Crmsh Cluster Privilege Bypass

The vulnerability of the Crmsh cluster management interface is related to the lack of a mechanism for managing privileges. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Why You’re Not Making the Leap from Compliance to a Database Security Strategy

Gartner strongly recommends that the concept of “big data strategy” should be replaced with “making big data part of our everyday strategy.” Technology has created a database activity explosion for most enterprises and made traditional agent-based data logging, monitoring, and auditing far too...

SNMP – Simply Not My Problem. Or is it?

TL;DR: Use SNMPv3; long gone is default community strings, hello complex passwords! Remove from the internet, if required, implement a VPN solution to restrict access to only authorised parties. SNMP is a protocol used for the remote management of devices on a network. By remote, we mean access...

QEMU Disasinsn Buffer Overflow DoS

The vulnerability of the disasinsn function in the target/i386/translate.c component of the QEMU hardware emulation software is related to the lack of restrictions on instruction size. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and caus...

Johnson Controls Facility Explorer

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Equipment: Facility Explorer Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could give an authenticated user an unintended...

Sensormatic Electronics C-CURE 9000 (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Equipment: C-CURE 9000 Vulnerability: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...

Johnson Controls Facility Explorer security vulnerabilities

Johnson Controls Facility Explorer is a monitoring controller from Johnson Controls that provides scalable system-wide monitoring and control. A security vulnerability exists in Johnson Controls Facility Explorer that stems from improper privilege management and can be exploited by an attacker to...

Johnson Controls C-CURE: Input validation vulnerability

Johnson Controls C-CURE is a site server from Johnson Controls, Inc. It is a cost-effective access control solution for small sites requiring up to 64 card readers. An input validation error vulnerability exists in the Johnson Controls C-CURE 9000, which stems from the auto-update feature of the...

Johnson Controls exacqVision Web Service Detection

Binary data exacqVisionwebservicedetect.nbin...

Johnson Controls exacqVision Web Service Information Disclosure (JCI-PSA-2021-03)

Binary data exacqVisionwebservicecve-2021-27656.nbin...

CVE-2021-23275

The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfi...

MITRE ATT&CK® mappings released for built-in Azure security controls

The Security Stack Mappings for Azure research project was published today, introducing a library of mappings that link built-in Azure security controls to the MITRE ATT&CK® techniques they mitigate against. Microsoft once again worked with the Center for Threat-Informed Defense and other Center...

MITRE ATT&CK® mappings released for built-in Azure security controls

The Security Stack Mappings for Azure research project was published today, introducing a library of mappings that link built-in Azure security controls to the MITRE ATT&CK® techniques they mitigate against. Microsoft once again worked with the Center for Threat-Informed Defense and other Center...

ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch?

A flaw was discovered in Ruby in the way certain functions handled strings containing NULL bytes. Specifically, the built-in methods File.fnmatch and its alias File.fnmatch? did not properly handle path patterns containing the NULL byte. A remote attacker could exploit this flaw to make a Ruby...

Exacq Technologies exacqVision Enterprise Manager

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Exacq Technologies, Inc., a subsidiary of Johnson Controls Inc. Equipment: exacqVision Enterprise Manager Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this...

Exacq Technologies exacqVision Web Service

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Exacq Technologies, Inc., a subsidiary of Johnson Controls Inc. Equipment: exacqVision Web Service Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability...

Critical CISO Initiatives for the Second Half of 2021

As we all know, the coronavirus pandemic has affected CISOs and other security and risk-management leaders worldwide. Some of these leaders are developing and implementing security projects which are designed to simultaneously minimize the risk as well as support remote workers. In talking with o...

Johnson Controls ExacqVision Enterprise Manager Cross-site Scripting Vulnerability

Johnson Controls exacqVision Enterprise Manager is a suite of enterprise video management software from Johnson Controls. A security vulnerability exists in exacqVision Enterprise Manager 20.12 that arises from insufficient validation, filtering, escaping, and encoding of user-controllable input...

Johnson Controls ExacqVision Web Service cross-site scripting vulnerability

Johnson Controls exacqVision Web Service is a Johnson Controls, Inc. program that supports viewing live video, searching and playing video using a Web browser. A security vulnerability exists in exacqVision Web Service 21.03, which arises from insufficient validation, filtering, escaping, and...

Plan managed by specs allows to modify artifact dependencies with UI

h3. Issue Summary RSS-managed plan should be in View mode for every tab and page. h3. Steps to Reproduce Create plan managed by RSS with artifact subscription settings Open Plan config page and visit artifacts tab of job Click Edit or Delete button of artifact subscription item h3. Expected Resul...