CVE-2018-14476

CVE-2018-14476 affects GeniXCMS 1.1.5 and is a cross-site scripting vulnerability exploitable via the installation step 1 parameters. The root cause is reflected in the documentation as XSS through the dbuser or dbhost fields submitted during step 1 of installation, allowing arbitrary web script ...

SYS.1.2.2.A14

Ziel des Bausteins SYS.1.2.2 ist die Absicherung von Microsoft Windows Server 2012 und Microsoft Windows Server 2012 R2. Die Kern-Anforderung Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Over 12,000 Google Users Hit by Government Hackers in 3rd Quarter of 2019

As part of its active efforts to protect billions of online users, Google identified and warned over 12,000 of its users who were targeted by a government-backed hacking attempt in the third quarter of this year. According to a report published by Google's Threat Analysis Group TAG, more than 90...

PT-2019-14699 · Jenkins · Jenkins Qmetry For Jira - Test Management Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins QMetry for JIRA - Test Management Plugin versions 1.12 and earlier Description: The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master or controller. This allows users with...

WordPress YITH WooCommerce Multi-step Checkout plugin <=1.7.4 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Multi-step Checkout plugin versions =1.7.4. Solution Update the WordPress YITH WooCommerce Multi-step Checkout plugin to the latest available version at least 1.7.5...

Siemens Industrial Products Local Privilege Escalation Vulnerability (Update I)

1. EXECUTIVE SUMMARY CVSS v3 6.4 ATTENTION: Exploitable locally Vendor: Siemens Equipment: Industrial Products Vulnerability: Improper privilege management 2. UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-16-313-02 Siemens Industrial Products Local...

Siemens STEP 7-MicroWIN SMART suffers from a Denial of Service Vulnerability

Siemens is a leading global technology company providing solutions for customers in the areas of power generation and transmission and distribution, infrastructure, industrial automation, drives and software through innovations in electrification, automation and digitalization. A denial of servic...

CVE-2019-3738

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key...

CVE-2019-3738

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key...

Design/Logic Flaw

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key...

CVE-2019-3738

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key...

Siemens SIMATIC STEP 7 S7HTREEX.OCX control has an out-of-bounds access vulnerability

Siemens SIMATIC STEP 7 TIA Portal is a suite of programming software for SIMATIC controllers from Siemens, Germany. The software provides PLC programming, design option packages and advanced drive technology. An out-of-bounds access vulnerability exists in the S7HTREEX.OCX control of Siemens...

Integer Overflow Vulnerability in S7hcom_x.dll Control for Siemens SIMATIC STEP 7

Siemens SIMATIC STEP 7 TIA Portal is a suite of programming software for SIMATIC controllers from Siemens, Germany. The software provides PLC programming, design option packages and advanced drive technology. An integer overflow vulnerability exists in the S7hcomx.dll control for Siemens SIMATIC...

PT-2019-14641 · FFmpeg · Ffjpeg

Name of the Vulnerable Software and Affected Versions: ffjpeg versions prior to 2019-08-18 Description: The issue is related to a NULL pointer dereference in the huffman decode step function at huffman.c. Recommendations: For versions prior to 2019-08-18, update to a version released after...

Integer Overflow Vulnerability in the sacommoncontrols.dll Control for Siemens SIMATIC STEP 7

Siemens SIMATIC STEP 7 TIA Portal is a suite of programming software for SIMATIC controllers from Siemens, Germany. The software provides PLC programming, design option packages and advanced drive technology. An integer overflow vulnerability exists in the sacommoncontrols.dll control of Siemens...

It's Time for IoT Security's Next Big Step

Connected devices are more secure than ever. That's still not nearly enough...

8 ways to improve security on smart home devices

Every so often, a news story breaks that hackers have made their way into a smart home device and stolen personal data. Or that vulnerabilities in smart tech have been discovered that allow their producers or other cybercriminals to spy on customers. We've seen it play out over and over with smar...

Android's Built-in Security Key Now Works With iOS Devices For Secure Login

In April this year, a software update from Google overnight turned all Android phones, running Android 7.0 Nougat and up, into a FIDO-certified hardware security key as part of a push to encourage two-step verification. The feature made it possible for users to confirm their identity when logging...

Android's Built-in Security Key Now Works With iOS Devices For Secure Login

In April this year, a software update from Google overnight turned all Android phones, running Android 7.0 Nougat and up, into a FIDO-certified hardware security key as part of a push to encourage two-step verification. The feature made it possible for users to confirm their identity when logging...

SUSE-SU-2019:1422-1 Security update for the Linux Kernel (Live Patch 23 for SLE 12 SP2)

This update for the Linux Kernel 4.4.121-9285 fixes one issue. The following security issue was fixed: - CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucmaleavemulticast to access a certain data structure after a cleanup step in ucmaprocessjoin, which allows attackers to cause a denial o...