Cross site request forgery (csrf)

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY CSRF vulnerability can allow execution of unauthorized actions on the device such as configuration parameter...

CVE-2017-5145

The CVE-2017-5145 entry describes a CROSS-SITE REQUEST FORGERY (CSRF) vulnerability in Carlo Gavazzi VMU-C EM (firmware before A11_U05) and VMU-C PV (firmware before A17). Successful exploitation can allow unauthorized configuration changes and saving of modified configurations. Public guidance i...

CVE-2017-5146

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11U05, and VMU-C PV prior to firmware Version A17. Sensitive information is stored in clear-text...

CVE-2017-5144

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11U05, and VMU-C PV prior to firmware Version A17. The access control flaw allows access to most application functions without authentication...

CVE-2017-5144

The CVE-2017-5144 issue affects Carlo Gavazzi VMU-C EM (pre-A11_U05) and VMU-C PV (pre-A17) where an access control flaw allows access to most application functions without authentication. According to the ICS-CERT advisory, the root cause is an access-control weakness (CWE-284) enabling remote, ...

CVE-2017-5146

CVE-2017-5146 affects Carlo Gavazzi VMU-C EM (before firmware A11_U05) and VMU-C PV (before firmware A17). The issue is that sensitive information is stored in clear text on these devices, constituting an information disclosure vulnerability. Public sources describe the affected products and firm...

oob access in cirrus bitblt copy

ISSUE DESCRIPTION When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory. IMPACT A malicious guest administrator can cause an out of bounds memory access, leading to information disclosure or privilege escalation. VULNERABLE...

Carlo Gavazzi Automation VMU-C EM and VMU-C PV have unauthorized access vulnerabilities

Carlo Gavazzi Automation VMU-C EM and VMU-C PV are control modules in the automation products of the Italian company Carlo Gavazzi Automation. An unauthorized access vulnerability exists in the Carlo Gavazzi Automation VMU-C EM and VMU-C PV. An unauthenticated attacker could exploit the...

Carlo Gavazzi Automation VMU-C EM and VMU-C PV suffer from information disclosure vulnerabilities

Carlo Gavazzi Automation VMU-C EM and VMU-C PV are control modules in the automation products of the Italian company Carlo Gavazzi Automation. The Carlo Gavazzi Automation VMU-C EM and VMU-C PV store sensitive information in clear text, allowing remote attackers to exploit the vulnerability to re...

Cross-Site Request Forgery Vulnerability in Carlo Gavazzi Automation VMU-C EM and VMU-C PV

Carlo Gavazzi Automation VMU-C EM and VMU-C PV are control modules in the automation products of the Italian company Carlo Gavazzi Automation. A cross-site request forgery vulnerability exists in the Carlo Gavazzi Automation VMU-C EM and VMU-C PV. A remote attacker can exploit the vulnerability b...

Carlo Gavazzi VMU-C EM and VMU-C PV

CVSS V3 10 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Carlo Gavazzi Equipment: VMU-C EM, VMU-C PV Vulnerabilities: Access Control Flaws, CSRF, Sensitive Information Stored In Clear Text AFFECTED PRODUCTS Carlo Gavazzi reports that the vulnerabilities affect the following...

Updated xen packages fix security vulnerability

This xen update is based on upstream 4.5.5 maintenance release, and fixes the following security issues: The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service host disk consumption by writing to stdout or stderr CVE-2014-3672 The xrstor...

Fedora 25 : xen (2016-92e3ea2d1b)

two security flaws 1406840 x86 PV guests may be able to mask interrupts XSA-202, CVE-2016-10024 x86: missing NULL pointer check in VMFUNC emulation XSA-203, CVE-2016-10025 x86: Mishandling of SYSCALL singlestep during emulation XSA-204, CVE-2016-10013 1406260 Note that Tenable Network Security ha...

OracleVM 3.2 : Unbreakable / etc (OVMSA-2016-0181)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/iopl/64: properly context-switch IOPL on Xen PV Andy Lutomirski Orabug: 25269184 CVE-2016-3157 - net: Fix use after free in the recvmmsg exit path Arnaldo Carvalho de Melo Orabug: 25298618...

SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:3208-1)

This update for xen fixes the following issues : - A Mishandling of SYSCALL singlestep during emulation which could have lead to privilege escalation. XSA-204, bsc1016340, CVE-2016-10013 - CMPXCHG8B emulation failed to ignore operand size override which could have lead to information disclosure...

FreeBSD : xen-kernel -- x86 PV guests may be able to mask interrupts (3ae078ca-c7eb-11e6-ae1b-002590263bf5)

The Xen Project reports : Certain PV guest kernel operations page table writes in particular need emulation, and use Xen's general x86 instruction emulator. This allows a malicious guest kernel which asynchronously modifies its instruction stream to effect the clearing of EFLAGS.IF from the state...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3656)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3656 advisory. - x86/iopl/64: properly context-switch IOPL on Xen PV Andy Lutomirski Orabug: 25269176 CVE-2016-3157 CVE-2016-3157 Tenable has extracted the...

x86 PV guests may be able to mask interrupts

ISSUE DESCRIPTION Certain PV guest kernel operations page table writes in particular need emulation, and use Xen's general x86 instruction emulator. This allows a malicious guest kernel which asynchronously modifies its instruction stream to effect the clearing of EFLAGS.IF from the state used to...

xen-kernel -- x86 PV guests may be able to mask interrupts

The Xen Project reports: Certain PV guest kernel operations page table writes in particular need emulation, and use Xen's general x86 instruction emulator. This allows a malicious guest kernel which asynchronously modifies its instruction stream to effect the clearing of EFLAGS.IF from the state...

x86: Mishandling of SYSCALL singlestep during emulation

ISSUE DESCRIPTION The typical behaviour of singlestepping exceptions is determined at the start of the instruction, with a DB trap being raised at the end of the instruction. SYSCALL and SYSRET, although we don't implement it behave differently because the typical behaviour allows userspace to...