Emerson DeltaV Uncontroller Resource Consumption Vulnerability

Overview This advisory was originally posted to the US-CERT secure portal library on February 22, 2013, and is now being released to the ICS-CERT Web page. This advisory provides mitigation details for a vulnerability that impacts the Emerson DeltaV MD and SD controllers. Independent researcher...

Apache Tomcat Chunked Transfer Denial of Service - Ver 2 (CVE-2012-3544)

A denial of service vulnerability has been identified in Apache Tomcat as it processes Chunked-Transfer encoded requests. The error is caused by Tomcat not discarding any extensions included in very long Chunked-transfer requests, even if they were not processed. A remote attacker could exploit...

rubygems: version regex algorithmic complexity vulnerability

A denial of service vulnerability exists in the RubyGems versions 2.0.7 or older, such that when RubyGems validates versioning it performs a wrong regular expression causing resource consumption due to algorithmic complexity...

rubygems: version regex algorithmic complexity vulnerability

A denial of service vulnerability exists in the RubyGems versions 2.0.7 or older, such that when RubyGems validates versioning it performs a wrong regular expression causing resource consumption due to algorithmic complexity...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : gnupg, gnupg2 vulnerabilities (USN-1987-1)

Daniel Kahn Gillmor discovered that GnuPG treated keys with empty usage flags as being valid for all usages. CVE-2013-4351 Taylor R Campbell discovered that GnuPG incorrectly handled certain OpenPGP messages. If a user or automated system were tricked into processing a specially crafted message,...

USN-1987-1: GnuPG vulnerabilities

Daniel Kahn Gillmor discovered that GnuPG treated keys with empty usage flags as being valid for all usages. CVE-2013-4351 Taylor R Campbell discovered that GnuPG incorrectly handled certain OpenPGP messages. If a user or automated system were tricked into processing a specially-crafted message,...

USN-1984-1: Python 3.2 vulnerabilities

Florian Weimer discovered that Python incorrectly handled matching multiple wildcards in ssl certificate hostnames. An attacker could exploit this to cause Python to consume resources, resulting in a denial of service. CVE-2013-2099 Ryan Sleevi discovered that Python did not properly handle...

CVE-2013-4179

The security group extension in OpenStack Compute Nova Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service resource consumption and crash via an XML Entity Expansion XEE attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664...

Debian DSA-2725-1 : tomcat6 - several vulnerabilities

Two security issues have been found in the Tomcat servlet and JSP engine : - CVE-2012-3544 The input filter for chunked transfer encodings could trigger high resource consumption through malformed CRLF sequences, resulting in denial of service. - CVE-2013-2067 The FormAuthenticator module was...

Oracle Linux 6 : squid (ELSA-2013-0505)

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2013-0505 advisory. - Resolves: 888198 - CVE-2012-5643: improved upstream patch - Resolves: 888198 - CVE-2012-5643: patch - Resolves: 888198 - CVE-2012-5643: DoS excessive resource...

CVE-2013-3299

RealNetworks RealPlayer

Ubuntu: Security Advisory (USN-1895-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-0685

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

CVE-2013-1235

Cisco Wireless LAN Controller WLC devices do not properly address the resource consumption of terminated TELNET sessions, which allows remote attackers to cause a denial of service TELNET outage by making many TELNET connections and improperly ending these connections, aka Bug ID CSCug35507...

CVE-2012-6551

The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service broker resource consumption via HTTP requests...

CVE-2013-0270

OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service CPU and memory consumption via a large HTTP request, as demonstrated by a long tenantname when requesting a token...

MiniWeb File Upload / Directory Traversal

============================================================================================ Vulnerable Software: MiniWeb build 300, built on Feb 28 2013 Official Site: http://miniweb.sourceforge.net/ Vulns: Remote arbitrary file upload,Directory traversal. Tested Software/version: MiniWeb build...

Debian Security Advisory DSA 2659-1 (libapache-mod-security - XML external entity processing vulnerability)

Timur Yunusov and Alexey Osipov from Positive Technologies discovered that the XML files parser of ModSecurity, an Apache module whose purpose is to tighten the Web application security, is vulnerable to XML external entities attacks. A specially-crafted XML file provided by a remote attacker,...

CVE-2013-1664

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute Nova Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service resource consumption and crash via an XML...

Ubuntu Update for libxml2 USN-1782-1

Check for the Version of libxml2 OpenVAS Vulnerability Test $Id: gbubuntuUSN17821.nasl 8542 2018-01-26 06:57:28Z teissa $ Ubuntu Update for libxml2 USN-1782-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free softwar...