TCM315 Denial of Service

No description provided by source. source: http://www.securityfocus.com/bid/9091/info A problem has been identified in Thomson Cable Modems when handling long requests on the HTTP port. Because of this, it may be possible for an attacker to deny service to legitimate users of the device. / ADVISO...

Schneider Electric SCADA Expert ClearSCADA Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-14-259-01 Schneider Electric SCADA Expert ClearSCADA Vulnerabilities that was published September 16, 2014, on the NCCIC/ICS-CERT web site. Independent researcher Aditya Sood has identified a weak hashing algorithm...