Cisco TelePresence Video Communication Server (VCS) Detection Consolidation

Consolidation of Cisco TelePresence Video Communication Server VCS detections. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2024-24262

media-server v1.0.0 was discovered to contain a Use-After-Free UAF vulnerability via the sipuacstoptimer function at /uac/sip-uac-transaction.c...

Design/Logic Flaw

media-server v1.0.0 was discovered to contain a Use-After-Free UAF vulnerability via the sipsubscriberemove function at /uac/sip-uac-subscribe.c...

CVE-2024-24260

media-server v1.0.0 was discovered to contain a Use-After-Free UAF vulnerability via the sipsubscriberemove function at /uac/sip-uac-subscribe.c...

PT-2024-20330 · Unknown · Mediaserver

Name of the Vulnerable Software and Affected Versions: media-server version 1.0.0 Description: A Use-After-Free UAF issue was discovered in the sip uac stop timer function. This issue is related to the /uac/sip-uac-transaction.c file. Recommendations: For media-server version 1.0.0, consider...

PT-2024-20329 · Unknown · Mediaserver

Name of the Vulnerable Software and Affected Versions: media-server version 1.0.0 Description: The issue is related to a Use-After-Free UAF vulnerability. This vulnerability occurs when the sip subscribe remove function is used. The UAF vulnerability is a type of memory corruption bug that can...

media-server security vulnerability

media-server is a library from Chen's personal developer. A security vulnerability exists in media-server v1.0.0, which was discovered via the sipsubscriberemove function in /uac/sip-uac-subscribe.c to contain a memory reuse after release vulnerability...

media-server security vulnerability

media-server is a library from Chen's personal developer. A security vulnerability exists in media-server v1.0.0, which was discovered via the sipuacstoptimer function in /uac/sip-uac-transaction.c to contain a memory reuse after release vulnerability...

CVE-2024-21616

An Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service DoS. On all Junos OS MX Series and SRX Series platforms, when SIP ALG is enabled, and a...

CVE-2024-21616

An Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service DoS. On all Junos OS MX Series and SRX Series platforms, when SIP ALG is enabled, and a...

Input validation

An Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service DoS. On all Junos OS MX Series and SRX Series platforms, when SIP ALG is enabled, and a...

CVE-2024-21616 Junos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to fail

An Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service DoS. On all Junos OS MX Series and SRX Series platforms, when SIP ALG is enabled, and a...

CVE-2024-21616 Junos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to fail

An Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service DoS. On all Junos OS MX Series and SRX Series platforms, when SIP ALG is enabled, and a...

FreeSWITCH 1.10.10 Denial Of Service Vulnerability

When handling DTLS-SRTP for media setup, FreeSWITCH version 1.10.10 is susceptible to denial of service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. FreeSWITCH...

FreeSWITCH 1.10.10 Denial Of Service

FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation - Fixed versions: 1.10.11 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-02-freeswitch-dtls-hello-race - Vendor Security Advisory:...

Asterisk Buffer Overflow Vulnerability (CNVD-2023-9903086)

Asterisk is a software for PBX systems that runs on Linux and supports IP calls using SIP, IAX, and H323 protocols. Asterisk suffers from a buffer overflow vulnerability, which stems from the "update" function of the PJSIPHEADER dialplan function that may exceed the available buffer space for...

RTPEngine mr11.5.1.6 Denial Of Service

RTPEngine susceptible to Denial of Service via DTLS Hello packets during call initiation - Fixed versions: mr12.1.1.2, mr12.0.1.3, mr11.5.1.16, mr10.5.6.3, mr10.5.6.2 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-03-rtpengine-dtls-hello-race - Vendor...

ALPINE-CVE-2023-37457

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIPHEADER dialplan function can exceed the available buffer space...

Rockwell Automation Stratix 5900 (CVE-2014-3360)

A vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device. To exploit this vulnerability, affected devices must be configured to process SIP messages...

Rockwell Automation Stratix 5900 Improper Input Validation (CVE-2014-2106)

A vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device. To exploit this vulnerability, affected devices must be configured to process SIP messages...