PT-2017-3656

Name of the Vulnerable Software and Affected Versions: Red Lion Controls Sixnet-Managed Industrial Switches version 5.0.196 Red Lion Controls Stride-Managed Ethernet Switches version 5.0.190 Description: The issue is related to the use of hard-coded HTTP SSL/SSH keys in the firmware of the affect...

VIPA Controls WinPLC7

CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: VIPA Controls Equipment: WinPLC7 Vulnerability: Stack Buffer Overflow AFFECTED PRODUCTS The following versions of WinPLC7, a PLC programming software, are affected: WinPLC Versions 5.0.45.5921 and prior. IMPACT...

Google Upspin Secure File-Sharing Released to Open Source

Google has released to open source new file-sharing interfaces and protocols it calls Upspin that allow users to securely share files using a global namespace rather than uploading and downloading content or sharing it first with a web-based service. Upspin is largely a consumer tool, Google said...

CVE-2017-2365

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted...

CVE-2017-0310

All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper access controls allowing unprivileged user to cause a denial of service...

CVE-2017-0310

All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper access controls allowing unprivileged user to cause a denial of service...

CVE-2017-0310

All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper access controls allowing unprivileged user to cause a denial of service...

PT-2017-10513

Name of the Vulnerable Software and Affected Versions NVIDIA GPU Display Driver affected versions not specified Description The issue is related to improper access controls in the kernel mode layer handler, allowing an unprivileged user to cause a denial of service. Recommendations At the moment,...

Information disclosure

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...

CVE-2017-3813

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...

CVE-2017-3813

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...

CVE-2017-3813: Missing Authorization

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...

Cisco AnyConnect Secure Mobility Client for Windows SBL Privileges Escalation Vulnerability

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...

Teleopti WFM 7.1.0 Information Disclosure / Access Controls

Advisory Title: Teleopti WFM Multiple Vulnerabilities Date: 2/4/2017 Researcher: Graph-X email: [email protected] Vendor Homepage: http://www.teleopti.com Version: = 7.1.0 CVE: is dead Disclosure Timeline 8/30/2016 Initial contact made to alert Teleopti of the flaws 9/2/2016 Vulnerabilities...

DEBIAN-CVE-2017-5610

wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms...

browsers Internet Explorer and Security Bypass

The vulnerability of Internet Explorer and Microsoft Edge is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass existing access control policies using uncertain vectors...

ICSMA-17-017-01_BD Alaris 8000 Insufficiently Protected Credentials Vulnerability

OVERVIEW This advisory was originally posted to the NCCIC Portal on January 17, 2017, and is being released to the NCCIC/ICS-CERT web site. Becton, Dickinson and Company BD has identified an insufficiently protected credentials vulnerability in BD’s Alaris 8000 Point of Care PC unit, which provid...

Starbucks: Lack of Controls Allowing for Card and PIN Enumeration Leading to Fraud

Summary: The pages https://www.starbucks.com/account/card/addcard and https://www.starbucks.com/account/card/Balance do not properly enforce security controls to limit POST requests. This bug allows attackers to successfully hijack a loaded Starbucks card and transfer all the funds into their own...

KLA10937 Obsolete Adobe Flash Player for Windows

Microsoft released update to address vulnerabilities in Flash Player for Internet Explorer. For details look at KLA10936. Technical details To mitigate this vulnerability you can implement some of workarounds listed in original Microsoft advisory: disable Adobe Flash Player, prevent Adobe FP from...

MS12-060: Description of the security update for Office 2010: August 14, 2012

MS12-060: Description of the security update for Office 2010: August 14, 2012 View products that this article applies to.Microsoft has released the security bulletin MS12-060. You can view the complete security bulletin by going to one of the following Microsoft websites: Home users:...