CVE-2018-2907

Vulnerability in the Hyperion Financial Reporting component of Oracle Hyperion subcomponent: Security Models. The supported version that is affected is 11.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Financial Reporting...

Design/Logic Flaw

Vulnerability in the Hyperion Financial Reporting component of Oracle Hyperion subcomponent: Security Models. The supported version that is affected is 11.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Financial Reporting...

CVE-2018-2907: Undefined Security Weakness

Vulnerability in the Hyperion Financial Reporting component of Oracle Hyperion subcomponent: Security Models. The supported version that is affected is 11.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Financial Reporting...

Apple TV < 11.4.1 Multiple Vulnerabilities

According to its banner, the version of Apple TV on the remote device is prior to 11.4.1. It is, therefore, affected by multiple vulnerabilities as described in the HT208936 security advisory. Note that only 4th and 5th generation models are affected by these vulnerabilities. C Tenable Network...

Sql injection

The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL injection. One consequence is that an application without the READSMS permission can read SMS messages. This affects Infinix X571 phones, as well as various Lenovo...

CVE-2016-6554

Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:blank and admin:blank . A remote network attacker can gain privileged access to a vulnerable device...

VulnCheck KEV: CVE-2017-8877

ASUS RT-AC and RT-N devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID...

Year-Old Critical Vulnerabilities Patched in ISP Broadband Gear

Patches for three critical vulnerabilities impacting broadband gateways made by Advanced Digital Broadcast ADB have been released to the public, nearly two years after the bugs were first found. Issues range from a privilege escalation flaw, an authorization bypass vulnerability and a local...

CVE-2017-17317

Common Open Policy Service Protocol COPS module in Huawei USG6300 V100R001C10; V100R001C20; V100R001C30; V500R001C00; V500R001C20; V500R001C30; V500R001C50; Secospace USG6500 V100R001C10; V100R001C20; V100R001C30; V500R001C00; V500R001C20; V500R001C30; V500R001C50; Secospace USG6600 V100R001C00;...

CVE-2018-10661

An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control...

CVE-2018-10662

An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface...

CVE-2018-10663

An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation...

CVE-2018-10664

An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption...

The need and opportunity for adaptive prevention in the cloud

This post is authored by Michael Bargury, Data Scientist, C+E Security. The need The cloud introduces new security challenges, which differ from classic ones by diversity and scale. Once a Virtual Machine VM is up and running with an open internet port, it is almost instantaneously subject to...

Security Bulletin: A vulnerability affects the IBM FlashSystem model V840

Summary There is a vulnerability which the IBM FlashSystem™ V840 is susceptible. An exploit of this vulnerability CVE-2018-1495 could make the system susceptible to attacks which could allow an attacker to overwrite arbitrary files. Vulnerability Details CVEID: CVE-2018-1495 DESCRIPTION: IBM...

Security Bulletin: IBM Security Network Protection is vulnerable to Cross-Site Scripting. (CVE-2014-6189)

Summary IBM Security Network Protection contains a Cross-Site Scripting vulnerability. Vulnerability Details CVEID:CVE-2014-6189 DESCRIPTION: IBM Security Network Protection is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploi...

Security Bulletin: TLS padding vulnerability affects IBM Security Network Protection (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Security Network Protection. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive informatio...

Security Bulletin: IBM Security Network Protection is affected by ClickJacking vulnerability CVE-2014-6197

Summary A ClickJacking also known as a "UI redress attack" vulnerability has been discovered in IBM Security Network Protection. Vulnerability Details CVE-ID: CVE-2014-6197 Description: A clickjacking vulnerability in IBM Security Network Protection could allow a remote attacker to hijack the...

Security Bulletin: Vulnerability in SSLv3 affects Network Protection (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in the IBM Security Network Protection Local Management Interface LMI. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allo...

Security Bulletin: IBM Security Network Protection is affected by Shell Command Injection vulnerability (CVE-2014-6183)

Summary A Shell Command Injection vulnerability has been discovered in IBM Security Network Protection. Vulnerability Details CVE-ID: CVE-2014-6183 Description: IBM Security Network Protection could allow a remote attacker to execute arbitrary commands on the system. An authenticated attacker cou...