PT-2018-1524

Name of the Vulnerable Software and Affected Versions Modicon M221 versions prior to V1.6.2.0 Description A Permissions, Privileges, and Access Control issue exists, allowing unauthorized users to overwrite the original password with their own. This could enable an attacker to upload the original...

PT-2018-1525

Name of the Vulnerable Software and Affected Versions Modicon M221 versions prior to V1.6.2.0 Description A Permissions, Privileges, and Access Control issue exists, allowing unauthorized users to decode passwords using a rainbow table. This could enable a remote attacker to exploit the...

Samsung SmartThings Hub hubCore ZigBee firmware update CRC16 check denial-of-service vulnerability(CVE-2018-3926)

Summary An exploitable integer underflow vulnerability exists in the ZigBee firmware update routine of the hubCore binary of the Samsung SmartThings Hub. The hubCore process incorrectly handles malformed files existing in its "data" directory, leading to an infinite loop, which eventually causes...

Security Bulletin: IBM Security Identity Governance and Intelligence has released a fixpack in response to the vulnerabilities known as Spectre and Meltdown

Summary IBM has released the following fixpack for IBM Security Identity Governance and Intelligence in response to CVE-2017-5753 and CVE-2017-5754 Vulnerability Details CVEID: CVE-2017-5753 DESCRIPTION: Intel Haswell Xeon, AMD PRO and ARM Cortex A57 CPUs could allow a local authenticated attacke...

Integrated Management Module 2 (IMM2) First Failure Data Capture (FFDC) Information Disclosure - US

Lenovo Security Advisory: LEN-20227 Potential Impact: Information disclosure Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2018-9068 Summary Description: The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware...

Integrated Management Module 2 (IMM2) First Failure Data Capture (FFDC) Information Disclosure - Lenovo Support US

No description provided...

Vulnerability Spotlight: Multiple Vulnerabilities in Samsung SmartThings Hub

These vulnerabilities were discovered by Claudio Bozzato of Cisco Talos. Executive Summary Cisco Talos recently discovered several vulnerabilities present within the firmware of the Samsung SmartThings Hub. In accordance with our coordinated disclosure policy, Cisco Talos has worked with Samsung ...

Security Bulletin: IBM QRadar Network Security is affected by procps-ng procps vulnerabilities

Summary IBM QRadar Network Security has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-1126 DESCRIPTION: procps-ng procps is vulnerable to a buffer overflow, caused by improper bounds checking. By sending a specially-crafted request, a remote attacker could overflo...

MGASA-2018-0323 Updated nonfree firmware packages fixes security vulnerabilities

This firmware update fixes the following security issues: bcm4356, bcm4354, bcm43362, bcm43340, bcm43430: - dropping replayed M3 for offloaded 4-way handshake CVE-2017-13077, CVE-2017-13078, CVE-2017-13079 - dropping replayed G1 for offloaded GTK rekey CVE-2017-13080, CVE-2017-13081 Also in this...

Updated nonfree firmware packages fixes security vulnerabilities

This firmware update fixes the following security issues: bcm4356, bcm4354, bcm43362, bcm43340, bcm43430: - dropping replayed M3 for offloaded 4-way handshake CVE-2017-13077, CVE-2017-13078, CVE-2017-13079 - dropping replayed G1 for offloaded GTK rekey CVE-2017-13080, CVE-2017-13081 Also in this...

WL-330NUL vulnerable to cross-site request forgery

Overview WL-330NUL provided by ASUS Japan Inc. is a portable wireless LAN router. WL-330NUL contains a cross-site request forgery vulnerability CWE-352. Masashi Sakai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

JVN#71329812: WL-330NUL vulnerable to cross-site request forgery

WL-330NUL provided by ASUS Japan Inc. is a portable wireless LAN router. WL-330NUL contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in the management screen, unintended operations may be performed on the device. Solution Update the...

WAGO e!DISPLAY Web-Based-Management

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/Low skill level to exploit/Public exploits are available Vendor: WAGO Equipment: e!DISPLAY Web-Based-Management WBM Vulnerabilities: Cross-site Scripting, Unrestricted Upload of File with Dangerous Type, and Incorrect Permissions fo...

CVE-2016-6567

SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards, which according to the reporter may be used in some industrial control and embedded applications. The Resident Download Manager does not verify that the firmware is authentic before executi...

CVE-2016-6567

The CVE-2016-6567 entry describes SHDesigns’ Resident Download Manager for Rabbit 2000/3000 CPU boards as not authenticating firmware updates before executing code. A remote attacker able to send UDP traffic could potentially execute arbitrary code on the device. Public details indicate the Resid...

Lenovo Smart Assistant Factory Test Mode - US

Lenovo Security Advisory: LEN-22172 Potential Impact: Root access of the device Severity: Medium Scope of Impact: Lenovo Smart Assistant CVE Identifier: CVE-2018-9070 Summary Description: Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo. An attacker with physica...

Intel Q1’18 AMT 9.x/10.x/11.x Cumulative Update - US

Lenovo Security Advisory: LEN-21031 Potential Impact: Elevation of Privilege Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2018-3628, CVE-2018-3629, CVE-2018-3632 Summary Description: Intel performed a security review of their Intel® Management Engine ME firmware, and identifi...

Multiple vulnerabilities in Aterm HC100RC

Overview Aterm HC100RC provided by NEC Corporation contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2018-0634, CVE-2018-0635, CVE-2018-0636, CVE-2018-0637, CVE-2018-0638, CVE-2018-0639 Buffer Overflow CWE-119 - CVE-2018-0640, CVE-2018-0641 Taizoh Tsukamoto of Mits...

Multiple vulnerabilities in Aterm W300P

Overview Aterm W300P provided by NEC Corporation contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2018-0629, CVE-2018-0630, CVE-2018-0631 Buffer Overflow CWE-119 - CVE-2018-0632, CVE-2018-0633 Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this...

Multiple OS command injection vulnerabilities in Aterm WG1200HP

Overview Aterm WG1200HP provided by NEC Corporation contains multiple OS command injection vulnerabilities CWE-78. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...