Meltdown and Spectre update for WildFire-500 Appliance

Palo Alto Networks has determined that the WildFire-500 WF-500 appliance is affected by the vulnerability disclosures known as Meltdown and Spectre, and has completed an update to address these issues. The WF-500 software update is now available to customers that use the WF-500 appliance for...

HackerOne: Information disclosure

Summary: Chaining few simple informative issues on HackerOne platform and applying new method of timing attack, exploiting interesting feature in HTML5 https://developer.mozilla.org/en-US/docs/Web/API/ResourceTimingAPI/UsingtheResourceTimingAPI more precise Copy with CORSwe can perform low cost,...

Silex SD-320AN and GE MobileLink Unauthorized Operation Vulnerability

Silex SD-320AN is a serial device server from Silex Technology, Japan. GE MobileLink GEH-500 is an electrocardiogram analysis system from General Electric GE. A security vulnerability exists in Silex SX-500 and GE MobileLink GEH-500 versions 1.54 and earlier, which arises from the program's failu...

CVE-2018-6020

In Silex SX-500 all versions and GE MobileLinkGEH-500 version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings...

CVE-2018-6020

In Silex SX-500 all versions and GE MobileLinkGEH-500 version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings...

Authentication flaw

In Silex SX-500 all versions and GE MobileLinkGEH-500 version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings...

CVE-2018-6020

In Silex SX-500 all versions and GE MobileLinkGEH-500 version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings...

CVE-2018-6020

CVE-2018-6020 affects Silex SX-500 series and GE MobileLink (GEH-500) devices (version 1.54 and earlier). The vulnerability is an improper authentication on certain POST requests, allowing an attacker to modify system settings. Public documentation from ICS-CERT/ENISA details that these products ...

Silex Technology SX-500/SD-320AN or GE Healthcare MobileLink (Update B)

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION : Exploitable Remotely / Low skill level to exploit / Public exploits are available Vendors : Silex Technology, GE Healthcare Equipment : SX-500, SD-320AN, MobileLink Vulnerabilities : Improper Authentication, OS Command Injection 2. UPDATE INFORMATION...

New BEC Spam Campaign Targets Fortune 500 Businesses

Researchers have identified a wave of new business email compromise campaigns targeting Fortune 500 companies that are designed to trick victims into fraudulent wire transfers. Researchers said the campaigns originate from Nigeria and are targeting companies in the retail, healthcare and financia...

Welcome Our New CMO, Renata Budko

By Ivan Novikov We have ended 2017 with an oomph — having record revenues, on-boarding new marquee Fortune 500 customers and forging new partnerships. We are also growing our team and I would like to welcome Renata Budko joining us as our new Chief Marketing Officer. We’re really excited to have...

3 of 5 Fortune 500 companies vulnerable due to ManageEngine flaws

By Waqas Hackers can exploit security flaws in ManageEngine software to gain administrator type control This is a post from HackRead.com Read the original post: 3 of 5 Fortune 500 companies vulnerable due to ManageEngine flaws...

CVE-2017-12308

A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation ...

Design/Logic Flaw

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-12736

CVE-2017-12736 affects Siemens Ruggedcom ROS and SCALANCE devices. After initial configuration, the Ruggedcom Discovery Protocol (RCDP) can still write to the device under certain conditions, potentially allowing an attacker in the adjacent network to perform unauthorized administrative actions. ...

CVE-2017-17888

The CVE-2017-17888 entry concerns Anti-Web (up to version 3.8.7) used in multiple industrial/OT devices (NetBiter/HMS, Ouman EH-net, Alliance WS100 → AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, ASCON DY WebServer). Vulnerability: remote authe...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-3186

CVE-2017-3186 affects ACTi cameras (D, B, I, E series) with firmware A1D-500-V6.11.31-AC, which uses non-random default admin credentials across all devices, enabling a remote attacker to take complete control of the device. Related issues include CVE-2017-3184 (factory-reset access) and CVE-2017...

Information disclosure

IBM Rhapsody DM products could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124359...

CVE-2017-1240

CVE-2017-1240 affects IBM Rational Rhapsody Design Manager (RDM) within IBM CLM family. Affected versions: RDM 4.0–4.0.7, 5.0–5.0.2, and 6.0–6.0.4. Description in connected sources shows an information-disclosure flaw where sensitive data could be exposed via HTTP 500 Internal Server Error respon...