60 matches found
WPGraphQL < 1.3.6 - Denial of Service
The plugin suffers from a Denial of Service vulnerability by Field Duplication. It is possible to create an expensive query by duplicating the number of fields, while simultaneously sending these requests in batches using GraphQL's Batching capability. v1.3.6 added a setting to disable batch...
Cloning Google’s Titan Key to bypass 2FA – Research
By Sudais Asif The attack requires the attacker to have physical access to the victim's Titan Key, hours of time, and side-channel setup equipment worth €10,000 $12,000 - £9,000. This is a post from HackRead.com Read the original post: Cloning Googles Titan Key to bypass 2FA - Research...
Faketoken malware sends expensive & offensive texts at your expense
By Sudais Another day, another Android malware.! This time, Faketoken malware has made a comeback and here's what it does... This is a post from HackRead.com Read the original post: Faketoken malware sends expensive & offensive texts at your expense...
CVE-2019-16554
A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression...
CVE-2019-16553
A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression...
CVE-2019-16553: Cross-Site Request Forgery (CSRF)
A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression...
OSINT for Avionics
One of the biggest challenges with avionics research is simply getting hold of equipment to work on. Current equipment is frighteningly expensive – think $100,000 and up for some components, reflecting the relatively short production run, high reliability requirement and significant certification...
USN-3742-3: Linux kernel (Trusty HWE) regressions
USN-3742-2 introduced mitigations in the Linux Hardware Enablement HWE kernel for Ubuntu 12.04 ESM to address L1 Terminal Fault L1TF vulnerabilities CVE-2018-3620, CVE-2018-3646. Unfortunately, the update introduced regressions that caused kernel panics when booting in some environments as well a...
Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3742-1)
The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3742-1 advisory. It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core...
DEBIAN-CVE-2018-5390
Linux kernel versions 4.9+ can be forced to make very expensive calls to tcpcollapseofoqueue and tcppruneofoqueue for every incoming packet which can lead to a denial of service...
Node.js third-party modules: Prototype Pollution Vulnerability in cached-path-relative Package
I would like to report a prototype pollution attack in cached-path-relative. It allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain. Module module name: cached-path-relative version: 1.0.1 npm page:...
CVE-2018-0004
A sustained sequence of different types of normal transit traffic can trigger a high CPU consumption denial of service condition in the Junos OS register and schedule software interrupt handler subsystem when a specific command is issued to the device. This affects one or more threads and...
Petya the Great and why *they* don’t patch vulnerabilities
I really like this. Just imagine. Quiet, routine, everyday Vulnerability Management process in organizations: scanning-patching, scanning-patching, scanning-patching… And then. Suddenly! PEEETYYA!!! And at very same moment everything changes. People from different companies start to communicate...
CVE-2013-5958
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...
Design/Logic Flaw
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...
Wix.com Cross Site Scripting
57 million web pages are affected by a security problem in wix.com Proof of concept of a web page made in wix.com: http://www.itsec.cl/ to see the source code can observe the following: ... Find the SEO content of this site's homepage via http://www.itsec.cl/?escapedfragment= That is where search...
CVE-2013-5750
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation...
CVE-2012-4557: Undefined Security Weakness
The modproxyajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service worker consumption via an expensive request...
xtel detection
xteld is running on this port. This service allows users to connect to the 'Teletel' network. Some of the servers are expensive. Note that by default, xteld forbids access to the most expensive services. OpenVAS Vulnerability Test $Id: xteldetect.nasl 5877 2017-04-06 09:01:48Z teissa $ Descriptio...
xtelw detection
xteld is running on this port in HyperTerminal mode. This service allows users to connect to the 'Teletel' network. Some of the servers are expensive. Note that by default, xteld forbids access to the most expensive services. OpenVAS Vulnerability Test $Id: xtelwdetect.nasl 6065 2017-05-04...