Cisco Prime License Manager SQL Injection Vulnerability

Update 2018-December-20: The updated patch ciscocm.CSCvk30822v2.0.k3.cop.sgn that avoids the functional issues identified with the v1.0 patch has been posted to Cisco.com. See the Fixed Releases "fr" section for details. Update 2018-December-10: Installing the ciscocm.CSCvk30822v1.0.k3.cop.sgn...

CVE-2018-9084

CVE-2018-9084 affects Lenovo System Management Module (SMM) firmware prior to 1.06. If an attacker logs into the device OS, the validation of software updates can be circumvented. The Lenovo advisory LEN-24374 recommends upgrading SMM firmware to the stated level for your model and applying stand...

JVN#55263945: Multiple vulnerabilities in RICOH Interactive Whiteboard

RICOH Interactive Whiteboard provided by RICOH COMPANY, LTD. contains multiple vulnerabilities listed below. Command injection CWE-94 - CVE-2018-16184 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 9.8 CVSS v2| AV:N/AC:L/AU:N/C:C/I:C/A:C| Bas...

MGASA-2018-0467 Updated flash-player-plugin packages fix security vulnerability

A critical vulnerability in Adobe Flash Player 31.0.0.148 and earlier versions. Successful exploitation could lead to arbitrary code execution in the context of the current user. CVE-2018-15981...

Design/Logic Flaw

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 Serial number below 14000 and 04.x before 04.03.00 Serial Number above 14000, CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 Serial...

CVE-2018-18565

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 Serial number below 14000 and 04.x before 04.03.00 Serial Number above 14000, CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 Serial...

CVE-2018-18565

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 Serial number below 14000 and 04.x before 04.03.00 Serial Number above 14000, CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 Serial...

CVE-2018-18565

CVE-2018-18565 is an Improper Access Control (CWE-284) vulnerability in Roche Diagnostics handheld medical devices (Accu-Chek Inform II Instrument and related models) where attackers in the adjacent network can change instrument configuration. Affected products include Accu-Chek Inform II Instrum...

3 New Code Execution Flaws Discovered in Atlantis Word Processor

This is why you should always think twice before opening innocent looking email attachments, especially word and pdf files. Cybersecurity researchers at Cisco Talos have once again discovered multiple critical security vulnerabilities in the Atlantis Word Processor that allow remote attackers to...

SUSE-SU-2018:3816-1 Security update for py26-compat-salt

This update for py26-compat-salt fixes the following issues: Salt was updated to version 2016.11.10 and contains the following fixes: Security issues fixed: - CVE-2018-15750: Fixed directory traversal vulnerability in salt-api bsc1113698. - CVE-2018-15751: Fixed remote authentication bypass in...

Security Bulletin: NVIDIA GeForce Experience - November 2018

NVIDIA has released a software update for GeForce Experience. This update addresses issues that may lead to escalation of privileges or information disclosure. To protect your system, download and install this software update through the GeForce Experience Downloads page. Details This section...

MGASA-2018-0453 Updated flash-player-plugin packages fix security vulnerability

An important vulnerability in Adobe Flash Player 31.0.0.122 and earlier versions. Successful exploitation could lead to information disclosure. CVE-2018-15978...

CVE-2018-0690

An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-middle attacker to tamper with an update file and inject executable files...

CVE-2018-0690

An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-middle attacker to tamper with an update file and inject executable files...

Information disclosure

An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-middle attacker to tamper with an update file and inject executable files...

CVE-2018-0690

An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-middle attacker to tamper with an update file and inject executable files...

CVE-2018-0690

CVE-2018-0690 affects Sony Music Center for PC prior to 1.0.02, where the software update process does not validate updates securely. This enables a man-in-the-middle attacker to tamper with an update file and inject executable files during the update, potentially leading to code execution on the...

Siemens Patches Firewall Flaw That Put Operations at Risk

Siemens AG on Tuesday issued a slew of fixes addressing eight vulnerabilities spanning its industrial product lines. The most serious of the patched flaws include a cross-site scripting vulnerability in Siemens’ SCALANCE firewall product. The flaw could allow an attacker to gain unauthorized acce...

Multiple directory traversal vulnerabilities in Cybozu Office

Overview Cybozu Office provided by Cybozu, Inc. contains multiple directory traversal vulnerabilities below. Directory traversal vulnerability due to a flaw in processing parameter of the HTTP request CWE-22 - CVE-2018-0703 Directory traversal vulnerability due to a flaw in processing parameter...

Security Advisory - Anonymous TLS Cipher Suite Supported Vulnerability in Huawei eSpace Product

There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to hijack the connection from a client when the user signs up to log in by TLS. Due to insufficient authentication, which may be exploite...