UPnP denial of service vulnerability

UPnP is a Universal Plug and Play protocol from the Open Connectivity Foundation. A security vulnerability exists in versions of UPnP prior to 2020-04-17. An attacker could exploit the vulnerability by sending traffic to an arbitrary location with the help of the SUBSCRIBE feature, resulting in a...

Improper Access Control

Overview faye is a simple pub/sub messaging for the web. Affected versions of this package are vulnerable to Improper Access Control. The Server parses channels in a way that means any channel namespaced under /meta/subscribe will also work as a subscription request. For example if the client sen...

The vulnerability of the Eclipse Mosquitto messaging broker, related to insufficient checking of exclusive states, allows a hacker to trigger a service failure.

The vulnerability of the Eclipse Mosquitto messaging broker is related to insufficient checking of exceptional states. Exploiting this vulnerability allows a malicious actor to cause a service failure by sending a SUBSCRIBE packet containing approximately 65,400 or more characters '/'...

IBM Security Information Queue Information Disclosure Vulnerability (CNVD-2020-22191)

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue. An attacker could exploit the...

IBM Security Information Queue Information Disclosure Vulnerability (CNVD-2020-22189)

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue ISIQ that stems from the program's...

IBM Security Information Queue Information Disclosure Vulnerability (CNVD-2020-22186)

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue ISIQ that stems from the program failin...

User Survey 2020 Report Shows Rapid Growth In Apache Pulsar Adoption

For the first time ever, the Apache Pulsar PMC team is publishing a user survey report. The 2020 Apache Pulsar User Survey Report reveals Pulsar's accelerating rate of global adoption, details how organizations are leveraging Pulsar to build real-time streaming applications, and highlights key...

Eclipse Mosquitto Denial Of Service (CVE-2019-11779)

A stack overflow exists in Eclipse Mosquitto. The vulnerability is due to insufficient handling of the Topic in MQTT SUBSCRIBE messages. A remote attacker can exploit this vulnerability by sending a crafted MQTT SUBSCRIBE message with a large number of topic hierarchy separators in the topic...

The vulnerability of D-Link DIR-818Lx, DIR-822, DIR-823, DIR-859, DIR-865L, DIR-868L, DIR-869, DIR-880L, DIR-890L/R, DIR-885L/R, and DIR-895L/R routers stems from the failure to address the issue of eliminating special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands on behalf of the root user in the target system.

The vulnerability of D-Link DIR-818Lx, DIR-822, DIR-823, DIR-859, DIR-865L, DIR-868L, DIR-869, DIR-880L, DIR-890L/R, DIR-885L/R, and DIR-895L/R routers exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerabilit...

New Talos Takes podcast puts Talos' spin on the latest cyber news

By Jon Munshaw. Today, Cisco Talos' podcast network is growing with a new show. Talos Takes is a new podcast that provides Talos analysts' and researchers' opinions and expertise on the hottest topics in cyber security. The first three episodes of the show — covering holiday shopping scams,...

PT-2019-4530 · D Link · D-Link Dir-895L/R +10

Name of the Vulnerable Software and Affected Versions: D-Link DIR-818Lx versions not specified D-Link DIR-822 versions not specified D-Link DIR-823 versions not specified D-Link DIR-859 versions 1.05 through 1.06B01 Beta01 D-Link DIR-865L versions not specified D-Link DIR-868L versions not...

Updated mosquitto packages fix security vulnerability

Updated mosquitto packages fix security vulnerability: A vulnerability was discovered in mosquitto, allowing a malicious MQTT client to cause a denial of service stack overflow and daemon crash, by sending a specially crafted SUBSCRIBE packet containing a topic with a extremely deep hierarchy...

Debian: Security Advisory (DSA-4570-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4570-1 : mosquitto - security update

A vulnerability was discovered in mosquitto, a MQTT version 3.1/3.1.1 compatible message broker, allowing a malicious MQTT client to cause a denial of service stack overflow and daemon crash, by sending a specially crafted SUBSCRIBE packet containing a topic with a extremely deep hierarchy. C...

Debian DLA-1972-1 : mosquitto security update

Several issues have been found in mosquitto, a MQTT version 3.1/3.1.1 compatible message broker. CVE-2017-7655 A Null dereference vulnerability in the Mosquitto library could lead to crashes for those applications using the library. CVE-2018-12550 An ACL file with no statements was treated as...

YouPHPTube subscribe.json.php file SQL Injection Vulnerability

YouPHPTube is a PHP-based video website system. A SQL injection vulnerability exists in the /objects/subscribe.json.php file in YouPHPTube version 7.6. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit th...

[SECURITY] Fedora 29 Update: mosquitto-1.6.7-1.fc29

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

openSUSE Security Update : mosquitto (openSUSE-2019-2206)

This update for mosquitto fixes the following issues : - CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE packets that could lead to a stack overflow bsc1151494. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

DEBIAN-CVE-2019-11779

In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur...

CVE-2019-11779

In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur...