3544 matches found
Fedora 17 : yum-3.4.3-31.fc17 (2013-2789)
Fix a DOS attack maybe more by a bad Fedora mirror on repo. metadata. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...
Vulnerability in OpenSSL - TLS 1.1 and 1.2 AES-NI crash
A flaw in the OpenSSL handling of CBC ciphersuites in TLS 1.1 and TLS 1.2 on AES-NI supporting platforms can be exploited in a DoS attack...
CVE-2013-1573
The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle a large number of padding bits, which allows remote attackers to cause a denial of service infinite loop via a malformed packet...
CVE-2013-1576
The dissectsdpmediaattribute function in epan/dissectors/packet-sdp.c in the SDP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly process crypto-suite parameters, which allows remote attackers to cause a denial of service infinite loop via a malformed packet...
Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
There is a vulnerability in the JSON code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application...
Ruby on Rails 3.0 and 2.3 JSON Parser vulnerability
Overview The Ruby on Rails 3.0 and 2.3 JSON parser contain a vulnerability that may result in arbitrary code execution. Description The Ruby on Rails advisory states:There is a vulnerability in the JSON code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitra...
nested virtualization on 32-bit exposes host crash
ISSUE DESCRIPTION When performing nested virtualisation Xen would incorrectly map guest pages for extended periods using an interface which is only intended for transient mappings. In some configurations there are a limited number of slots available for these transient mappings and exhausting the...
Multiple vulnerabilities in parameter parsing in Action Pack
There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application...
Action Pack Multiple Vulnerabilities
There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a denial of service attack on a Rails application. Fixed Versions: 3.2.11, 3.1.10, 3.0.19,...
FreeBSD : rubygem-rails -- multiple vulnerabilities (ca5d3272-59e3-11e2-853b-00262d5ed8ee)
Ruby on Rails team reports : Two high-risk vulnerabilities have been discovered : CVE-2013-0155 There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing. Due to the way Active Record interprets parameters in combination with the way that JSON parameters are...
DSA-2604-1 rails - insufficient input validation
Bulletin has no description...
FreeBSD : puppet -- multiple vulnerabilities (101f0aae-52d1-11e2-87fe-f4ce46b9ace8)
puppet -- multiple vulnerabilities Arbitrary file read on the puppet master from authenticated clients high. It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the maste...
[btrfs] is vulnerable to a hash-DoS attack
Hello folk, The btrfs file system, part of the linux kernel, is vulnerable to a trivial hash-DoS attack. More details can be found here: http://crypto.junod.info/2012/12/13/hash-dos-and-btrfs/ Enjoy! Pascal Junod -- http://crypto.junod.info @cryptopathe...
Apache Tomcat Multiple Critical Vulnerabilities
Some critical vulnerabilities have been reported in Apache Tomcat, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS Denial of Service attack. These vulnerabilities affect Apache Tomcat 6.x and Apache Tomcat 7.x . Apache Tomcat vulnerabilities...
MODx 1.0.6 XSS / Abuse Functionality / Denial Of Service
Hello list! I want to warn you about new security vulnerabilities in MODx. This is the second part of the vulnerabilities in this CMS 6 vulnerabilities to previous 19 vulnerabilities. These are Cross-Site Request Forgery, Abuse of Functionality, Denial of Service and Insufficient Anti-automation...
Modbus Unit ID and Station ID Enumerator
Modbus is a cleartext protocol used in common SCADA systems, developed originally as a serial-line RS232 async protocol, and later transformed to IP, which is called ModbusTCP. default tcp port is 502. This module sends a command 0x04, read input register to the modbus endpoint. If this command i...
Broadcom BCM4325 and BCM4329 wireless chipset denial-of-service vulnerability
Overview Broadcom BCM4325 and BCM4329 wireless chipsets have been reported to contain an out-of-bounds read error condition that may be exploited to produce a denial-of-service condition. Description The CORE Security Technologies advisory states:"An out-of-bounds read error condition exists in...
HSBC Sites Knocked Offline in 'Large Scale' DoS Attack
Websites belonging to British bank and financial services company HSBC are back online today after reportedly experiencing a denial of service DoS attack. The attack, which lasted approximately 10 hours last night, was deemed a “large scale denial of service attack” by the company. “On 18 October...
EZHomeTech EzServer 7.0 - Remote Heap Corruption
EZHomeTech EzServer 7.0 - Remote Heap Corruption Title: Ezhometech EzServer 7.0 Remote Heap Corruption Vulnerability Description: EzServer is a software for audio and video streaming adopted by various companies worldwide. Version 7.0 is affected by a remote heap corruption vulnerability. Version...
