Update for Windows Server 2012 and Windows Embedded 8 Standard: June 21, 2019

Update for Windows Server 2012 and Windows Embedded 8 Standard: June 21, 2019 Summary This update for Windows Server 2012 and Windows Embedded 8 Standard includes the quality improvements from KB4503263 released June 11, 2019, in addition to these key changes: Addresses an issue that may display...

Microsoft DirectWrite AFDKO - Multiple Bugs in OpenType Font Handling Related to the _post_ Table

Microsoft DirectWrite AFDKO - Multiple Bugs in OpenType Font Handling Related to the post Table -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling library...

Microsoft DirectWrite / AFDKO - Stack Corruption in OpenType Font Handling While Processing CFF Blend DICT Operator

-----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling library written in C, which provides interfaces for reading and writing Type 1, OpenType, TrueType to some...

2019-07 Security Monthly Quality Rollup for Windows Embedded 8 Standard for x86-based Systems (KB4507462)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

The vulnerability of ABB’s automation control panels and the PB610 Panel Builder 600 software, which allows a intruder to read and write configuration files of HMI devices or trigger a system restart.

The vulnerabilities of ABB CP620 1SAP520100R0001, CP620 1SAP520100R4001, CP620-WEB 1SAP520200R0001, CP630 1SAP530100R0001, CP630-WEB 1SAP530200R0001CP, CP635 1SAP535100R0001, CP635 1SAP535100R5001, CP635-B 1SAP535100R2001, CP635-WEB 1SAP535200R0001, CP651 1SAP551100R0001, CP651-WEB 1SAP551200R000...

Countdown to Black Hat: Top 10 Sessions to Attend — #4

With Black Hat USA 2019 fast approaching, we continue our blog series highlighting training sessions and research briefings that we think Qualys customers will find relevant and valuable. Our pick this week is the training session An Introduction To IoT Pentesting With Linux. The course offers “a...

NetData Detection

Detection of NetData. The script sends a connection request to the server and attempts to detect NetData and to extract its version. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the...

PT-2019-9566 · Ibm · Ibm Rational Collaborative Lifecycle Management

Name of the Vulnerable Software and Affected Versions: IBM Rational Collaborative Lifecycle Management versions 6.0 through 6.0.6.1 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Libraries. Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

Embedthis GoAhead Buffer Overflow Vulnerability

Embedthis Software GoAhead is an embedded Web server from Embedthis Software, USA. A buffer overflow vulnerability exists in the http.c file in Embedthis GoAhead versions prior to 4.1.1 and 5.x versions prior to 5.0.1. The vulnerability stems from a network system or product performing operations...

The vulnerability of the RTU module’s microprogramming software, Modicon BMXNOR0200H, arises from the presence of embedded authentication data. This allows a hacker to gain access to the FTP service.

The vulnerability of the RTU module’s microprogramming software, Modicon BMXNOR0200H, is related to the presence of embedded authentication data. Exploiting this vulnerability could allow a malicious actor to gain access to the FTP service remotely...

CVE-2019-6325

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server that is potentially vulnerable to Cross-site Request Forgery...

CVE-2019-6326

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have embedded web server attributes which may be potentially vulnerable to Buffer Overflow...

CVE-2019-6325

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server that is potentially vulnerable to Cross-site Request Forgery...

CVE-2019-6326

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have embedded web server attributes which may be potentially vulnerable to Buffer Overflow...

Cross site scripting

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server potentially vulnerable to reflected XSS in wireless configuration page...

CVE-2019-6324

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server potentially vulnerable to stored XSS in wireless configuration page...

CVE-2018-12147

Insufficient input validation in HECI subsystem in IntelR CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access...

Cesanta Mongoose Embedded Web Server Library Resource Management Error Vulnerability (CNVD-2019-22662)

Cesanta Mongoose Embedded Web Server Library is a cross-platform embedded server and web library written in C. It is designed to be used with a wide range of applications, including... A resource management error vulnerability exists in the 'mghttpgetprotodata' function of the mongoose.c file in...