CVE-2018-7797

A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert formerly Power Manager - EcoStruxure Power Monitoring Expert PME v8.2 all editions, EcoStruxure Energy Expert 1.3 formerly Power Manager, EcoStruxure Power SCADA Operation PSO 8.2 Advanced Reports and Dashboards...

CVE-2018-7797

A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert formerly Power Manager - EcoStruxure Power Monitoring Expert PME v8.2 all editions, EcoStruxure Energy Expert 1.3 formerly Power Manager, EcoStruxure Power SCADA Operation PSO 8.2 Advanced Reports and Dashboards...

Design/Logic Flaw

A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert formerly Power Manager - EcoStruxure Power Monitoring Expert PME v8.2 all editions, EcoStruxure Energy Expert 1.3 formerly Power Manager, EcoStruxure Power SCADA Operation PSO 8.2 Advanced Reports and Dashboards...

CVE-2018-7797

The vulnerability CVE-2018-7797 is an Open Redirect in Schneider Electric EcoStruxure products, enabling a phishing-capable redirect to untrusted sites. Affected are PME/Energy Expert/PSO components: PME v8.2 (all editions), Energy Expert 1.3, PSO v8.2 AR&D, PME v9.0, Energy Expert v2.0, and PSO ...

CVE-2018-7797

A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert formerly Power Manager - EcoStruxure Power Monitoring Expert PME v8.2 all editions, EcoStruxure Energy Expert 1.3 formerly Power Manager, EcoStruxure Power SCADA Operation PSO 8.2 Advanced Reports and Dashboards...

UBUNTU-CVE-2018-18248

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

UBUNTU-CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

DEBIAN-CVE-2018-18248

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

DEBIAN-CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

Shamoon Returns to Wipe Systems in Middle East, Europe

ARCHIVED STORY Shamoon Returns to Wipe Systems in Middle East, Europe By Alexandre Mundo · December 14, 2018 Destructive malware has been employed by adversaries for years. Usually such attacks are carefully targeted and can be motivated by ideology, politics, or even financial aims. Destructive...

SQL Injection Vulnerability in Zhuhai Goling Information Air Quality Online Monitoring System

Zhuhai Goling Information Technology Co., Ltd. is a national high-tech enterprise specializing in the research and development, system integration, production, sales and technical services of network information security equipment, special communication equipment, ecological environment monitorin...

F5 Networks BIG-IP : BIG-IP SNMP vulnerability (K42027747)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.0. It is, therefore, affected by a vulnerability as referenced in the K42027747 advisory. The passphrases for SNMPv3 users and trap destinations that are used forauthentication and privacy are not handled by the BIG-I...

Proper File Integrity Monitoring Critical in Light of Big Breaches & Regulatory Pressure

In light of the recent mega data breaches that have plagued our market over the last year, and the continued escalation of attempted cyberattacks against critical systems during peak periods i.e. the retail sector POS and payment systems, reported in the Carbon Black Threat Analysis Unit TAU...

Zoho ManageEngine OpManager 12.3 Cross Site Scripting

I. VULNERABILITY ------------------------- Zoho ManageEngine OpManager 12.3 before Build 123237 has XSS via the domainController API. II. CVE REFERENCE ------------------------- CVE-2018-19921 III. VENDOR ------------------------- https://www.manageengine.com IV. TIMELINE ------------------------...

Microsoft Edge Chakra Scripting Engine CVE-2018-8618 Remote Memory Corruption Vulnerability

Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft ChakraCore Microsoft...

Worried about Spouseware?

We recently participated in a BBC Radio 4 interview for You and Yours about ‘Spouseware’. This covers smartphone apps which are used by a domestic abuser to track and monitor their victim. The tracking ‘spouseware’ can tell the abuser where their victim is, when they use the phone, what speed...

Denial of Service Vulnerability in Jiuan Host Monitoring Software

JiuAn host monitoring software is a high-security and easy-to-use enterprise document leakage prevention software, which can effectively prevent illegal outgoing external copies, and protect corporate and personal digital knowledge assets from loss, proliferation and leakage. There is a...

Parlez-vous Machine?

Have you ever heard of the MQTT or CoAP protocols? No? Well the device on your wrist, and so many devices around you, could be using them right now. MQTT and CoAP are machine-to-machine or M2M protocols. With the rise of the internet of things IoT and operational technology OT, there’s increased...

Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP

In MITREs evaluation of endpoint detection and response solutions, Windows Defender Advanced Threat Protection demonstrated industry-leading optics and detection capabilities. The breadth of telemetry, the strength of threat intelligence, and the advanced, automatic detection through machine...

Security Bulletin: Security vulnerability has been identified in IBM Tivoli Monitoring for Virtual Environments Agent for Linux Kernel-based Virtual Machines as it is dependent on ITM shipped Java

Summary IBM Java is shipped as an ITM shared component of IBM Tivoli Monitoring for Virtual Environments Agent for Linux Kernel-based Virtual Machines. Information about a security vulnerability affecting Linux Kernel-based Virtual Machines agent has been published in a security bulletin...