Buffer Over-read

Overview mqtt-packet is an Encoder and Decoder for MQTT. Affected versions of this package are vulnerable to Buffer Over-read. An attacker could trigger an out of range read on a buffer which throws a RangeError. MQTT Brokers using this module could be forced to crash by sending a specifically...

PT-2019-18281 · Frederick Townes · W3 Total Cache

Name of the Vulnerable Software and Affected Versions: W3 Total Cache plugin versions prior to 0.9.4 Description: The issue allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data. This is due to a lack of proper access control in the API,...

CVE-2019-17621

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network. Recent...

DEBIAN-CVE-2019-1000021

slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin Persistent Storage of Private Data via PubSub options profile, used for the configuration of default access model that can result in all of the contacts of...

[SECURITY] Fedora 29 Update: mosquitto-1.5.5-1.fc29

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

Security Bulletins for Emptoris SSM Analytics Integration Module

Question Security Bulletins for Emptoris SSM Analytics Integration Module Answer This article tracks all Security Bulletins for Emptoris SSM Analytics Integration Module. IBM's Product Security Incident Response Team PSIRT follows the NIST guidelines for determining the severity rating of the...

[SECURITY] Fedora 29 Update: mosquitto-1.5.3-1.fc29

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

CVE-2018-18765

An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mgmqttnextsubscribetopic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially...

DEBIAN-CVE-2018-18765

An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mgmqttnextsubscribetopic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially...

DEBIAN-CVE-2018-18764

An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parsemqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially...

UBUNTU-CVE-2018-18764

An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parsemqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially...

UBUNTU-CVE-2018-18765

An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mgmqttnextsubscribetopic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially...

Cesanta Mongoose buffer overread vulnerability (CNVD-2019-09626)

Mongoose is a cross-platform embedded Web server and networking libraries , its features include TCP, HTTP clients and servers , WebSocket clients and servers , MQTT clients and proxies and so on. A heap buffer over-read vulnerability exists in the MQTT packet parsing feature...

cabaretinfo.nl XSS vulnerability

Open Bug Bounty ID: OBB-681711 Description| Value ---|--- Affected Website:| cabaretinfo.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

floraldaily.com XSS vulnerability

Open Bug Bounty ID: OBB-669683 Description| Value ---|--- Affected Website:| floraldaily.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bannerelkwinery.com XSS vulnerability

Open Bug Bounty ID: OBB-667338 Description| Value ---|--- Affected Website:| bannerelkwinery.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

palmsprings.edgemedianetwork.com XSS vulnerability

Open Bug Bounty ID: OBB-663248 Description| Value ---|--- Affected Website:| palmsprings.edgemedianetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6....

lasvegas.edgemedianetwork.com XSS vulnerability

Open Bug Bounty ID: OBB-663241 Description| Value ---|--- Affected Website:| lasvegas.edgemedianetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Security Bulletin: IBM Cloud Manager is affected by the vulnerabilities known as Spectre and Meltdown

Summary IBM Cloud Manager is affected by security vulnerabilities known as Spectre and Meltdown, which can enable CPU data cache timing to be abused to bypass conventional memory security restrictions to gain access to privileged memory that should be inaccessible. Vulnerability Details CVEID:...

findsavings.com XSS vulnerability

Open Bug Bounty ID: OBB-656658 Description| Value ---|--- Affected Website:| findsavings.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...