CISA Releases Security Advisories Related to OT:ICEFALL (Insecure by Design) Report

CISA is aware that Forescout researchers have released OT:ICEFALL, a report on 56 vulnerabilities caused by insecure-by-design practices in operational technology across multiple vendors. The vulnerabilities are divided into four main categories: insecure engineering protocols, weak cryptography ...

Malicious code in cs-task-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c39698ac329277055768167de3fa99bf56777d8a97481cea290407f8226eeedb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft DFSCoerce Domain Control Privilege Vulnerability

Windows Server is a server operating system for Windows introduced by Microsoft on April 24, 2003, with the Microsoft Windows Server System WSS at its core. Microsoft DFSCoerce has a domain control privilege exploit, which can be exploited by an attacker to request the certificate of a domain...

Malicious code in cs-connection-hub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29eae716d8e0ba65820582f2c6f159bae978f21cd7eea64fe3e3524cd320be77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2260 Malicious code in cs-connection-hub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29eae716d8e0ba65820582f2c6f159bae978f21cd7eea64fe3e3524cd320be77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

new packages: mythes-cs

An update is available for mythes-cs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterpri...

Oracle PeopleSoft Enterprise CS Academic Advisement Information Disclosure Vulnerability (CNVD-2022-79907)

Oracle PeopleSoft Products is an enterprise human capital management solution from Oracle Corporation USA. The product provides human capital management, financial management, vendor relationship management, etc. An information disclosure vulnerability exists in Oracle PeopleSoft Enterprise CS...

CVE-2022-21447

Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft component: Advising Notes. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2022-21447

CVE-2022-21447 affects Oracle PeopleSoft Enterprise CS Academic Advisement (component: Advising Notes) in version 9.2. The vulnerability is an information disclosure that can be accessed over the network via HTTP by a low-privileged attacker, potentially exposing critical data across the affected...

cs-prod.popxo.com Cross Site Scripting vulnerability OBB-2494874

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Yokogawa CENTUM and Exaopc Uncontrolled Search Path Element (CVE-2022-23401)

The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00. This plugin only work...

Yokogawa CENTUM and Exaopc Permissions, Privileges, and Access Controls (CVE-2022-22141)

'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 t...

Yokogawa CENTUM and Exaopc Relative Path Traversal (CVE-2022-21808)

Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.0...

CVE-2022-21177

There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.00 to R6.08.00, Exaopc versions from...

CVE-2022-21808

Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.0...

CVE-2022-21177

There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.00 to R6.08.00, Exaopc versions from...

CVE-2022-21808

Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.0...

CVE-2022-22148

'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc...

CVE-2022-22145

CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, from R6.01.00 to R6.08.00, Exaopc versions...

CVE-2022-23401

The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00...