Google Accelerates Google+ Shutdown After New Bug Discovered

The discovery of a new API bug in Google+ has led Google to hasten the shuttering of its consumer version of the social-networking platform, the tech giant said Monday. Google was already in the process of shutting down Google+ after a different API software bug in the platform, disclosed in...

Multiple vulnerabilities in Cybozu Remote Service

Overview Cybozu Remote Service provided by Cybozu, Inc. contains multiple vulnerabilities listed below. Upload of arbitrary files in logo setting screen CWE-434 - CVE-2018-16169 Directory traversal in used device management screen CWE-22 - CVE-2018-16170 Directory traversal in client certificates...

Cybozu Garoon access restriction bypass vulnerability

Overview Single sign-on function of Cybozu Garoon provided by Cybozu, Inc. contains a restriction bypass vulnerability CWE-284. Kanta Nishitani reported this vulnerability to Cybozu, Inc., and Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN...

JVN#23161885: Multiple vulnerabilities in Cybozu Remote Service

Cybozu Remote Service provided by Cybozu, Inc. contains multiple vulnerabilities listed below. Upload of arbitrary files in logo setting screen CWE-434 - CVE-2018-16169 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2|...

JVN#25385698: Cybozu Garoon access restriction bypass vulnerability

Single sign-on function of Cybozu Garoon provided by Cybozu, Inc. contains a restriction bypass vulnerability CWE-284. Impact An attacker who can access the product may bypass authentication of Single sign-on function and view the information which is available only for sign-on users. Solution...

Multiple vulnerabilities in i-FILTER

Overview i-FILTER provided by Digital Arts Inc. contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2018-16180 HTTP header injection CWE-113 - CVE-2018-16181 Keigo Yamazaki of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

DSA-4352-1 chromium-browser - security update

Bulletin has no description...

MGASA-2018-0477 Updated kio-extras packages fix security vulnerability

The HTML thumbnailer was incorrectly accessing some content of remote URLs listed in HTML files. This meant that the owners of the servers referred in HTML files in your system could have seen in their access logs your IP address every time the thumbnailer tried to create the thumbnail...

TIBCO Security Advisory: December 11, 2018 - TIBCO Managed FileTransfer

TIBCO Managed File Transfer Credentials Disclosure Original release date: December11, 2018 Last revised: CVE-2018-18810 Source: TIBCO Software Inc. TIBCO Managed File Transfer Credentials Disclosure Original release date: December 11, 2018 Last revised: -- Source: TIBCO Software Inc. Systems...

SUSE-SU-2018:3968-1 Security update for tomcat

This update for tomcat to 9.0.12 fixes the following issues: See the full changelog at: http://tomcat.apache.org/tomcat-9.0-doc/changelog.htmlTomcat9.0.12markt Security issues fixed: - CVE-2018-11784: When the default servlet in Apache Tomcat returned a redirect to a directory e.g. redirecting to...

Schneider Electric Software Update Detection (Windows SMB Login)

This detection has been deprecated and replaced by the detection SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco Prime License Manager SQL Injection Vulnerability

Update 2018-December-20: The updated patch ciscocm.CSCvk30822v2.0.k3.cop.sgn that avoids the functional issues identified with the v1.0 patch has been posted to Cisco.com. See the Fixed Releases "fr" section for details. Update 2018-December-10: Installing the ciscocm.CSCvk30822v1.0.k3.cop.sgn...

CVE-2018-9084

CVE-2018-9084 affects Lenovo System Management Module (SMM) firmware prior to 1.06. If an attacker logs into the device OS, the validation of software updates can be circumvented. The Lenovo advisory LEN-24374 recommends upgrading SMM firmware to the stated level for your model and applying stand...

JVN#55263945: Multiple vulnerabilities in RICOH Interactive Whiteboard

RICOH Interactive Whiteboard provided by RICOH COMPANY, LTD. contains multiple vulnerabilities listed below. Command injection CWE-94 - CVE-2018-16184 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 9.8 CVSS v2| AV:N/AC:L/AU:N/C:C/I:C/A:C| Bas...

MGASA-2018-0467 Updated flash-player-plugin packages fix security vulnerability

A critical vulnerability in Adobe Flash Player 31.0.0.148 and earlier versions. Successful exploitation could lead to arbitrary code execution in the context of the current user. CVE-2018-15981...

CVE-2018-18565

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 Serial number below 14000 and 04.x before 04.03.00 Serial Number above 14000, CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 Serial...

Design/Logic Flaw

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 Serial number below 14000 and 04.x before 04.03.00 Serial Number above 14000, CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 Serial...

CVE-2018-18565

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 Serial number below 14000 and 04.x before 04.03.00 Serial Number above 14000, CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 Serial...

CVE-2018-18565

CVE-2018-18565 is an Improper Access Control (CWE-284) vulnerability in Roche Diagnostics handheld medical devices (Accu-Chek Inform II Instrument and related models) where attackers in the adjacent network can change instrument configuration. Affected products include Accu-Chek Inform II Instrum...

3 New Code Execution Flaws Discovered in Atlantis Word Processor

This is why you should always think twice before opening innocent looking email attachments, especially word and pdf files. Cybersecurity researchers at Cisco Talos have once again discovered multiple critical security vulnerabilities in the Atlantis Word Processor that allow remote attackers to...