SUSE SLES12 Security Update : kernel (SUSE-SU-2018:3772-1)

This update for the Linux Kernel 3.12.74-6064107 fixes one issue. The following security issue was fixed : CVE-2018-18386: The drivers/tty/ntty.c allowed local attackers who are able to access pseudo terminals to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus...

Microsoft Cryptography Next Generation Security Bypass Vulnerability

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. Cryptography Next Generation CNG is one of the cryptographic platforms. cng.sys driver is one of the drivers. A security bypass vulnerability exists in the cng.sys driver in Microsoft C...

CVE-2017-15108

spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed...

CVE-2017-5754

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache...

openstack-tripleo-heat-templates package information disclosure vulnerability

The openstack-triple-heat-templates package is a set of generic template packages that support installation, upgrades, and other operations on the Openstack platform using the Openstack Cloud Facility. A security vulnerability exists in the openstack-tripleo-heat-templates package that stems from...

The vulnerability of the microprogramming software of Siemens SIMATIC STEP 7 (TIA Portal) arises from the improper storage of common keys in TIA project files. This allows attackers to gain access to confidential information.

The vulnerability of the microprogramming software of Siemens SIMATIC STEP 7 TIA Portal is related to the improper storage of common keys in TIA project files. Exploiting this vulnerability can allow an intruder, operating locally, to gain access to confidential information...

The vulnerability of the “ACTConfig” configuration file of the ABB PCM600 energy management and configuration tool allows a hacker to crack the password and gain access to the main application.

The vulnerability of the “ACTConfig” configuration file of the ABB PCM600 energy management and configuration tool is related to insufficient calculation of the password hash using a unreliable function with a hard-coded key and initialization vector. Exploiting this vulnerability allows an...

Cisco IR800 Integrated Services Router Software Command Execution Vulnerability

Cisco IR800 Integrated Services Router Software is a suite of software from Cisco that runs in routers. the ROM Monitor is one of the resource monitors. A command execution vulnerability exists in the ROM Monitor ROMMON code in the Cisco IR800 Integrated Services Router Software, which arises fro...

sosreport information disclosure vulnerability

sosreport is a set of tools for collecting log information on all systems. The tool supports automatic zipping of the collected information into a compressed package and provides MD5 checksums. A security vulnerability exists in sosreport version 3.2, which stems from the program assigning weak...

CVE-2017-5042

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...

CVE-2017-0531

An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...

The vulnerability of the Android operating system, which allows a hacker to gain access to data

The vulnerability in the initial loader of the Android operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow a local attacker to access data beyond their authorized access level. This issue is considered “high” because it could be used to...

The vulnerability of the control device in the electrical energy sector, SICAM PAS, allows a intruder to access the database.

The vulnerability of the telecontrol device in the electric energy sector, SICAM PAS, is related to the storage of passwords in a recoverable format. Exploiting this vulnerability allows a malicious actor, who operates locally and has completed the authentication process, to restore user password...

The vulnerability of the ABB PCM600 control and configuration device allows a intruder to gain access to user passwords.

The vulnerability of the ABB PCM600 control and configuration device lies in the use of reversible encryption for passwords stored in the ACTConfig configuration file. Exploiting this vulnerability could allow an attacker acting locally to gain access to user passwords...

Vulnerabilities in the Debian GNU/Linux operating system that allow a local attacker to compromise the confidentiality of protected information

The multiple vulnerabilities in the libgcrypt11 package of the Debian GNU/Linux operating system may lead to a violation of the confidentiality of protected information. These vulnerabilities can be exploited by local malicious individuals...

ABB PCM600 Credential Protection Vulnerability (CNVD-2016-03749)

The ABB PCM600 is a protection and control IED manager, primarily used in the energy industry. A vulnerability exists in the way the ABB PCM600 authentication credentials are saved. A local attacker could exploit this vulnerability to gain access to the affected device...

Siemens APOGEE Insight Information Disclosure Vulnerability

Siemens APOGEE Insight is a building automation control system from Siemens, Germany. A security vulnerability exists in Siemens APOGEE Insight, which originates when the program assigns weak privileges to the application folder. A local attacker could exploit the vulnerability to obtain sensitiv...

IBM SPSS Modeler Information Disclosure Vulnerability

IBM SPSS Modeler formerly known as Clementine is a set of data mining platforms from the American company IBM. The platform provides a visual environment for rapid model building, and provides functions such as data source connection, data processing, modeling and analysis. A security vulnerabili...

setroubleshoot: insecure use of commands.getstatusoutput in sealert

A shell command injection flaw was found in the way the setroubleshoot executed external commands. A local attacker able to trigger certain SELinux denials could use this flaw to execute arbitrary code with root privileges...

Apple OS X IOAudioFamily Kernel Memory Leak Vulnerability

Apple OS X is an operating system developed by Apple Inc. A security vulnerability exists in Apple OS X IOAudioFamily, which can be exploited by local attackers to gain access to kernel memory contents...