29 matches found
CVE-2021-33959
CVE-2021-33959 可以看到，Plex 服务监听了 32410、32412、32413 和 32414 四个 udp 端口。通过分析攻击载荷，并参考设备查询请求的消息格式，我们编写软件向这些端口发送带有 M-SEARCH HTTP/1.1 攻击载荷的 udp 数据包，并抓包获取反射源 IP。最后，我们发现 32410 和 32414 都会响应。复现攻击如下图所示： 发送请求 echo "M-SEARCH HTTP/1.1" | nc -4u 32410 示例 受影响版本 plex media server - 1.21 之前 参考链接...
curl: PROTOCOL-LEVEL: Persistent UDP Amplification and Cache Poisoning via Alt-Svc Logic Flaw
Summary A structural logic flaw in the libcurl Alt-Svc header parser allows attack attributes specifically persist and max-age to "leak" from one service definition to another. We have successfully chained this logic bug with curl's HTTP/3 QUIC support to demonstrate a Persistent UDP Amplificatio...
EUVD-2018-7370
Malware in sbrugna...
EUVD-2025-3677
Malicious code in bioql PyPI...
EUVD-2022-3989
Malicious code in bioql PyPI...
CVE-2025-24356 UDP traffic amplification via fastd's fast reconnect feature
fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast...
BIT-JENKINS-2020-2100
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848...
CVE-2022-42982
BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long tens of kBs and can be requested with a packet of only 30 bytes. This presents a vector that can be used for UDP amplification attacks...
CVE-2022-42982
CVE-2022-42982 affects BKG Professional NtripCaster 2.0.39. The issue allows querying the NTRIP sourcetable over UDP without authentication, enabling a potential UDP amplification vector because the sourcetable is long yet can be retrieved with a small packet. Normally, UDP-only data is authentic...
Jenkins vulnerable to UDP amplification reflection attack
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier supports two network discovery services UDP multicast/broadcast and DNS multicast by default. The UDP multicast/broadcast service can be used in an amplification reflection attack, as very few bytes sent to the respective endpoint result in much...
Threat Actors Can Exploit Windows RDP Servers to Amplify DDoS Attacks
Cybercriminals can exploit Microsoft Remote Desktop Protocol RDP as a powerful tool to amplify distributed denial-of-service DDoS attacks, new research has found. Attackers can abuse RDP to launch UDP reflection/amplification attacks with an amplification ratio of 85.9:1, principal engineer Rolan...
Jenkins < 2.219, < 2.204.2 LTS Multiple Vulnerabilities - Linux
Jenkins is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2020-2100
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848...
FreeBSD : jenkins -- multiple vulnerabilities (a250539d-d1d4-4591-afd3-c8bdfac335d8)
Jenkins Security Advisory : DescriptionHigh SECURITY-1682 / CVE-2020-2099 Inbound TCP Agent Protocol/3 authentication bypass Medium SECURITY-1641 / CVE-2020-2100 Jenkins vulnerable to UDP amplification reflection attack Medium SECURITY-1659 / CVE-2020-2101 Non-constant time comparison of inbound...
CVE-2020-2100
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848...
CVE-2020-2100
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848...
Design/Logic Flaw
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848...
CVE-2020-2100
CVE-2020-2100 affects Jenkins <= 2.218 and LTS
CVE-2020-2100
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848...
Massive Gaming DDoS Exploits Widespread Technology
UPDATE Akamai Wednesday revealed that it’s witnessed the fourth-largest DDoS attack the company has ever encountered, leveraging a widespread and highly exploitable UDP amplification technique known as WS-Discovery WSD. WSD—a consumer device network discovery and connectivity technology—was seen...