Design/Logic Flaw

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's...

CVE-2021-34561

The CVE affects Pepperl+Fuchs WirelessHART-Gateway (versions 3.0.7–3.0.8, with related advisories extending to 3.0.9) where DNS rebinding can bypass IP/firewall access controls by proxying through a target’s browser. Root cause: reliance on DNS-based access controls; impact includes potential una...

CVE-2021-34561 A vulnerability in WirelessHART-Gateway <= 3.0.8 allows to bypass any IP or firewall based access restrictions through DNS rebinding

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's...

PT-2021-20546 · Pepperl+Fuchs · Pepperl+Fuchs Wirelesshart-Gateway

Name of the Vulnerable Software and Affected Versions: PEPPERL+FUCHS WirelessHART-Gateway versions 3.0.8 and earlier Description: A serious issue exists in the application if it is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or...

Pepperl Fuchs WirelessHART-Gateway安全漏洞

The Pepperl Fuchs WirelessHART-Gateway is a gateway device from Pepperl Fuchs, Germany. A security vulnerability exists in Pepperl Fuchs WirelessHART-Gateway version 3.0.8 and prior versions, which can be exploited by an attacker to bypass any IP- or firewall-based access restrictions that may be...

GHSA-X2XG-6WCJ-6XF9 SafeCurl before 0.9.2 has a DNS rebinding vulnerability.

SafeCurl before 0.9.2 has a DNS rebinding vulnerability...

CVE-2020-36474

SafeCurl before 0.9.2 has a DNS rebinding vulnerability...

CVE-2020-36474

SafeCurl before 0.9.2 has a DNS rebinding vulnerability...

Security feature bypass

SafeCurl before 0.9.2 has a DNS rebinding vulnerability...

CVE-2020-36474

CVE-2020-36474 affects SafeCurl prior to version 0.9.2, which is reported to have a DNS rebinding vulnerability. The connected sources (GitHub PRs/releases and vendor advisories) confirm SafeCurl 0.9.2 fixes the issue, with the ARMs indicating a network‑level impact and high severity in CVSS term...

activemq: improper authentication allows MITM attack

Apache ActiveMQ uses LocateRegistry.createRegistry to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to...

CVE-2021-34561

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's...

Security Bulletin: IBM API Connect is impacted by vulnerabilities in node.js and OpenSSL (CVE-2021-23840, CVE-2021-22884, CVE-2021-22883)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long argument, an attacker could exploit this vulnerability...

activemq: improper authentication allows MITM attack

Apache ActiveMQ uses LocateRegistry.createRegistry to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to...

SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2021:2620-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2620-1 advisory. - update to npm 6.14.13 - CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. bsc1187976 - CVE-2021-23362: Fixed...

SUSE-SU-2021:2620-1 Security update for nodejs8

This update for nodejs8 fixes the following issues: - update to npm 6.14.13 - CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. bsc1187976 - CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service bsc1187977 - CVE-2021-22884: DNS rebinding in --inspect bsc1182620...

Security Bulletin: Potential vulnerability with Node.js

Summary A potential vulnerability has been identified related to Node.js. Refer to details for additional information. Vulnerability Details CVEID: CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long...

OESA-2021-1272 gupnp security update

GUPnP is an elegant, object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible. It provides the same set of features as libupnp,but shields the developer from most...

openSUSE 15 Security Update : gupnp (openSUSE-SU-2021:2153-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2153-1 advisory. - An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this...

openSUSE: Security Advisory for gupnp (openSUSE-SU-2021:2153-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...