CVE-2019-6260

The CVE-2019-6260 issue affects ASPEED AST2400/AST2500 Baseboard Management Controllers (BMCs). The hardware/firmware implements AHB bridges that allow arbitrary reads/writes to the BMC’s physical address space from the host (or network in some cases). Affected components include iLPC2AHB bridge ...

CVE-2019-6260

The ASPEED ast2400 and ast2500 Baseband Management Controller BMC hardware and firmware implement Advanced High-performance Bus AHB bridges, which allow arbitrary read and write access to the BMC's physical address space from the host or from the network in unusual cases where the BMC console uar...

Fedora 29 : mosquitto (2018-ff1fdf28aa)

Release 1.5.3 Security : - Fix CVE-2018-12543. If a message is sent to Mosquitto with a topic that begins with $, but is not $SYS, then an assert that should be unreachable is triggered and Mosquitto will exit. Broker : - Elevate log level to warning for situation when socket limit is hit. - Remo...

Tor Update Fixes ReachableAddresses Problem

The Tor Project on Wednesday updated its software package to version 0.2.8.7 and fixed a number of issues, including a bug it calls “important” in the ReachableAddresses option. ReachableAddresses is a list of IP addresses and ports that are permitted by a firewall; admins can set IP ranges and...

1944 Burning Bridges - Dangerous filesystem permissions, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application 1944 Burning Bridges published at the 'play' market has multiple vulnerabilities...

Flow Free: Bridges - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Flow Free: Bridges published at the 'play' market has multiple vulnerabilities...

Western Digital Self-Encrypting Drives Vulnerable

Some consumer-grade, self-encrypting external hard drives are littered with security vulnerabilities that render their encryption an afterthought. An academic paper published in late September took apart a number of drives manufactured by Western Digital that suffer from flaws that are trivial to...

Tor Cloud Shut Down Amid Lack of Support

The Tor Project has shuttered its cloud proxy service citing security vulnerabilities, usability bugs and a lack of resources. Tor offers its users the capacity to surf the Web anonymously, bouncing traffic through a series of relay servers so that no observer at any point can tell where that...

Ceragon Networks Microwave Bridges Root Password Discovered

The Department of Homeland security warned users of Ceragon Networks microwave bridges that the devices contain an undocumented root password. The advisory said Ceragon FibeAir IP-10 Microwave Bridges can be accessed remotely. “The root account can be accessed through ssh, telnet, command line...

CVE-2015-0924

Ceragon FibeAir IP-10 bridges expose a default root password that can be exploited by remote attackers to gain administrative access via HTTP, SSH, TELNET, or CLI sessions. The issue stems from an embedded default password in affected devices, with multiple sources noting the risk and the need to...

CVE-2015-0924

Ceragon FibeAir IP-10 bridges have a default password for the root account, which makes it easier for remote attackers to obtain access via a 1 HTTP, 2 SSH, 3 TELNET, or 4 CLI session...

CVE-2014-0592

Barclamp aka barclamp-network 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs...

Security Vulnerabilities in Apache Cordova / PhoneGap

The following email was sent to Apache Cordova/PhoneGap on 12/13/2013, and again on 1/17/2014. As there has been no response, we are re-posting it here to alert the general public of the inherent vulnerabilities in Apache Cordova/PhoneGap. Dear PhoneGap contributors, PhoneGap’s domain whitelistin...

[SECURITY] Fedora 16 Update: libupnp-1.6.18-1.fc16

The Universal Plug and Play UPnP SDK for Linux provides support for building UPnP-compliant control points, devices, and bridges on Linux...

[SECURITY] Fedora 18 Update: libupnp-1.6.18-1.fc18

The Universal Plug and Play UPnP SDK for Linux provides support for building UPnP-compliant control points, devices, and bridges on Linux...

Design/Logic Flaw

Untrusted search path vulnerability in InfoSphere Import Export Manager 8.1 through 9.1 in InfoSphere Information Server MetaBrokers & Bridges MBB in IBM InfoSphere Information Server 8.1, 8.5 before FP3, 8.7, and 9.1 allows local users to gain privileges via a Trojan horse DLL in the current...

Input validation

InfoSphere Import Export Manager in InfoSphere Information Server MetaBrokers & Bridges MBB in IBM InfoSphere Information Server 8.1, 8.5 before FP3, 8.7, and 9.1 does not validate unspecified input data, which allows remote authenticated users to execute arbitrary commands via unknown vectors...

CVE-2012-0705

CVE-2012-0705 affects IBM InfoSphere Information Server Import Export Manager (in the MBB/bridges component) across 8.1, 8.5 (pre-FP3), 8.7 and 9.1. Root cause: lack of input validation on unspecified data, enabling remote authenticated users to execute arbitrary commands via unknown vectors. Doc...

DEBIAN-CVE-2011-4894

Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections...

CVE-2011-2769

Affected software: Tor prior to 0.2.2.34. Issue: When Tor is configured as a bridge, it accepts CREATE and CREATE_FAST in a cell’s Command field within an OR connection it initiated, enabling remote relays to enumerate bridges. Impact: Bridge enumeration could reveal bridge presence to adversarie...