Siemens多款产品 路径遍历漏洞

SCALANCE M-800, MUM-800 and S615 and RUGGEDCOM RM1224 are industrial routers. A path traversal vulnerability exists in multiple Siemens products, which can be exploited by an attacker to append arbitrary values, resulting in a compromise of system integrity...

Siemens多款产品 安全漏洞

SCALANCE M-800, MUM-800 and S615 and RUGGEDCOM RM1224 are industrial routers. An input validation error vulnerability exists in multiple Siemens products, which can be exploited by an attacker to execute arbitrary code on the device...

Siemens多款产品 访问控制错误漏洞

SCALANCE M-800, MUM-800 and S615 and RUGGEDCOM RM1224 are industrial routers. An access control error vulnerability exists in multiple Siemens products that can be exploited by an attacker to cause a temporary denial of service condition...

Siemens SCALANCE M-800 Family

SUMMARY SCALANCE M-800 family before V8.2 is affected by multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. 2. GENERAL RECOMMENDATIONS As a general security measure, Siemens strongly recommends to protect network...

The vulnerability of the microprogrammed software of the SCALANCE M-800 industrial routers stems from incorrect processing of input data in the configuration fields of VPNs. This allows attackers to execute arbitrary code.

The vulnerability of the microprogrammed software of the SCALANCE M-800 industrial routers is related to incorrect processing of input data in the configuration fields of VPNs. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the microprogrammed software of industrial routers SCALANCE M-800, related to insufficient protection of registration data, allows a hacker to replace other users’ 2FA tokens and expose the protected information.

The vulnerability of the microprogrammed software in industrial routers SCALANCE M-800 is related to insufficient protection for registration data. Exploiting this vulnerability could allow a hacker to replace other users’ 2FA tokens and expose the protected information...

Acronym Overdose – Navigating the Complex Data Security Landscape

In the modern enterprise, data security is often discussed using a complex lexicon of acronyms—DLP, DDR, DSPM, and many others. While these acronyms represent critical frameworks, architectures, and tools for protecting sensitive information, they can also overwhelm those trying to piece together...

The FIPS Compliance of HKDF

HKDF is an HMAC-based key-derivation function specified in RFC 5869. It’s nice and we generally like using it. FIPS Federal Information Processing Standards is used generally as a moniker for the set of standards, recommendations, and guidance published by the U.S. National Institute of Standards...

openSUSE Security Advisory (SUSE-SU-2024:3106-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: libopenssl-3-devel / libopenssl-3-devel-32bit / etc (SUSE-SU-2024:3106-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3106-1 advisory. - CVE-2024-6119: Fixed denial of service in X.509 name checks bsc1229465 Other fixes: - FIPS: Deny SHA-1...

SUSE-SU-2024:3106-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2024-6119: Fixed denial of service in X.509 name checks bsc1229465 Other fixes: - FIPS: Deny SHA-1 signature verification in FIPS provider bsc1221365. - FIPS: RSA keygen PCT requirements. - FIPS: Check that the fips provider is available...

CVE-2024-42274

In the Linux kernel, the following vulnerability has been resolved: Revert "ALSA: firewire-lib: operate for period elapse event in process context" Commit 7ba5ca32fe6e "ALSA: firewire-lib: operate for period elapse event in process context" removed the process context workqueue from...

CVE-2024-42274 Revert "ALSA: firewire-lib: operate for period elapse event in process context"

In the Linux kernel, the following vulnerability has been resolved: Revert "ALSA: firewire-lib: operate for period elapse event in process context" Commit 7ba5ca32fe6e "ALSA: firewire-lib: operate for period elapse event in process context" removed the process context workqueue from...

CVE-2024-42274 Revert "ALSA: firewire-lib: operate for period elapse event in process context"

In the Linux kernel, the following vulnerability has been resolved: Revert "ALSA: firewire-lib: operate for period elapse event in process context" Commit 7ba5ca32fe6e "ALSA: firewire-lib: operate for period elapse event in process context" removed the process context workqueue from...

CVE-2024-42274

CVE-2024-42274 affects the Linux kernel’s ALSA firewire-lib. Reverting commit 7ba5ca32fe6e caused by removing the process-context workqueue from amdtp_domain_stream_pcm_pointer() and update_pcm_pointers() introduced AB/BA deadlock competition for the substream lock, potentially freezing systems u...

CVE-2024-42274 Revert "ALSA: firewire-lib: operate for period elapse event in process context"

In the Linux kernel, the following vulnerability has been resolved: Revert "ALSA: firewire-lib: operate for period elapse event in process context" Commit 7ba5ca32fe6e "ALSA: firewire-lib: operate for period elapse event in process context" removed the process context workqueue from...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an incorrect commit causing a compatibility issue with RME Fireface 800 devices, resulting in a system freez...

HHS OIG Report Underscores Challenges of Securing the Cloud

On July 22, 2024, HHS Health and Human Services OIG published a report identifying a need for the Department of Health and Human Services, Office of the Secretary HHS OS to improve key security controls to better protect cloud information systems. The report, while focused on HHS OS, underscores...

Siemens SCALANCE M-800, RUGGEDCOM RM1224

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

IV Collision

github.com/bincyber/go-sqlcrypter is vulnerable to IV Collision. The vulnerability is due to using a random IV, which can exceed the safe limit of encrypting plaintext above 2^32 in size under the same key as stated by NIST SP 800-38D, potentially allowing attackers to decrypt messages if IV...