TotoLink routers 命令注入漏洞

TOTOLink T6 is a wireless dual-band router from China-based TotoLink. isAssocPriDevice function of TOTOLink T6 is vulnerable to command injection. An attacker can exploit this vulnerability to execute arbitrary commands via specially crafted MQTT packets...

SUSE: Security Advisory (SUSE-SU-2014:1438-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

pri-med.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1165108 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

pri-med.com XSS vulnerability

Open Bug Bounty ID: OBB-401711 Description| Value ---|--- Affected Website:| pri-med.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

Unrestricted SQL Injection Vulnerability in Frontend of iWebSNS Enterprise Social Networking Platform

iWebSNS is a set of open source SNS social networking software built on LAMP development. iWebSNS enterprise social networking platform front-end there are unlimited SQL injection vulnerabilities. As the source code servtools\menupop\translatepri.php tname, vid and tem variables failed to strictl...

SUSE SLED12 / SLES12 Security Update : update for rsyslog (SUSE-SU-2014:1438-1)

This update for rsyslog provides the following fixes : - Fixed remote PRI DoS vulnerability patch CVE-2014-3683, bnc899756 - Removed broken, unsupported and dropped by upstream zpipe utility from rsyslog-diag-tools package bnc890228 Note that Tenable Network Security has extracted the preceding...

Fedora 19 : sysklogd-1.5-18.fc19 (2014-12878)

Added patch for remote syslog PRI vulnerability 1142373 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

[SECURITY] [DLA 72-1] rsylog security update

Package : rsylog Version : 4.6.4-2+deb6u1 CVE ID : CVE-2014-3634 CVE-2014-3683 CVE-2014-3634 Fix remote syslog vulnerability due to improper handling of invalid PRI values. CVE-2014-3683 Followup fix for CVE-2014-3634. The initial patch was incomplete. It did not cover cases where PRI values MAXI...

openSUSE Security Update : rsyslog (openSUSE-SU-2014:1298-1)

Fixed remote PRI DoS vulnerability patch CVE-2014-3683,bnc899756 rsyslog-7.2.7-remote-PRI-DoS-fix-backportCVE-2014-3634. patch - Removed broken, unsupported and dropped by upstream zpipe utility from rsyslog-diag-tools package bnc890228 - Remote syslog PRI DoS vulnerability fix...

rsyslog: remote denial of service

The rsyslog fix shipped in 8.4.1 for an invalid PRI value see ASA-201410-1 was incomplete, as it did not cover cases where PRI values MAXINT. These values caused an integer overflow, resulting in negative values. Sending a syslog message containing an invalid PRI value to a vulnerable rsyslog...

FreeBSD : rsyslog -- remote syslog PRI vulnerability (8e0e86ff-48b5-11e4-ab80-000c29f6ae42)

The rsyslog project reports : potential abort when a message with PRI 191 was processed if the 'pri-text' property was used in active templates, this could be abused to a remote denial of service from permitted senders The original fix for CVE-2014-3634 was not adequate. %NASLMINLEVEL 70300 C...

rsyslog -- remote syslog PRI vulnerability

The rsyslog project reports: potential abort when a message with PRI 191 was processed if the "pri-text" property was used in active templates, this could be abused to a remote denial of service from permitted senders The original fix for CVE-2014-3634 was not adequate...

Call spoofing - Evolution of Cybercrime in Growing Children

Call spoofing - Evolution of Cybercrime in Growing Children The Hacker News & 5 Other Top IT Security Sites are Sponsoring a Special Edition January 2012 Magazine under a Cyber Security Awareness Campaign called "ENTER AT YOUR OWN RISK". Our goal is to provide the most up-to-date information on a...

DoS Condition with Altigen VoIP Phone Systems

If you run a NMAP network scan against the IP of the phone server, it will crash the Altigen's Gateway service, rendering the system useless until rebooted. All information saved in the phone system at the time is lost. Port 5061 crashes due to HEAP Overflow. Following message: Application popup:...