Fortinet Warns of New Auth Bypass Flaw Affecting FortiGate and FortiProxy

Fortinet has privately warned its customers of a security flaw affecting FortiGate firewalls and FortiProxy web proxies that could potentially allow an attacker to perform unauthorized actions on susceptible devices. Tracked as CVE-2022-40684 CVSS score: 9.6, the critical flaw relates to an...

Cisco Expressway Series and Cisco TelePresence VCS Improper Certificate Validation Vulnerability (cisco-sa-expressway-csrf-sqpsSfY6)

According to its self-reported version, Cisco Expressway-C and Cisco TelePresence VCS devices are affected by a vulnerability in the certificate validation that could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability is due to a lack of...

Security Bulletin: IBM Smart Analytics System 5600 V3 is affected by a vulnerability in the IBM DB2 Fast Communications Manager (CVE-2013-4032)

Abstract A vulnerability in IBM DB2 for Linux, UNIX, and Windows could allow arbitrary data sent to the Fast Communications Manager FCM to cause server denial of service. Only IBM Smart Analytics System 5600 V3 systems that ship with IBM DB2 Version 10.1 are vulnerable. Content VULNERABILITY...

Security Bulletin: IBM Tivoli Directory Server use of NULL ciphers in default Transport Layer Security configuration would result in unencrypted communications (CVE-2012-0726)

Abstract IBM Tivoli Directory Server TDS enables NULL-MD5 and NULL-SHA ciphers in the default Transport Layer Security TLS configuration. Use of either of these ciphers would result in unencrypted communications. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-0726 DESCRIPTION: In the default TDS...

brodencommunications.com Cross Site Scripting vulnerability OBB-2951099

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Host Engineering H0-ECOM100 Communications Module 缓冲区错误漏洞

Host Engineering H0-ECOM100 Communications Module is a Host Engineering communications module from Host Engineering, Inc. A security vulnerability exists in the Host Engineering H0-ECOM100 Communications Module. An attacker could exploit the vulnerability to cause a stack-based buffer overflow by...

Authentication flaw

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an...

The vulnerability of the Infrastructure component of the Oracle Communications Billing and Revenue Management software allows a attacker to trigger a service failure.

The vulnerability of the Infrastructure component of the Oracle Communications Billing and Revenue Management software exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the HTTP protocol...

Code injection

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SST...

orbitcommunications.com Cross Site Scripting vulnerability OBB-2866824

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Ubuntu: Security Advisory (USN-833-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerabilities of opcua and asyncua libraries are related to uncontrolled resource consumption, which allows attackers to cause service failures.

The vulnerability of opcua and asyncua libraries is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

The vulnerability of the OPC UA node-opcua software implementation, related to incorrect resource cleanup or release, allows a perpetrator to trigger a service failure.

The vulnerability of the OPC UA node-opcua software implementation is related to incorrect cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

CVE-2021-4028

A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this...

Softing smartLink SW-HT 安全漏洞

The Softing smartLink SW-HT is a HART multiplexer from Softing that provides simple and fast access to HART field devices without additional hardware. A security vulnerability exists in the Softing smartLink SW-HT that arises from enabling weak passwords during secure communications SSL...

CVE-2022-30264

The CVE-2022-30264 issue affects Emerson ROC and FloBoss RTU lines (through 2022-05-02) where the ROC protocol on 4000/5000 TCP uses Opcode 203 to transfer files to/from flash, enabling arbitrary file read/write/delete. This constitutes insecure filesystem operations with high impact (confidentia...

Black Hat and DEF CON Roundup

There was nothing typical this year at BSides LV, Black Hat USA and DEF CON – also known collectively as Hacker Summer Camp. The weeklong collection of cybersecurity conferences featured an eclectic mix of attendees to learn, network, hack and have fun. The week even included a rare Las Vegas fla...

[SECURITY] Fedora 35 Update: gnutls-3.7.7-1.fc35

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

Splunk Enterprise < 9.0 Multiple Vulnerabilities

The version of Splunk installed on the remote host is prior to 9.0. It is, therefore, affected by multiple vulnerabilities. - The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority CA certificate stores by...

CVE-2022-20816

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to delete arbitrary files from an affected system. This...