CVE-2018-7837

CVE-2018-7837 affects Schneider Electric IIoT Monitor (version 3.1.38 and earlier). The connected advisories describe an improper restriction of XML External Entity (XXE) references in multiple components (e.g., RuleMgmt addRule, AccountMgmt, EventMgmt, Login/Logout, and others) that can cause th...

CVE-2018-7836

An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files...

CVE-2018-7836

Schneider Electric IIoT Monitor vulnerability CVE-2018-7836 (Unrestricted Upload of File with Dangerous Type) affects version 3.1.38 and earlier. The connected advisories describe a path to remote code execution via uploading malicious files, with high-severity impact (CVSS v3 base score 9.3). Ex...

CVE-2018-7835

Schneider Electric IIoT Monitor (versions 3.1.38 and older) contains a path traversal vulnerability (CVE-2018-7835) that may allow an attacker to access files reachable to the SYSTEM user. Multiple connected sources (ZDI-19-020, ICS-CERT Update A, CNVD-2019-03466) describe this as an improper val...

CVE-2018-7837

An Improper Restriction of XML External Entity Reference 'XXE' vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its outp...

CVE-2018-7837: Improper Restriction of XML External Entity Reference

An Improper Restriction of XML External Entity Reference 'XXE' vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its outp...

CVE-2018-7835: Improper Limitation of a Pathname to a Restricted Directory

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files available to SYSTEM user...

CVE-2018-7836: Unrestricted Upload of File with Dangerous Type

An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files...

qemu security update

15:3.0.0-3.el7 - monitor: guard iothread access by mon-useiothread Wolfgang Bumiller Orabug: 29046045 - monitor: delay monitor iothread creation Wolfgang Bumiller Orabug: 29010480 - Revert 'qmp: isolate responses into io thread' Marc-Andre Lureau Orabug: 29010480 - usb-mtp: outlaw slashes in...

OracleVM 3.3 / 3.4 : ntp (OVMSA-2018-0290)

The remote OracleVM system is missing necessary patches to address critical security updates : - add disable monitor to default ntp.conf CVE-2013-5211 - fix buffer overflow in parsing of address in ntpq and ntpdc CVE-2018-12327 - fix CVE-2016-7429 patch to work correctly on multicast client 14229...

PT-2018-2186

Name of the Vulnerable Software and Affected Versions IIoT Monitor version 3.1.38 Description An Improper Restriction of XML External Entity Reference 'XXE' issue exists in numerous methods of the software, allowing it to resolve documents outside of the intended sphere of control. This could cau...

PT-2018-2184

Name of the Vulnerable Software and Affected Versions IIoT Monitor version 3.1.38 Description A Path Traversal vulnerability exists in the software, which could allow access to files available to the SYSTEM user. This issue is related to the lack of filtering of special symbols, potentially...

PT-2018-2185

Name of the Vulnerable Software and Affected Versions Schneider Electric IIoT Monitor version 3.1.38 Description The issue is related to the lack of restrictions on file uploads, allowing a remote attacker to upload and execute malicious files that can be automatically processed within the produc...

The vulnerability of network monitoring software for PRTG Network Monitor lies in the insecure management of privileges. This allows a malicious actor with the “read-only” privilege to create users with the “read-write” privilege.

The vulnerability of the network monitoring software PRTG Network Monitor relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor, who has the “read-only” privilege, to create users with “read-write” privileges, including administrators, by using ...

ntp security update

4.2.6p5-15.0.1 - add disable monitor to default ntp.conf CVE-2013-5211 4.2.6p5-15 - fix buffer overflow in parsing of address in ntpq and ntpdc CVE-2018-12327 4.2.6p5-14 - fix CVE-2016-7429 patch to work correctly on multicast client 1422973 4.2.6p5-13 - fix buffer overflow in datum refclock driv...

CVE-2018-18921

PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action...

CVE-2018-18921

PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action...

Cross site request forgery (csrf)

PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action...

CVE-2018-18921

PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action...

CVE-2018-18921

PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action...