SubSTATION Server Telegyr 8979 Master Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on July 15, 2014, and is being released to the NCCIC/ICS-CERT web site. Adam Crain of Automatak and Chris Sistrunk of Mandiant have identified a Buffer Overflow Vulnerability in the SUBNET Solutions Inc SUBNET,...

MGASA-2014-0060 Updated qemu package fixes security vulnerability

Sibiao Luo discovered that QEMU incorrectly handled device hot-unplugging. A local user could possibly use this flaw to cause a denial of service CVE-2013-4377. Additionally, qemu has been updated to 1.6.2, fixing several other bugs...

Updated qemu package fixes security vulnerability

Sibiao Luo discovered that QEMU incorrectly handled device hot-unplugging. A local user could possibly use this flaw to cause a denial of service CVE-2013-4377. Additionally, qemu has been updated to 1.6.2, fixing several other bugs...

[USN-2092-1] QEMU vulnerabilities

========================================================================== Ubuntu Security Notice USN-2092-1 January 30, 2014 qemu, qemu-kvm vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

Ubuntu 12.04 LTS / 12.10 / 13.10 : qemu, qemu-kvm vulnerabilities (USN-2092-1)

Asias He discovered that QEMU incorrectly handled SCSI controllers with more than 256 attached devices. A local user could possibly use this flaw to elevate privileges. CVE-2013-4344 It was discovered that QEMU incorrectly handled Xen disks. A local guest could possibly use this flaw to consume...

USN-2092-1: QEMU vulnerabilities

Asias He discovered that QEMU incorrectly handled SCSI controllers with more than 256 attached devices. A local user could possibly use this flaw to elevate privileges. CVE-2013-4344 It was discovered that QEMU incorrectly handled Xen disks. A local guest could possibly use this flaw to consume...

CVE-2013-5218

Cross-site scripting XSS vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to inject arbitrary web script or HTML via a crafted DHCP Host Name option, which is not properly handled during rendering of the DHCP table in wlanAccess.asp...

CVE-2013-5037

The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attackers to obtain the WPA or WPA2 pre-shared key via EAP messages...

CVE-2013-5220

goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service device crash via crafted HTTP POST data...

Design/Logic Flaw

The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attackers to obtain the WPA or WPA2 pre-shared key via EAP messages...

Cross site scripting

Cross-site scripting XSS vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to inject arbitrary web script or HTML via a crafted DHCP Host Name option, which is not properly handled during rendering of the DHCP table in wlanAccess.asp...

CVE-2013-5037

The CVE-2013-5037 entry concerns the HOTBOX router (SAGEMCOM HOTBOX F@st 3184) running software version 2.1.11, where a default WPS PIN of 12345670 enables easier access to the WPA/WPA2 PSK via EAP messages. The connected sources corroborate the affected device and version and describe the underl...

CVE-2013-5038

The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP address that had previously been used for an authenticated session...

CVE-2013-5218

CVE-2013-5218 describes an XSS vulnerability in the HOTBOX router (SAGEMCOM F@st 3184) with software 2.1.11. The issue arises from improper handling of a crafted DHCP Host Name option during rendering of the DHCP table in wlanAccess.asp, allowing remote attackers to inject arbitrary web script or...

CVE-2013-5219

CVE-2013-5219 affects HOTBOX Router/Modem (SAGEMCOM F@st 3184, 2.1.11). A directory traversal vulnerability allows an attacker to read arbitrary files via a .. in a URI (e.g., /etc/passwd). Evidence from multiple sources confirms the vulnerable component is the web-facing URI handling, enabling r...

CVE-2013-5037

The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attackers to obtain the WPA or WPA2 pre-shared key via EAP messages...

CVE-2013-5039

The CVE-2013-5039 entry concerns the HOTBOX router (SAGEMCOM HOTBOX F@st 3184) with firmware 2.1.11. It describes a CSRF flaw in goform/wlanBasicSecurity that lets an attacker hijack administrator authentication to set WifiSecurity to Deactivated. Public material (e.g., exploit-db, packetstorm, 0...

CVE-2013-5038

CVE-2013-5038 affects HOTBOX router/modem (SAGEMCOM F@st 3184, software version 2.1.11; possibly earlier). The issue is an authentication bypass: an attacker can gain remote access by configuring a source IP address that had been used for an authenticated session. Public references in the connect...

xorg security update

CentOS Errata and Security Advisory CESA-2013:1620 Updated xorg-x11-server packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring...

RHEL 6 : xorg-x11-server (RHSA-2013:1620)

Updated xorg-x11-server packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severit...