Rockwell Automation PanelView 5510

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely Vendor: Rockwell Automation Equipment: PanelView 5510 Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote unauthenticated user to gain root privileges on the...

Fedora 30 : libvirt (2019-b2dfb13daf)

CVE-2019-10161: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API bz 1722463, bz 1720115 - CVE-2019-10166: virDomainManagedSaveDefineXML API exposed to readonly clients bz 1722462, bz 1720114 - CVE-2019-10167: arbitrary command execution via virConnectGetDomainCapabilities API bz...

EulerOS Virtualization for ARM 64 3.0.2.0 : expat (EulerOS-SA-2019-1698)

According to the versions of the expat packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attacke...

Fedora 30 : 2:qemu (2019-52a8f5468e)

CVE-2019-12155: qxl: NULL pointer dereference while releasing spice resources bz 1712727, bz 1712670 - CVE-2019-5008: NULL pointer dereference in hw/sparc64/sun4u.c leading to DoS bz 1705916, bz 1705915 - CVE-2018-20815: devicetree: heap buffer overflow while loading device tree blob bz 1693117,...

ICSA-19-192-04 Siemens SIMATIC RF6XXR

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION : Exploitable remotely/public exploits are available Vendor : Siemens Equipment : SIMATIC RF6XXR Vulnerabilities : Improper Input Validation, Cryptographic Issues 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow access to...

Countdown to Black Hat: Top 10 Sessions to Attend — #5

Black Hat USA 2019, which is only one month away, offers scores of training courses and research briefings, so every week we’re picking a session we believe Qualys customers will find valuable. This week’s selection is the training course Adversary Tactics -- Detection. This course focuses on...

NetSet - Operational Security Utility And Automator

Operational Security utility and automator. NetSet is designed to automate a number of operations that will help the user with securing their network traffic. It also provides an easy way to gather proxies and run utilities through Tor. All the utilities installed and used by NetSet will be...

CVE-2019-5964

The CVE-2019-5964 issue affects iDoors Reader 2.10.17 and earlier, where an attacker on the same network segment can bypass authentication to access the management console and operate the product via unspecified vectors. Root cause is an authentication bypass in the management console (CWE-288). ...

CVE-2018-20850

Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server...

CVE-2018-20850

Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server...

Cross site scripting

Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server...

CVE-2018-20850

Stormshield Network Security versions 2.0.0–2.13.0 and 3.0.0–3.7.1 contain a self‑XSS vulnerability in the SNS web server's command‑line interface. The issue stems from a lack of proper validation in the web application, enabling local attackers to trigger client‑side script execution. No remedia...

SUSE SLES12 Security Update : php72 (SUSE-SU-2019:1724-1)

This update for php72 fixes the following issues : Security issues fixed : CVE-2019-11039: Fixed a heap-buffer-overflow on phpjpgget16 bsc1138173. CVE-2019-11040: Fixed an out-of-bounds read due to an integer overflow in iconv.c:phpiconvmimedecode bsc1138172. Note that Tenable Network Security ha...

SUSE SLED15 / SLES15 Security Update : taglib (SUSE-SU-2019:1374-2)

This update for taglib fixes the following issues : CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file bsc1096180 Note that Tenable Network Security has extracted the preceding...

Fedora 29 : kernel / kernel-headers (2019-69c132b061)

Update to v5.1.15 ---- Update to v5.1.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

5 Years of Fighting DDoS with the Power of Akamai

Additional analysis and research provided by Principal Architect, Tom Emmons Earlier this year, Akamai celebrated the fifth anniversary of the Prolexic acquisition. The merger was officially completed in February of 2014, and a lot has happened since then. In this post, we want to spend a moment...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20190626)

Security Fixes : - Mozilla: Type confusion in Array.pop CVE-2019-11707 - Mozilla: Sandbox escape using Prompt:Open CVE-2019-11708 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid126434; scriptversion"1.11";...

Debian DLA-1842-1 : python-django security update

It was discovered that the Django Python web development framework did not correct identify HTTP connections when a reverse proxy connected via HTTPS. When deployed behind a reverse-proxy connecting to Django via HTTPS django.http.HttpRequest.scheme would incorrectly detect client requests made v...

Fedora 30 : libtiff (2019-fa3e40f00a)

Fix for CVE-2018-19210. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security...

SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1308-2)

This update for java-180-ibm fixes the following issues : Update to Java 8.0 Service Refresh 5 Fix Pack 35. Security issues fixed : CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes bsc1134718. CVE-2019-2698: Fixed out of bounds access flaw in the 2D component bsc1132729...