#DoSAttack

Over 300K Prometheus Instances Exposed: Credentials and API Keys Leaking Online

by

December 12, 2024 at 09:51AM Cybersecurity researchers warn that numerous publicly accessible Prometheus servers are vulnerable to information leakage and attacks due to inadequate authentication. Sensitive data, including credentials, can be exposed, and denial-of-service attacks may occur via specific endpoints. Organizations should implement authentication, limit exposure, and monitor server activity to mitigate risks. **Meeting Takeaways … Read more

Cisco Patches Multiple NX-OS Software Vulnerabilities

by

August 29, 2024 at 08:06AM Cisco released patches for multiple high and medium-severity vulnerabilities in its NX-OS software, including a high-severity flaw in DHCPv6 relay agent allowing remote unauthenticated attackers to cause a denial-of-service condition. The patches also address command injection and sandbox escape issues, as well as medium-severity bugs in APIC, affecting certain Cisco … Read more

Cisco Patches High-Severity Vulnerability Reported by NSA

by

August 22, 2024 at 08:45AM Cisco announced patches for multiple vulnerabilities, including a high-severity bug in its collaboration solutions impacting SIP call processing. The bug can cause a denial-of-service condition, but patches are available for affected versions. Additionally, medium-severity bugs were found in Identity Services Engine, Unified CM, and Unified CM SME, with workarounds provided. … Read more

Vulnerability Found in Fluent Bit Utility Used by Major Cloud, Tech Companies

by

May 20, 2024 at 11:42AM Fluent Bit, a widely used logging utility, has a critical vulnerability allowing DoS attacks, information disclosure, and potential RCE. Tenable found a memory corruption flaw, affecting major cloud and tech companies. While a patch is developed, it’s not released. Users are advised to mitigate risks by restricting API access and … Read more

Intel Publishes 41 Security Advisories for Over 90 Vulnerabilities 

by

May 15, 2024 at 11:21AM Intel released 41 security advisories addressing over 90 vulnerabilities in its products. Critical vulnerability CVE-2024-22476 was found in Neural Compressor, allowing unauthenticated remote attackers to escalate privileges. High-severity flaws were also found in UEFI firmware, graphics, and network products. Additionally, there were medium-severity vulnerabilities in various hardware and software products. … Read more

Critical Bug Could Open 50K+ Tinyproxy Servers to DoS, RCE

by

May 8, 2024 at 12:44PM A use-after-free flaw in the open-source Tinyproxy (versions 1.11.1 and 1.10.0) allows attackers to trigger memory corruption, potentially leading to denial-of-service (DoS) and remote code execution (RCE) via a specially crafted HTTP Connection header. The flaw is rated 9.8 out of 10 in severity. While no known exploitation exists, more … Read more

New HTTP/2 DoS attack can crash web servers with a single connection

by

April 4, 2024 at 11:30AM Newly discovered HTTP/2 protocol vulnerabilities, “CONTINUATION Flood,” can lead to denial of service (DoS) attacks, crashing web servers with a single TCP connection in some implementations. Discovered by researcher Barket Nowotarski, these vulnerabilities relate to the use of HTTP/2 CONTINUATION frames, not properly limited or checked, potentially causing memory outages, … Read more

New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks

by

April 4, 2024 at 08:03AM New research has revealed a vulnerability in the HTTP/2 protocol, named HTTP/2 CONTINUATION Flood, which can be exploited to conduct denial-of-service (DoS) attacks. The issue affects multiple HTTP/2 implementations and could lead to server crashes, performance degradation, and memory exhaustion. Upgrading affected software or temporarily disabling HTTP/2 is recommended. After … Read more

New HTTP/2 DoS Attack Potentially More Severe Than Record-Breaking Rapid Reset

by

April 4, 2024 at 07:30AM Researcher Bartek Nowotarski has unveiled a new denial-of-service (DoS) attack method named HTTP/2 Continuation Flood, potentially posing a greater threat than the previous Rapid Reset vulnerability. The attack exploits a flaw in the handling of HTTP/2 frames and has affected various implementations. Patches and mitigations are being issued, and the … Read more

New ‘Loop DoS’ Attack Impacts Hundreds of Thousands of Systems

by

March 20, 2024 at 11:36AM A new DoS attack vector, dubbed Loop DoS attacks, targets UDP-based application-layer protocols, leading to reflected DoS attacks. Researchers discovered that certain UDP protocol implementations can be weaponized, creating self-perpetuating attack loops. Potentially impacting around 300,000 hosts and networks, the attack has been flagged as trivial to exploit. Multiple products … Read more