CVE-2018-7504

This CVE concerns OSIsoft PI Vision (versions 2017 and prior). Root cause: Protection Mechanism Failure due to the X-XSS-Protection header not being set to block, enabling reflected cross-site scripting. Affected: PI Vision 2017 and earlier. Impact: potential cross-site scripting; possibly inform...

Workspace Environment Management (WEM): Active Directory search improvements in WEM 4.6

Introduction The Active Directory AD system built into the WEM Administration Console and WEM Infrastructure Server has been refactored in WEM 4.6 to improve performance and stability. Although AD searches performed by the WEM Console and WEM Infrastructure server in previous WEM versions have...

CVE-2018-7504: Protection Mechanism Failure

A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection response header is not set to block, allowing attempts at reflected cross-site scripting...

[SECURITY] Fedora 27 Update: zsh-5.4.1-2.fc27

The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell the Korn shell, but includes many enhancements. Zsh supports command line editing, built-in spelling correction, programmable command completion, shell...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 6.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2018-1055

Name of the Vulnerable Software and Affected Versions Samba versions 4.0.0 and later Description The issue is related to the LDAP server in Samba, specifically when configured as an Active Directory domain controller. It incorrectly validates permissions to modify passwords over LDAP, allowing...

OSIsoft PI Vision

CVSS v3 6.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: OSIsoft Equipment: PI Vision Vulnerabilities: Protection Mechanism Failure, Information Exposure AFFECTED PRODUCTS The following versions of PI Vision, a data visualization framework, are affected: PI Vision versions...

CVE-2018-7562

A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via front/fileupload.ph...

Vulnerability in Robots Can Lead To Costly Ransomware Attacks

CANCUN, Mexico – A vulnerability in Softbank Robotics’ NAO and Pepper robots can lead to costly ransomware attacks that could cause robots deployed in businesses to stop working, curse at customers, or even perform violent movements. The vulnerability was disclosed at Kaspersky Lab’s Security...

Burrowing ideas | account to attack of a several common techniques-vulnerability warning-the black bar safety net

web security incidents, the account, is usually presented to the attacker's first point of contact with account-related functions if there is a defect, an attacker can obtain the key information and important features, such as, the login fails, the error message can determine whether the because...

SUSE-SU-2018:0552-1 Security update for SUSE Manager Server 3.1

This update fixes the following issues: nutch: - Fix hadoop log dir. bsc1061574 osad, rhnlib: - Fix update mechanism when updating the updateservice bsc1073619 pxe-default-image: - Spectre and Meltdown mitigation. CVE-2017-5753, CVE-2017-5715, CVE-2017-5754, bsc1068032 spacecmd: - Support multipl...

SUSE-SU-2018:0552-2 Security update for SUSE Manager Server 3.1

This update fixes the following issues: nutch: - Fix hadoop log dir. bsc1061574 osad, rhnlib: - Fix update mechanism when updating the updateservice bsc1073619 pxe-default-image: - Spectre and Meltdown mitigation. CVE-2017-5753, CVE-2017-5715, CVE-2017-5754, bsc1068032 spacecmd: - Support multipl...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix six bugs are now available for Red Hat Enterprise Linux 7.3 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

KLA11204 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities possibly to cause denial of service or spoof user interface. Below is a complete list of vulnerabilities: 1. Incorrect processing of AppMenifests can be exploited remotely to perfo...

Volkswagen Customer-Link App Protection Mechanism Failure CAN Message Injection Vulnerability

This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Customer-Li...

Lutron Quantum BACnet Integration Devices Information Disclosure Vulnerability

Lutron Quantum BACnet Integration device is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

Trend Micro Email Encryption Gateway Security Bypass Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. A security bypass vulnerability exists in Trend Micro Email Encryption Gateway 5...

CVE-2013-4891

The CVE-2013-4891 entry documents a vulnerability in CodeIgniter’s xss_clean function prior to version 2.1.4. An unclosed HTML tag could allow remote attackers to bypass protection and perform cross-site scripting (XSS). Affected software: CodeIgniter 2.x ≤ 2.1.3; vulnerable component: xss_clean ...

Authentication flaw

A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQ...

CVE-2018-1298

CVE-2018-1298 describes a Denial of Service in Apache Qpid Broker-J 7.0.0 related to authentication of AMQP connections. The issue occurs when using PLAIN or XOAUTH2 SASL mechanisms during SASL negotiation, where unauthenticated attackers may crash the broker. Affected scope includes AMQP protoco...