Groundbreaking Integration: Stellar Cyber Safeguards OT Environments Alongside IT

By Waqas Stellar Cyber, a cybersecurity company that specializes in providing an Open XDR Extended Detection and Response platform, has… This is a post from HackRead.com Read the original post: Groundbreaking Integration: Stellar Cyber Safeguards OT Environments Alongside IT...

Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Unmeasured Boot (CVE-2019-1589)

A vulnerability in the Trusted Platform Module TPM functionality of software for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI mode could allow an unauthenticated, local attacker with physical access to view sensitive information on an affected device. The...

Cisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service (CVE-2021-1230)

A vulnerability with the Border Gateway Protocol BGP for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI mode could allow an unauthenticated, remote attacker to cause a routing process to crash, which could lead to a denial of service DoS condition. This...

Cisco Nexus 9000 Series Switches Reserved VLAN Number (CVE-2015-6295)

Cisco NX-OS 6.12I34 and 7.03I11 on Nexus 9000 N9K devices allows remote attackers to cause a denial of service CPU consumption or control-plane instability or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number, aka Bug ID CSCuw13560. This plugin only works with...

Cisco NX-OS Software NX-API Arbitrary Command Execution (CVE-2018-0313)

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a malicious packet to the management interface on an affected system and execute a command- injection exploit. The vulnerability is due to incorrect input validation of user-supplie...

Cisco FXOS and NX-OS Software Unauthorized Administrator Account (CVE-2018-0294)

A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to configure an unauthorized administrator account for an affected device. The vulnerability exists because the affected software does not properly delete...

Cisco NX-OS Software Protocol Independent Multicast Denial of Service (CVE-2021-1367)

A vulnerability in the Protocol Independent Multicast PIM feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this...

Cisco Nexus 7000/7700 Series Switches Software Patch Signature Verification (CVE-2019-1808)

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signature...

Cisco Nexus 1000v Application Virtual Switch Cisco Discovery Protocol Packet Processing Denial of Service (CVE-2016-1465)

Cisco Nexus 1000v Application Virtual Switch AVS devices before 5.21SV31.5i allow remote attackers to cause a denial of service ESXi hypervisor crash and purple screen via a crafted Cisco Discovery Protocol packet that triggers an out-of-bounds memory access, aka Bug ID CSCuw57985. This plugin on...

Cisco NX-OS Software-Based Products Authentication, Authorization, and Accounting Bypass (CVE-2015-0721)

Cisco NX-OS 4.0 through 7.3 on Multilayer Director and Nexus 1000V, 2000, 3000, 3500, 4000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote authenticated users to bypass intended AAA restrictions and obtain privileged CLI access via crafted parameters in an SSH connection...

Cisco NX-OS Software Buffer Overflow and Command Injection (CVE-2019-1767)

A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to cause a buffer overflow condition or perform command injection. This could allow the attacker to execute arbitrary commands with...

Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Symbolic Link Path Traversal (CVE-2019-1836)

A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI mode could allow an authenticated, local attacker to use symbolic links to overwrite system files. These system files may be sensitive and should not be overwritable by non-ro...

OSV-2023-554 Heap-buffer-overflow in OT::CmapSubtable::get_glyph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60475 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::CmapSubtable::getglyph bool OT::cmap::acceleratort::getglyphfrom hbotgetnominalglyphs...

OSV-2023-551 Heap-buffer-overflow in OT::CmapSubtable::collect_unicodes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60467 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::CmapSubtable::collectunicodes hbfacecollectunicodes test-ot-face.c...

Schneider Electric Modicon Cross-Site Request Forgery (CVE-2020-7534)

A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 All Versions, Modicon Quantum CPUs with...

Schneider Electric Modicon Missing Authentication for Critical Function (CVE-2020-7540)

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules see security notification for affected versions, that could cause unauthenticated command executio...

Schneider Electric Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200 Stack-Based Buffer Overflow (CVE-2018-7240)

A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary code execution. An FTP command used to upgrade the firmware of the module can be misused to cause a denial of service, or in extreme cases, to load a malicious...

5 Things CISOs Need to Know About Securing OT Environments

For too long the cybersecurity world focused exclusively on information technology IT, leaving operational technology OT to fend for itself. Traditionally, few industrial enterprises had dedicated cybersecurity leaders. Any security decisions that arose fell to the plant and factory managers, who...

ot-paysbaumois.fr Cross Site Scripting vulnerability OBB-3471291

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ot-loiresillon.fr Cross Site Scripting vulnerability OBB-3471286

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...