3904 matches found
qemu, xen and VirtualBox OSE -- possible VM escape and code execution ("VENOM")
Jason Geffner, CrowdStrike Senior Security Researcher reports: VENOM, CVE-2015-3456, is a security vulnerability in the virtual floppy drive code used by many computer virtualization platforms. This vulnerability may allow an attacker to escape from the confines of an affected virtual machine VM...
The vulnerability of the microprogramming software of the Cisco ASA security device allows a malicious individual to gain administrator privileges.
The vulnerability of Cisco ASA security devices’ microprogramming software lies in the improper handling of messages that occur during failures. Exploiting this vulnerability allows a malicious actor to remotely reconfigure the ASA device and then gain administrator privileges by sending speciall...
CVE-2015-0675: Improper Access Control
The failover ipsec implementation in Cisco Adaptive Security Appliance ASA Software 9.1 before 9.16, 9.2 before 9.23.3, and 9.3 before 9.33 does not properly validate failover communication messages, which allows remote attackers to reconfigure an ASA device, and consequently obtain administrativ...
FreeBSD -- Denial of Service with IPv6 Router Advertisements
Problem Description: The Neighbor Discover Protocol allows a local router to advertise a suggested Current Hop Limit value of a link, which will replace Current Hop Limit on an interface connected to the link on the FreeBSD system. Impact: When the Current Hop Limit similar to IPv4's TTL is small...
CVE-2015-0667
The Management Interface on Cisco Content Services Switch CSS 11500 devices 8.20.4.02 and earlier allows remote attackers to bypass intended restrictions on local-network device access via crafted SSH packets, aka Bug ID CSCut14855...
CVE-2015-0667
The Management Interface on Cisco Content Services Switch CSS 11500 devices 8.20.4.02 and earlier allows remote attackers to bypass intended restrictions on local-network device access via crafted SSH packets, aka Bug ID CSCut14855...
D-Link and TRENDnet 'ncc2' service - multiple Vulnerabilities
Multiple D-Link and TRENDnet devices suffer from cross site request forgery and unauthenticated access vulnerabilities. Various proof of concepts included. D-Link and TRENDnet 'ncc2' service - multiple vulnerabilities Discovered by: ---- Peter Adkins Access: ---- Local network; unauthenticated...
D-Link / TRENDnet ncc2 CSRF / Unauthenticated Access
D-Link and TRENDnet 'ncc2' service - multiple vulnerabilities Discovered by: ---- Peter Adkins Access: ---- Local network; unauthenticated access. Remote network; unauthenticated access. Remote network; 'drive-by' via CSRF. Tracking and identifiers: ---- CVE - Mitre contacted; not yet allocated...
LG On Screen Phone authentication bypass (CVE-2014-8757)
LG On Screen Phone authentication bypass vulnerability ------------------------------------------------------ SEARCH-LAB Ltd. discovered a serious security vulnerability in the On Screen Phone protocol used by LG Smart Phones. A malicious attacker is able to bypass the authentication phase of the...
NetGear WNDR Authentication Bypass / Information Disclosure Vulnerabilities
A number of NetGear WNDR devices contain an embedded SOAP service that is seemingly for use with the NetGear Genie application. As this SOAP service is implemented by the built-in HTTP / CGI daemon, unauthenticated queries will also be answered over the internet if remote management has been...
ASUS Router infosvr Service Remote Command Execution Vulnerability
Added: 01/13/2015 CVE: CVE-2014-9583 BID: 71889 OSVDB: 116691 Background ASUS manufactures network devices, including routers and wireless repeaters. Some of these devices include the infosvr service, part of the "ASUS Wireless Router Device Discovery Utility". The infosvr service listens on port...
Cisco Meraki MS MRMX Arbitrary Firmware Installation Vulnerability
The Cisco-Meraki MS MRMX is a cloud-managed wireless networking device from Cisco. The Cisco Meraki MS MRMX Arbitrary Firmware Installation vulnerability allows an authenticated, remote user to install arbitrary firmware on the local network by exploiting unspecified HTTP handler access...
Cisco Meraki MS MRMX Information Disclosure Vulnerability
The Cisco Meraki MS MRMX is a cloud-managed wireless networking device from Cisco. The Cisco Meraki MS MRMX information disclosure vulnerability allows an attacker to obtain sensitive credential information by accessing the local network using an unspecified HTTP handler...
CVE-2014-7993
Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to obtain sensitive credential information by leveraging unspecified HTTP handler access on the local network, aka Cisco-Meraki defect ID 00302012...
CVE-2014-7993: Exposure of Sensitive Information to an Unauthorized Actor
Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to obtain sensitive credential information by leveraging unspecified HTTP handler access on the local network, aka Cisco-Meraki defect ID 00302012...
CVE-2014-7999
Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote authenticated users to install arbitrary firmware by leveraging unspecified HTTP handler access on the local network, aka Cisco-Meraki defect ID 00478565...
CVE-2014-7999: Undefined Security Weakness
Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote authenticated users to install arbitrary firmware by leveraging unspecified HTTP handler access on the local network, aka Cisco-Meraki defect ID 00478565...
FreeBSD routed DoS
Crash on RIP packet from non-local network...
elasticsearch weak CORS policy
Crossite requests to local network are possible...
Colin McRae Rally 2004 Multiplayer Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10464/info It is reported that Colin McRae Rally 2004 has a flaw handling server responses when entering the multiplayer menu of the game. When entering the multiplayer menu, the game client sends a broadcast message...