Threat Outbreak Alert RuleID31916: Email Messages Distributing Malicious Software on February 7, 2018

Medium Alert ID: 56695 First Published: 2018 February 7 16:13 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31916 may contain the following files: Name |...

Nari PCS-9611 (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit. Vendor : Nari Equipment : PCS-9611 Vulnerability : Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-18-025-01 Nari PCS-9611 that...

Advantech WebAccess/SCADA

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Advantech Equipment: WebAccess/SCADA Vulnerabilities: Path Traversal, SQL Injection AFFECTED PRODUCTS The following versions of WebAccess/SCADA, a SCADA software platform, are affected: WebAccess/SCADA versions prior ...

energy.gov.bn XSS vulnerability

Open Bug Bounty ID: OBB-470058 Description| Value ---|--- Affected Website:| energy.gov.bn Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ABB Ellipse

CVSS v3 6.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: ABB Equipment: Ellipse Vulnerability: Unprotected Transport of Credentials AFFECTED PRODUCTS ABB reports that the vulnerability affects Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 including Ellipse...

Operation Dragonfly Analysis Suggests Links to Earlier Attacks

ARCHIVED STORY Operation Dragonfly Analysis Suggests Links to Earlier Attacks By Trellix · December 17, 2017 On September 6, Symantec published details of the Dragonfly campaign, which targeted dozens of energy companies throughout 2017. This attack was effectively Dragonfly 2.0, an update to a...

Operation Dragonfly Analysis Suggests Links to Earlier Attacks

ARCHIVED STORY Operation Dragonfly Analysis Suggests Links to Earlier Attacks By Trellix · December 17, 2017 On September 6, Symantec published details of the Dragonfly campaign, which targeted dozens of energy companies throughout 2017. This attack was effectively Dragonfly 2.0, an update to a...

IBM Insights Foundation for Energy Information Disclosure Vulnerability

IBM Insights Foundation for Energy is an energy analytics, data management and visualization software solution for utilities and energy companies. An information disclosure vulnerability exists in IBM Insights Foundation for Energy 2.0. An authenticated user can exploit the vulnerability to obtai...

CVE-2017-1342

IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks. IBM X-Force ID: 126457...

CVE-2017-1342

IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks. IBM X-Force ID: 126457...

CVE-2017-1342

IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks. IBM X-Force ID: 126457...

CVE-2017-1342

IBM Insights Foundation for Energy 2.0 is affected by a publicly documented information-disclosure vulnerability. An authenticated user could learn sensitive details from error messages, which could be leveraged to conduct further attacks. The exact root cause, affected versions, and remediation ...

Code injection

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

CVE-2017-17436

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

CVE-2017-17435

An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request,...

CVE-2017-17435

An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request,...

CVE-2017-17436

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

CVE-2017-17435

CVE-2017-17435 (Vaultek VT20i / BlueSteal) : A vulnerability in Vaultek Gun Safe VT20i products allows remote unlocking without a valid PIN. An attacker who observes the BLE advertisement can write a BLE characteristic to enable notifications, craft a getAuthor packet that returns a temporary key...

Cloud Energy App has SMS Bombing Vulnerability

Cloud Energy App is a software about car rental service. There is an SMS bombing vulnerability in Cloud Energy App. An attacker can exploit the vulnerability to replay packets sending verification codes without restriction and bombard the client with SMS...

Advantech WebAccess

CVSS v3 7.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Advantech Equipment: WebAccess Vulnerabilities: Stack-based Buffer Overflow, Untrusted Pointer Dereference AFFECTED PRODUCTS The following versions of WebAccess, an HMI platform, are affected: WebAccess versions prior...