Schneider-electric Modicom Weak Password Recovery Mechanism for Forgotten Password

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server File data ot500276.nasl...

Schneider-electric Modicom Weak Password Recovery Mechanism for Forgotten Password

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server. File data ot500170.nasl...

Rockwellautomation Micrologix Unspecified Vulnerability

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information,...

Mail.ru: Account TakeOver through password recovery at am.ru

Insufficient protection allowed account takeover at am.ru via account recovery code bruteforcing Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

Medium: fence-agents

Issue Overview: A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fencerhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying...

U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] CVE-2018-2879 (padding oracle attack in the Oracle Access Manager) at https://█████████

Description We were able to identify CVE-2018-2879 in Oracle Access Manager, used on the https://██████ Link to the CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-2879 This vulnerability is rated critical, and may allow unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2019-18673

On SHIFT BitBox02 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to...

CVE-2019-18360

In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery...

CVE-2019-18360

In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery...

Design/Logic Flaw

In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery...

CVE-2019-18360

In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery...

CVE-2019-18360

JetBrains Hub is affected by CVE-2019-18360 in versions earlier than 2019.1.11738. The issue enables username enumeration through the password-recovery flow, representing an information-disclosure vulnerability in Hub. Public sources (JetBrains Security Bulletin Q3 2019 and Red Hat/CNVD entries) ...

PT-2019-13635 · Coinkite · Coldcard Mk1 +1

Name of the Vulnerable Software and Affected Versions: Coldcard MK1 and MK2 devices affected versions not specified Description: A side channel vulnerability was found in the row-based OLED display of Coldcard devices. The power consumption of each display cycle depends on the number of illuminat...

Unspecified Vulnerability in Total Defense Anti-virus

Total Defense Anti-virus is a suite of antivirus software from the American company Total Defense. A security vulnerability exists in the Quarantine Recovery feature in Total Defense Anti-virus version 11.5.2.28, which can be exploited by an attacker to write files to a privileged directory...

The hidden costs of security breaches

The real cost of a security breach to your business is larger than many imagine. On the surface there is incredible expensive to recovering from breaches. What is often also at risk is the inestimable damage to company morale, brand reputation, and operations. The post The hidden costs of securit...

Mbed TLS -- Side channel attack on ECDSA

Janos Follath reports: Our bignum implementation is not constant time/constant trace, so side channel attacks can retrieve the blinded value, factor it as it is smaller than RSA keys and not guaranteed to have only large prime factors, and then, by brute force, recover the key...

Veeam Recovery Media creating fails with "This access control list is not in canonical form and therefore cannot be modified" error

Challenge During a Veeam Agent for Microsoft Windows backup job the following warning occurs: Collecting recovery media files Details: This access control list is not in canonical form and therefore cannot be modified. Copy The warning may appear in the following cases: Veeam Recovery Media is...

New Presentation Template: Incident Response Reporting for Management

Every security professional knows it’s only a matter of time before their organization is breached. And even though most security-conscious organizations have implemented procedures and products to facilitate the incident response process, many security decision-makers find much more of a challen...

Security Bulletin: Vulnerability in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows(IBM SDK, Java Technology Edition Quarterly CPU - Jul 2019 - Includes Oracle Jul 2019 CPU) )

Summary DB2 Recovery Expert for Linux, UNIX and Windows has addressed the following vulnerabilities:CVE-2019-4473,CVE-2019-11771. These issues were disclosed as part of the IBM Java SDK updates in July. 2019. Vulnerability Details Third Party Acknowledgement Info: None Relevant CVE Information:...

CVE-2019-13929

A vulnerability has been identified in SIMATIC IT UADM All versions V1.3. An authenticated remote attacker with network access to port 1434/tcp of SIMATIC IT UADM could potentially recover a password that can be used to gain read and write access to the related TeamCenter station. The security...