High-Severity Flaw Reported in Critical System Used by Oil and Gas Companies

Cybersecurity researchers have disclosed details of a new vulnerability in a system used across oil and gas organizations that could be exploited by an attacker to inject and execute arbitrary code. The high-severity issue, tracked as CVE-2022-0902 CVSS score: 8.1, is a path-traversal vulnerabili...

Intel® Server Boards and Server Systems Advisory

Summary: Potential security vulnerabilities in some Intel® Server Boards and Server Systems may allow escalation of privilege or denial of service. Intel is releasing firmware updates to mitigate these potential vulnerabilities Vulnerability Details: CVEID: CVE-2022-30542 Description: Improper...

2022.3 IPU – BIOS Advisory

Summary: Potential security vulnerabilities in the BIOS firmware for some Intel® Processors may allow escalation of privilege. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2022-26006 Description: Improper input validation in th...

Multiple race conditions due to TOCTOU flaws in various UEFI Implementations

Overview Multiple Unified Extensible Firmware Interface UEFI implementations are vulnerable to code execution in System Management Mode SMM by an attacker who gains administrative privileges on the local machine. An attacker can corrupt the memory using Direct Memory Access DMA timing attacks tha...

2022.1 IPU - Intel® Processor Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-21151 Description: Processor optimization removal or modification of...

Intel® Processors MMIO Stale Data Advisory

Summary: Potential security vulnerabilities in Memory Mapped I/O MMIO for some Intel® Processors may allow information disclosure. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2022-21123 Description: Incomplete cleanup of...

2022.2 IPU - Intel® Processor Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing firmware updates to address this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-21233 Description: Improper isolation of shared resources in some IntelR...

CVE-2022-36360

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Affected devices load firmware updates without checking the authenticity. Furthermore the integrity of the unencrypted firmware is only verified by a non-cryptographic method. This could allow an attacker t...

CVE-2022-36360

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Affected devices load firmware updates without checking the authenticity. Furthermore the integrity of the unencrypted firmware is only verified by a non-cryptographic method. This could allow an attacker t...

PT-2022-23329 · Siemens · Logo! 8 Bm

Name of the Vulnerable Software and Affected Versions: LOGO! 8 BM incl. SIPLUS variants versions prior to V8.3 Description: A vulnerability has been identified where affected devices load firmware updates without checking the authenticity. The integrity of the unencrypted firmware is only verifie...

Vulnerabilities fixed in Rockwell FactoryTalk Vantagepoint

Rockwell Automation has fixed two vulnerabilities in FactoryTalk Vantagepoint. A malicious person with limited privileges could exploit the vulnerabilities to use SQL injection to gain access gain access to sensitive data and execute arbitrary code on the underlying SQL Database. Rockwell...

PT-2022-7298 · Acer · Acer Veriton E430 +18

Name of the Vulnerable Software and Affected Versions: Acer Altos T110 F3 firmware version = P13 Acer AP130 F2 firmware version = P04 Acer Aspire 1600X firmware version = P11.A3L Acer Aspire 1602M firmware version = P11.A3L Acer Aspire 7600U firmware version = P11.A4 Acer Aspire MC605 firmware...

PT-2022-25420

FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to unauthenticated arbitrary command injection through the funjsq access token parameter. This affects R6230 befor...

Ubuntu 22.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-5599-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5599-1 advisory. Asaf Modelevsky discovered that the IntelR 10GbE PCI Express ixgbe Ethernet driver for the Linux kernel performed insufficient control flow management. A...

Honeywell Trend Controls Inter-Controller Protocol

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low attack complexity Vendor: Honeywell Equipment: Trend Controls IQ Series that utilize Inter-Controller IC protocol Vulnerability: Cleartext Transmission of Sensitive Information CISA is aware of a public report, known as “OT:ICEFALL” that details...

Security Bulletin: This Power System update is being released to address CVE-2019-16649 and CVE-2019-16650

Summary POWER8 and POWER9: In response to security issues with virtual media, new Power System firmware updates are being released to address Common Vulnerabilities and Exposures issue numbers CVE-2019-16649 and CVE-2019-16650. Vulnerability Details CVEID:CVE-2019-16649 DESCRIPTION: Multiple...

Intel® Ethernet Controllers and Adapters Advisory

Summary: Potential security vulnerabilities in some Intel® Ethernet Controllers and Adapters may allow denial of service. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2021-33126 Description: Improper access control in the...

CVE-2022-30262

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have n...

CVE-2022-30262

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have n...

CVE-2022-30262

The CVE-2022-30262 entry concerns Emerson ControlWave ‘Next Generation’ RTUs (through 2022-05-02) with firmware updates transmitted over BSAP-IP. The vulnerability is insufficient verification of data authenticity: firmware images in CAB archives are not authenticated (no signing) and rely on ins...