Digium Asterisk app_minivm Caller-ID Command Execution (CVE-2017-14100)

A command execution vulnerability exists in Digium Asterisk. The vulnerability is due to insufficient validation of Caller-IDs within SIP requests when the MinivmNotify dialplan function is used with an external notification program. A remote, authenticated attacker could exploit this vulnerabili...

Digium Asterisk non-SIP URIs Denial-of-Service (CVE-2017-14098)

A denial-of-service vulnerability exists in Digium Asterisk. The vulnerability is due to improper handling of non-SIP URIs within the sanitizetdata function. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted SIP packets to an Asterisk server...

Mr.SIP - SIP-Based Audit and Attack Tool

Mr.SIP is a tool developed to audit and simulate SIP-based attacks. Originally it was developed to be used in academic work to help developing novel SIP-based DDoS attacks and defense approaches and then as an idea to convert it to a fully functional SIP-based penetration testing tool, it has bee...

SIP Based Audit and Attack Tool: Mr. SIP

Mr.SIP is a tool developed to audit and simulate SIP-based attacks. Originally it was developed to be used in academic work to help developing novel SIP-based DDoS attacks and defense approaches and then as an idea to convert it to a fully functional SIP-based penetration testing tool, it has bee...

Asterisk 11.x < 11.25.2 / 11.6 < 11.6-cert17 / 13.x < 13.17.1 / 14.x < 14.6.1 / 13.13 < 13.13-cert5 Multiple Vulnerabilities (AST-2017-005 - AST-2017-007)

According to its SIP banner, the version of Asterisk running on the remote host is 11.x prior to 11.25.2, 13.x prior to 13.17.1, 14.x prior to 14.6.1, 11.6 prior to 11.6-cert17, or 13.13 prior to 13.13-cert5. It is therefore, affected by multiple vulnerabilities as described in AST-2017-005,...

The vulnerability of the SIP component of the Android operating system from the CAF repository, which allows a attacker to trigger buffer overflows.

The vulnerability of the SIP component of the Android operating system from the CAF repository is related to shortcomings in string processing the absence of a zero-terminated string. Exploiting this vulnerability can allow an attacker, acting remotely, to cause buffer overflows...

CVE-2015-9034

In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow...

Buffer overflow

In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow...

CVE-2015-9034

In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow...

CVE-2015-9034

Summary: CVE-2015-9034 is a buffer overflow in Qualcomm closed-source components used in Android CAF builds with the Linux kernel, caused by a SIP string not being null-terminated. This vulnerability affects Qualcomm components in Android and has a CVSS v3 base score of 9.8 (CRITICAL) with networ...

CVE-2017-6790

A vulnerability in the Session Initiation Protocol SIP on the Cisco TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the targeted appliance. The vulnerability is due to excessive SIP traffic sent to the devic...

CVE-2017-6790

Cisco TelePresence Video Communication Server (VCS) is affected by CVE-2017-6790 due to improper handling of SIP traffic. An unauthenticated remote attacker can send large volumes of SIP traffic to the VCS, potentially causing a complete DoS condition on the targeted system. The root cause is exc...

CVE-2017-6790

A vulnerability in the Session Initiation Protocol SIP on the Cisco TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the targeted appliance. The vulnerability is due to excessive SIP traffic sent to the devic...

Cisco TelePresence Video Communication Server Denial of Service Vulnerability

A vulnerability in the Session Initiation Protocol SIP on the Cisco TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the targeted appliance. The vulnerability is due to excessive SIP traffic sent to the devic...

CVE-2017-10677

Cross-Site Request Forgery CSRF exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to disable SIP...

CVE-2017-10677

Cross-Site Request Forgery CSRF exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to disable SIP...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to disable SIP...

CVE-2017-10677

CVE-2017-10677 affects Cisco Linksys EA4500 routers running firmware earlier than 2.1.41.164606. The vulnerability is a cross-site request forgery (CSRF) in the web interface, demonstrated via a request to apply.cgi to disable SIP. Affected component: apply.cgi on the EA4500’s web admin. Conseque...

CVE-2017-10677

Cross-Site Request Forgery CSRF exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to disable SIP...

CVE-2017-9861

An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to replay attacks, packet injection attacks, and man in the middle attacks. An attacker is able to successfully use SIP to communicate with the...