Apache Traffic Server Remote Code Execution Vulnerability

Apache Traffic Server is the United States Apache Apache Software Foundation of an efficient , scalable HTTP proxy and caching server . A security vulnerability exists in the HTTP/2 experimental feature of Apache Traffic Server versions 5.3.x prior to 5.3.1. A remote attacker can exploit this...

[SECURITY] Fedora 26 Update: systemd-233-7.fc26

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

[SECURITY] Fedora 26 Update: glusterfs-3.10.6-4.fc26

GlusterFS is a distributed file-system capable of scaling to several petabytes. It aggregates various storage bricks over Infiniband RDMA or TCP/IP interconnect into one large parallel network file system. GlusterFS is one of the most sophisticated file systems in terms of features and...

USN-3471-1: Quagga vulnerabilities

Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE messages. A remote attacker could possibly use this issue to cause Quagga to crash, resulting in a denial of service. CVE-2017-16227 Quentin Young discovered that Quagga incorrectly handled memory in the telnet vty CLI. A...

Debian DSA-4011-1 : quagga - security update

It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment ASPATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Circle with Disney Apid Strstr Authentication Bypass Vulnerability

Summary An exploitable authentication bypass vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A specially crafted token can bypass the authentication routine of the Apid binary, causing the device to grant unintended administrative access. An attacker needs...

Circle with Disney Apid Server Fork Denial of Service Vulnerability

Summary An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A large amount of simultaneous TCP connections causes the APID daemon to repeatedly fork, causing the daemon to run out of memory and trigger a device reboot. An attacker...

[SECURITY] [DSA 4011-1] quagga security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4011-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 30, 2017 https://www.debian.org/security/faq -...

CVE-2015-0224

qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service daemon crash via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203...

CVE-2015-3249

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service out-of-bounds access and daemon crash or possibly execute arbitrary code via vectors related to the 1 framehandlers array or 2 setdynamictablesize function...

CVE-2015-3249

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service out-of-bounds access and daemon crash or possibly execute arbitrary code via vectors related to the 1 framehandlers array or 2 setdynamictablesize function...

CVE-2015-0224

CVE-2015-0224 affects qpidd (Apache Qpid) 0.30 and earlier. The vulnerability enables remote denial of service (daemon crash) via a crafted protocol sequence set, and exists due to an incomplete fix for CVE-2015-0203. Public details in connected assessors note the issue is tied to the qpidd broke...

openSUSE Security Update : libvirt (openSUSE-2017-1213)

This update for libvirt fixes the following issues : Security issue fixed : - CVE-2017-1000256: Ensure TLS clients always verify the server certificate in the serial/TLS support. bsc1062563 Non security issue fixed : - libvirt-daemon-qemu requires libvirt-daemon-driver-storage bsc1062620 This...

PT-2017-6436 · Apache · Apache Qpid

Name of the Vulnerable Software and Affected Versions: Apache Qpid versions 0.30 and earlier Description: The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, by sending a crafted protocol sequence set. This problem exists due to an incomplete fix for a...

Debian: Security Advisory (DSA-4011-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ntp: Buffer Overflow in DPTS Clock

A vulnerability was found in NTP, in the parsing of packets from the /dev/datum device. A malicious device could send crafted messages, causing ntpd to crash...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2017:2850-1)

This update for libvirt fixes the following issues: Security issue fixed : - CVE-2017-1000256: Ensure TLS clients always verify the server certificate in the serial/TLS support. bsc1062563 Non security issue fixed : - libvirt-daemon-qemu requires libvirt-daemon-driver-storage bsc1062620 Note that...

REMOTE CODE EXECUTION (CVE-2017-13772) WALKTHROUGH ON A TP-LINK ROUTER

INTRODUCTION In this post, I will be discussing my recent findings while conducting vulnerability research on a home router: TP-Link’s WR940N home WiFi router. This post will outline the steps taken to identify vulnerable code paths, and how we can exploit those paths to gain remote code executio...

SAP Point of Sale Xpress Server Authentication Bypass Vulnerability

SAP Point of Sale POS is the German SAP SAP company's set of sales management system. Xpress Server is one of the Xpress server. A security vulnerability exists in the Xpress Server in SAP POS, which stems from the program's failure to require authentication. An attacker could use this...

Juniper Junos OS Denial of Service Vulnerability (CNVD-2017-33970)

Juniper Junos OS is a Juniper Networks network operating system designed for the company's hardware systems. The OS provides a secure programming interface and the Junos SDK. pluggable authentication module PAM is one of the authentication modules. A security vulnerability exists in the PAM in...