FDA Urged to More Rigorously Evaluate Medical Devices' Security Risks

Lawmakers are urging the Food and Drug Administration to more thoroughly vet certain implantable medical devices for security, not just safety, risks. They include life-saving defibrillators, insulin pumps and pacemakers, which have been shown in recent years to be vulnerable to remote attacks...

IBM WebSphere Application Server 6.1 < Fix Pack 45 Multiple Vulnerabilities

IBM WebSphere Application Server 6.1 before Fix Pack 45 appears to be running on the remote host. As such, it is potentially affected by the following vulnerabilities : - An error exists related to 'Application Snoop Servlet' and missing access controls. This error can allow sensitive information...

CVE-2012-3741

CVE-2012-3741 affects Apple iOS prior to version 6, where the Restrictions (Parental Controls) feature may fail to require Apple ID authentication after a Disable Restrictions action, allowing a local user to complete purchases without password verification. The issue is described in the CVE entr...

CVE-2012-3741

The Restrictions aka Parental Controls implementation in Apple iOS before 6 does not properly handle purchase attempts after a Disable Restrictions action, which allows local users to bypass an intended Apple ID authentication step via an app that performs purchase transactions...

Microsoft FixIt Will Address IE Zero-Day Vulnerability

With Internet Explorer users still exposed to as many as four active exploits of a zero-day vulnerability in the browser, Microsoft Tuesday night said it will release a FixIt in the next couple of days that will address the issue. A FixIt is an automated tool provided by Microsoft that diagnoses...

CVE-2012-3034

WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a username and password via crafted parameters to unspecified methods in ActiveX controls...

Default credentials

WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a username and password via crafted parameters to unspecified methods in ActiveX controls...

CVE-2012-3034

The CVE-2012-3034 issue affects Siemens WinCC WebNavigator (used with SIMATIC PCS7) where crafted parameters to certain ActiveX controls allow remote attackers to obtain a user name and password. The root cause involves unsafe handling within ActiveX methods exposed by WebNavigator, enabling cred...

CVE-2012-3034

WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a username and password via crafted parameters to unspecified methods in ActiveX controls...

Microsoft Recommends Workarounds to Mitigate Latest IE Zero-Day; Patch Still to Come

Microsoft issued a security advisory Monday night and recommended several workarounds to mitigate a zero-day vulnerability in Internet Explorer reported over the weekend that is being exploited in the wild. Microsoft said it is still investigating the vulnerability, and may issue an out-of-band...

SAS70 Needs to Die

By Andrew Storms Let’s be clear, SAS70 should be sentenced to a quick and painful death in the bottom of a giant pit protected by 20-foot thick concrete walls where it should be buried forever, along-side other IT criminals such as Windows ME and IE6. While SAS70 has its place in financial...

Stack overflow

Stack-based buffer overflow in the HMIWeb Browser HSCDSPRenderDLL ActiveX control in Honeywell Process Solutions HPS Experion R2xx, R30x, R31x, and R400.x; Honeywell Building Solutions HBS Enterprise Building Manager R400 and R410.1; and Honeywell Environmental Combustion and Controls ECC Symmetr...

CVE-2012-0254

Stack-based buffer overflow in the HMIWeb Browser HSCDSPRenderDLL ActiveX control in Honeywell Process Solutions HPS Experion R2xx, R30x, R31x, and R400.x; Honeywell Building Solutions HBS Enterprise Building Manager R400 and R410.1; and Honeywell Environmental Combustion and Controls ECC Symmetr...

CVE-2012-0254

CVE-2012-0254 denotes a stack-based buffer overflow in the HMIWeb Browser HSCDSPRenderDLL ActiveX control, affecting Honeywell HPS Experion (R2xx, R30x, R31x, R400.x); HBS Enterprise Building Manager (R400, R410.1); and ECC SymmetrE (R410.1). The vulnerability can allow remote attackers to execut...

MS12-060: Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2720573)

There is an unspecified remote code execution vulnerability in Windows common controls, which is included in several Microsoft products. An attacker could exploit this by tricking a user into viewing a maliciously crafted web page, resulting in arbitrary code execution. %NASLMINLEVEL 70300 C...

Microsoft Windows Common Controls Remote Code Execution Vulnerability (2720573)

This host is missing a critical security update according to Microsoft Bulletin MS12-060. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2012-4334

The ConnectDDNS method in the 1 STWConfigNVR 1.1.13.15 and 2 STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i viewer 1.37.120316 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2012-4333

Multiple stack-based buffer overflows in the BackupToAvi method in the 1 UMSCtrl 1.5.1.1 and 2 UMSCtrlSTW 2.0.1.0 ActiveX controls in Samsung NET-i viewer 1.37.120316 allow remote attackers to execute arbitrary code via a long string in the fname parameter. NOTE: some of these details are obtaine...

Stack overflow

Multiple stack-based buffer overflows in the BackupToAvi method in the 1 UMSCtrl 1.5.1.1 and 2 UMSCtrlSTW 2.0.1.0 ActiveX controls in Samsung NET-i viewer 1.37.120316 allow remote attackers to execute arbitrary code via a long string in the fname parameter. NOTE: some of these details are obtaine...

Information disclosure

The ConnectDDNS method in the 1 STWConfigNVR 1.1.13.15 and 2 STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i viewer 1.37.120316 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: some of these details are obtained from third party information...