ISC Releases Security Updates for BIND

The Internet Systems Consortium ISC has released updates that address several vulnerabilities in BIND. An attacker could exploit one of these vulnerabilities to take control of an affected system. Available updates include: BIND version 9.11.1-P1 BIND version 9.10.5-P1 BIND version 9.9.10-P1 ISC...

Samsung Magician fails to update itself securely

Overview Samsung Magician fails to securely check for and retrieve updates, which an allow an authenticated attacker to execute arbitrary code with administrator privileges. Description Samsung Magician is a management utility for Samsung SSDs. Prior to version 5.0, Samsung Magician checks for an...

Google Releases Security Updates for Chrome

Google has released Chrome version 59.0.3071.104 for Windows, Mac, and Linux. This version addresses several vulnerabilities, including one that an attacker could exploit to cause a denial-of-service condition. US-CERT encourages users and administrators to review the Chrome Releases page and app...

Mozilla Releases Security Update

Mozilla has released a security update to address multiple vulnerabilities in Thunderbird. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the Mozilla Security Advisory for Thunderbird 52.2...

CVE-2017-4981

EMC RSA BSAFE Cert-C before 2.9.0.5 contains a potential improper certificate processing vulnerability...

Design/Logic Flaw

EMC RSA BSAFE Cert-C before 2.9.0.5 contains a potential improper certificate processing vulnerability...

CVE-2017-4981

CVE-2017-4981 affects EMC RSA BSAFE Cert-C prior to 2.9.0.5 and is described as a potential improper certificate processing vulnerability. The NVD entry lists CVSS v3.1 base score 7.5 (HIGH) with NETWORK attack vector, LOW attack complexity, NONE privileges, and HIGH availability impact; CVSS v2 ...

DHS, FBI Warn of North Korea 'Hidden Cobra' Strikes Against US Assets

United States top cybersecurity cops warned Tuesday that North Korean government threat actors are targeting U.S. businesses with malware and botnet-related attacks that are part of concerted effort dubbed “Hidden Cobra.” According to a United States Computer Emergency Readiness Team US-CERT...

OSIsoft PI Web API 2017

CVSS v3 7.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: OSIsoft Equipment: PI Web API 2017 Vulnerability: Cross-Site Request Forgery AFFECTED PRODUCTS OSIsoft reports that the vulnerability affects the following PI Web API products: PI Web API versions prior to 2017 1.9.0...

OSIsoft PI Server 2017

CVSS v3 8.9 ATTENTION: Remotely exploitable. Vendor: OSIsoft Equipment: PI Server 2017 Vulnerabilities: Improper Authentication AFFECTED PRODUCTS OSIsoft reports that the vulnerabilities affect the following PI Server products: PI Data Archive versions prior to 2017. IMPACT Successful exploitatio...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe Flash Player, Shockwave Player, Captivate, and Digital Editions. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review Adobe...

Mozilla Releases Security Updates

Mozilla has released security updates to address multiple vulnerabilities in Firefox and Firefox ESR. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the Mozilla Security Advisory for Firefo...

Trihedral Engineering Limited VTScada

CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Trihedral Engineering Limited Equipment: VTScada Vulnerability: Resource Consumption, Cross-Site Scripting, Information Exposure AFFECTED PRODUCTS The following versions of VTScada, an HMI SCADA software, are affected...

WiMAX CPE Authentication Bypass Vulnerability

Various WiMAX CPEs are vulnerable to an authentication bypass. An attacker can set arbitrary configuration values without prior authentication. The vulnerability is located in commit2.cgi implemented in libmtkhttpdplugin.so. title: Various WiMAX CPEs Authentication Bypass product: see "Vulnerable...

VMware Patches Critical Vulnerabilities in vSphere Data Protection

VMware fixed two critical vulnerabilities in its vSphere Data Protection solution this week that could have allowed an attacker to execute commands on the virtual appliance, among other outcomes. The Department of Homeland Security’s CERT encouraged users and admins on Wednesday to apply the...

FTC Recommends Steps to Protect Against Mobile Phone Theft

The Federal Trade Commission FTC has released an alert about the theft of mobile phones and the best way to prepare for and recover from this kind of theft. Precautionary steps include regularly backing up the data on the phone, using strong passwords, and using two-factor authentication on any...

Digital Canal Structural Wind Analysis

CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Digital Canal Structural Equipment: Wind Analysis Vulnerability: Stack-Based Buffer Overflow AFFECTED PRODUCTS The following versions of Wind Analysis, a structural engineering software platform, are affected: Wind...

SRC-2018-0004 : Delta Industrial Automation Screen Editor Project File Parsing CThemeWnd Type Confusion Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation Screen Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file...

SEI Issues Advice on Ransomware

The Software Engineering Institute SEI of Carnegie Mellon University has released a blog post on best practices for preventing and responding to ransomware. This common malware captures, encrypts, and holds your data to extort a ransom. SEI’s top recommendation to thwart ransomware attacks is to...

NXP i.MX Product Family

CVSS v3 6.0 REPOSTED INFORMATION This advisory was originally posted to the NCCIC Portal on June 1, 2017, and is being released to the NCCIC/ICS-CERT web site. AFFECTED PRODUCTS The following i.MX Devices, used on logic boards, are affected: Devices affected by the Stack Buffer Overflow...