CVE-2015-8400

The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...

CVE-2015-8400: Undefined Security Weakness

The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...

PT-2016-3903

Name of the Vulnerable Software and Affected Versions Shell In A Box versions prior to 2.19 Description The issue makes it easier for remote attackers to conduct DNS rebinding attacks. This is due to the HTTPS fallback implementation in the affected software. The attack can be conducted via the...

[SECURITY] Fedora 23 Update: kea-1.0.0-1.fc23

DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers suppor...

Ubuntu 14.04 LTS : OpenJDK 7 vulnerability (USN-2818-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2818-1 advisory. It was discovered that rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed. Am attacker could use this to expose sensiti...

USN-2818-1 openjdk-7 vulnerability

It was discovered that rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed. Am attacker could use this to expose sensitive information or possibly execute arbitrary code...

Router devices do not implement sufficient UPnP authentication and security

Overview Home routers implementing the UPnP protocol do not sufficiently randomize UUIDs in UPnP control URLs, or implement other UPnP security measures. Description The UPnP protocol allows automatic device discovery and interaction with devices on a network. The UPnP protocol was originally...

Coinbase: Blacklist bypass on Callback URLs

In bug 47368, I was able to reach private IP addresses via the "Test Now" button of the "Callback URL" feature. Exploiting this flaw allowed me to reach the metadata server of your outbound proxy which is, afaik, maintained by Proximo. A comment by aianus states that callbacks are now restricted...

BlackBerry Link Multiple Vulnerabilities (Mac OS X)

The remote host has a version of BlackBerry Link installed prior to version 1.1.1.39. It is, therefore, affected by multiple vulnerabilities : - A WebDAV server that listens on an IPv6 address allows remote access to the host's file system. It may also be possible to utilize this vulnerability vi...

CVE-2013-3694

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding...

Cross site request forgery (csrf)

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding...

CVE-2013-3694

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding...

CVE-2013-3694

BlackBerry Link is affected by CVE-2013-3694 and related CVE-2013-6798. The vulnerable components are the WebDAV-enabled remote file-access folders in BlackBerry Link prior to Windows 1.2.1.31 and Mac OS X 1.1.1 build 39. The root cause is improper authentication for remote WebDAV access over IPv...

PT-2013-4571

Name of the Vulnerable Software and Affected Versions BlackBerry Link versions prior to 1.2.1.31 on Windows BlackBerry Link versions prior to 1.1.1 build 39 on Mac OS X Description The issue allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests. This can be achieved...

CVE-2013-3694: Cross-Site Request Forgery (CSRF)

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding...

New CSRF and XSS vulnerabilities in ADSL modem Callisto 821+

Hello 3APA3A! I want to warn you about security vulnerabilities in ADSL modem Callisto 821+ SI2000 Callisto821+ Router. These are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities. In April I've already drew attention of Ukrtelecom's representative and this modem was bough at...

DD-WRT Information Disclosure Vulnerability

Exploit for hardware platform in category remote exploits Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dd-wrt.com Version: v24-preSP2 Tested on: builds 14311, 14896 Remote attackers can gain sensitive information about a DD-WRT router and internal clients, including IP addresses, M...

DD-WRT 24-preSP2 - Information Disclosure

DD-WRT 24-preSP2 - Information Disclosure Exploit Title: DD-WRT Information Disclosure Vulnerability Date: 26-Dec-2010 Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dd-wrt.com Version: v24-preSP2 Tested on: builds 14311, 14896 Remote attackers can gain sensitive information about a...

DD-WRT 24-preSP2 - Information Disclosure

Exploit Title: DD-WRT Information Disclosure Vulnerability Date: 26-Dec-2010 Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dd-wrt.com Version: v24-preSP2 Tested on: builds 14311, 14896 Remote attackers can gain sensitive information about a DD-WRT router and internal clients,...

Mozilla Fixes Site Error-Handling Bug

Mozilla has fixed a bug in the way that its Bugzilla Web site and others handled certain errors, which could have been exploited to execute a man-in-the-middle attack against an unsuspecting user. The bug was related to the way that the sites responded to certain requests from client machines whe...