community.scottishpower.co.uk Cross Site Scripting vulnerability OBB-1269909

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

The vulnerability of the software for controlling uninterruptible power supplies (UPS) in PowerChute Business Edition arises from insufficient validation of input data. This allows a intruder to execute arbitrary code.

The vulnerability of the software for controlling uninterruptible power supplies UPS of the PowerChute Business Edition exists due to insufficient validation of input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2019-0155

A flaw was found in the Intel graphics hardware GPU, where a local attacker with the ability to issue commands to the GPU could inadvertently lead to memory corruption and possible privilege escalation. The attacker could use the GPU blitter to perform privilege MMIO operations, not limited to th...

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example within a single execution of a program the output of every __builtin_darn() call may be the same.

...

CVE-2020-16138

A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our...

Information disclosure

A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our...

CVE-2020-16138

A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our...

JDK: Information disclosure via calls to System.arraycopy() with invalid length

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value...

JDK: Information disclosure via calls to System.arraycopy() with invalid length

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value...

JDK: Information disclosure via calls to System.arraycopy() with invalid length

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value...

PT-2020-14770 · Cisco · Cisco Unified Ip Conference Station 7937G

Name of the Vulnerable Software and Affected Versions: Cisco Unified IP Conference Station 7937G versions 1-4-4-0 through 1-4-5-7 Description: A denial-of-service issue allows attackers to remotely disable the device until it is power cycled. The product is end of life and users are advised to...

SQL Injection Vulnerability in Hanzhong Qiyuan Power Network Co.

Hanzhong Qiyuan Power Network Co., Ltd. is a high-tech Internet technology service provider. Hanzhong Qiyuan Power Network Co., Ltd. website building system has SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive database information...

powermetalresources.com Cross Site Scripting vulnerability OBB-1252458

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Trailer Power Line Communications

1. EXECUTIVE SUMMARY CVSS v3 4.3 Vendor: Multiple Trailer and Brake Manufacturers Equipment: Power Line Communications Bus / PLC4TRUCKS / J2497 Vulnerability: Exposure of Sensitive Information Through Sent Data 2. RISK EVALUATION The National Motor Freight Traffic Association NMFTA and Assured...

CVE-2019-17639

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value...

Invision Power Services Community Suite Reflected Cross Site Scripting (CVE-2017-8897)

A reflected cross site scripting vulnerability exists in Invision Power Services Community Suite. Successful exploitation of this vulnerability could allow attackers to execute arbitrary code on the affected system...

Threat Source newsletter for July 23, 2020

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. While ransomware attacks continue to hog all the headlines, cryptocurrency miners are still running the background, sapping computing power from unsuspecting victims. We have what we believe is the first documentation of a new...

Eaton Intelligent Power Manager system_srv Command Injection (CVE-2020-6651)

A command injection vulnerability exists in Eaton Intelligent Power Manager. The vulnerability is due to a lack of validation of a user-supplied string in requests handled by systemsrv.js before using it to execute a system command...

Eclipse OpenJ9 Information Disclosure Vulnerability

Eclipse OpenJ9 is a Java application engine from the Eclipse Foundation. The product is primarily used to run Java applications. A security vulnerability exists in Eclipse OpenJ9 versions prior to 0.21 Power. An attacker could exploit the vulnerability to obtain sensitive information...

Hacking a Power Supply

This hack targets the firmware on modern power supplies. Yes, power supplies are also computers. Normally, when a phone is connected to a power brick with support for fast charging, the phone and the power adapter communicate with each other to determine the proper amount of electricity that can ...