CVE-2016-5950

CVE-2016-5950 affects IBM Kenexa LCMS Premier on Cloud. The vulnerability is that credentials are stored in plain text and could be read by an authenticated user, exposing sensitive information. The incident is documented with a CVSS3.0 base score of 6.5 (C:H/I:N/A:N) and CVSS2.0 base score 4.0 (...

Ubuntu: Security Advisory (USN-3179-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Update Rollup 6 for System Center 2012 R2 Orchestrator - Service Provider Foundation

Update Rollup 6 for System Center 2012 R2 Orchestrator - Service Provider Foundation Introduction This article describes the issues that are fixed in Update Rollup 6 for Microsoft System Center 2012 R2 Orchestrator - Service Provider Foundation. This article also contains the installation...

IBM BigFix Remote Control Information Disclosure Vulnerability (CNVD-2016-11859)

IBM BigFix Remote Control is a set of remote control systems from IBM in the United States. An information disclosure vulnerability exists in IBM BigFix Remote Control 9.1.2 and earlier versions, where the vulnerable program stores passwords in clear text. A local attacker can exploit this...

Design/Logic Flaw

A vulnerability has been identified in SIMATIC CP 343-1 Advanced incl. SIPLUS NET variant All versions V3.0.53, SIMATIC CP 443-1 Advanced incl. SIPLUS NET variant All versions V3.2.17, SIMATIC S7-300 PN/DP CPU family incl. SIPLUS variants All versions, SIMATIC S7-400 PN/DP CPU family incl. SIPLUS...

Phoenix Contact ILC Information Disclosure Vulnerability

Phoenix Contact ProConOs and MultiProg are programmable logic controllers PLCs for use in industrial PCs from the Phoenix Contact group. An information disclosure vulnerability exists in Phoenix Contact ILC PLCs due to sensitive information being stored in clear text. An attacker could exploit th...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2016-09647)

IBM Security Guardium is a data activity monitor product from IBM USA. The product offers features such as automated controls for compliance and protection against internal and external threats. An information disclosure vulnerability exists in IBM Security Guardium that originates from...

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions Information Disclosure Vulnerabilities

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions are Auto-Matrix USA's building automation front-end solutions for infrastructure, which are primarily deployed stateside in commercial facilities, critical manufacturing and energy and wastewater systems I&C. A...

Vulnerabilities in Insulin Pumps Can Lead to Overdose

Patients who use insulin pumps made by Johnson & Johnson are being warned this week that vulnerabilities in the devices could be exploited to trigger an overdose. The bugs exist in OneTouch Ping, a medical device made by Animas Corp. – a subsidiary of Johnson & Johnson – which allows diabetic...

USN-3087-2: OpenSSL regression

USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was incomplete and caused a regression when parsing certificates. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Shi Lei discovered that OpenSSL incorrectly handled the OCSP Statu...

OmniMetrix OmniView Vulnerabilities

OVERVIEW Bill Voltmer of Elation Technologies LLC has identified vulnerabilities in OmniMetrix’s OmniView web application. OmniMetrix has produced a new software version for its web interface that mitigates these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCT...

FortiClient SSL-VPN 5.4 Clear Text Password Extraction

Title : Extracting clear text passwords from running processesFortiClient CVE-ID : none Product : FortiClient SSLVPN Service : FortiTray.exe Affected : =5.4 Impact : Critical Remote : No Website link : http://forticlient.com/ Reported : 31/08/2016 Authors : Viktor Minin https://1-33-7.com Alexand...

IBM BixFix Platform Man-in-the-Middle Information Disclosure Vulnerability

IBM BigFix formerly known as IBM Endpoint Manager, Tivoli Endpoint Manager is a set of system management software from the American company IBM. The software provides remote control, patch management, software distribution, operating system deployment, network access protection and other function...

Phoenix Contact ILC PLC Authentication Vulnerabilities

OVERVIEW Matthias Niedermaier and Michael Kapfer of HSASec Hochschule Augsburg have identified authentication vulnerabilities in Phoenix Contact’s ILC inline controller PLCs. Phoenix Contact GmbH & Co. KG has produced a mitigation plan that includes an update and recommended security practices to...

IBM QRadar SIEM Information Disclosure Vulnerability (CNVD-2016-05955)

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. IBM QRadar SIEM ha...

Paragon Initiative Enterprises: [URGENT] Password reset emails are sent in clear-text (without encryption)

Hey, I've found that when we use the 'forgot password' page to recover our password, bridge.cspr.ng sends an email to us, and when I tried to get more information about the email from [email protected], I saw that the email is sent in clear-text instead of TLS which is so vulnerable since any...

IBM UrbanCode Deploy Information Disclosure Vulnerability (CNVD-2016-03996)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

Meteocontrol WEB'log Information Disclosure Vulnerability (CNVD-2016-03190)

Meteocontrol WEB'log is a web-based SCADA system that provides energy and power configuration management functions using different connected devices. Several Meteocontrol WEB'log products store information in clear text, allowing remote attackers to exploit vulnerabilities to obtain sensitive...

Meteocontrol WEB'log Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-133-01 Meteocontrol WEB'log Vulnerabilities that was published May 12, 2016, on the NCCIC/ICS‑CERT web site. Independent researcher Karn Ganeshen has identified one authentication and two information exposure...

Moxa MiiNePort Information Disclosure Vulnerability

Moxa MiiNePort is an embedded device networking module designed for manufacturers to connect serial devices to a network connection. Moxa MiiNePort stores information in clear text and does not provide a protection mechanism, allowing an attacker to view sensitive or configuration information...