CVE-2019-6651

CVE-2019-6651 affects F5 BIG-IP family and related products (BIG-IQ, iWorkflow, Enterprise Manager) via the REST framework in the Configuration utility login page. The vulnerability arises from processing a modified request, leading to inconsistent HTTP responses that could aid an attacker. Affec...

F5 Networks BIG-IP : REST Framework vulnerability (K89509323)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5 / 12.1.5 / 13.1.3 / 14.0.1 / 14.1.2 / 15.0.1 / 15.1.0. It is, therefore, affected by a vulnerability as referenced in the K89509323 advisory. The BIG-IP/BIG-IQ Configuration utility login page may not follow best...

The vulnerability of the microprogrammed input/output module Moxa ioLogik 2542-HSPA and the Moxa Ioxpress Configuration Utility, related to uncontrolled resource consumption, allows a intruder to cause service failures.

The vulnerability of the microprogrammed input/output module Moxa ioLogik 2542-HSPA and the Moxa Ioxpress Configuration Utility is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures by using specially crafted packag...

Code injection

A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 JACE 3e, JACE 6e, JACE 7, JACE-8000, Niagara 4.4u3 JACE 3e, JACE 6e, JACE 7, JACE-8000, and Niagara 4.7u1 JACE-8000, Edge 10...

CVE-2019-13528

CVE-2019-13528 is an Improper Authorization vulnerability affecting Tridium Niagara: Niagara AX 3.8u4 (JACE 3e/6e/7/JACE-8000), Niagara 4.4u3 (JACE 3e/6e/7/JACE-8000), and Niagara 4.7u1 (JACE-8000, Edge 10). A specific utility may allow a local attacker to read privileged files due to insufficien...

CVE-2019-13528

A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 JACE 3e, JACE 6e, JACE 7, JACE-8000, Niagara 4.4u3 JACE 3e, JACE 6e, JACE 7, JACE-8000, and Niagara 4.7u1 JACE-8000, Edge 10...

CVE-2019-5504

ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to perform administrative actions...

Open redirect

ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext...

CVE-2019-5505

ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext...

CVE-2019-5505

The CVE-2019-5505 issue affects NetApp ONTAP Select Deploy admin utility versions 2.2–2.12.1, where credentials are transmitted in plaintext. The combined documents identify the root cause as unencrypted credential handling in the deploy utility, leading to potential credential disclosure. The vu...

More U.S. Utility Firms Targeted in Evolving LookBack Spearphishing Campaign

A spearphishing campaign, first spotted in July targeting three U.S. utility companies with a new malware variant, has evolved its tactics and extended its targeting to include nearly 20 companies. The campaign was first discovered in phishing emails, sent between July 19 and 25, which targeted...

EulerOS Virtualization for ARM 64 3.0.2.0 : patch (EulerOS-SA-2019-1922)

According to the versions of the patch package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A double-free flaw was found in the way the patch utility processed patch files. An attacker could potentially use this...

CVE-2019-2390

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; Mongo...

eslint-utils Arbitrary Code Execution Vulnerability

eslint-utils is a utility for ESLint plugins and custom rules. An arbitrary code execution vulnerability exists in versions of eslint-utils prior to 1.4.1. An attacker can exploit this vulnerability to execute arbitrary code via the getStaticValue function...

EulerOS 2.0 SP5 : patch (EulerOS-SA-2019-1801)

According to the versions of the patch package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrar...

Cisco Integrated Management Controller Buffer Overflow Vulnerability (CNVD-2019-28404)

The Cisco Integrated Management Controller IMC is a baseboard management controller that provides embedded server management for Cisco UCS? C Series rackmount servers and Cisco S Series storage servers. A buffer overflow vulnerability in the "Import Cisco IMC" configuration utility for the Cisco...

Intel Processor Identification Utility Access Control Error Vulnerability

Intel Processor Identification Utility is a processor identification utility program from Intel USA. The program supports the display of graphics information, chipset information, processor supported technologies and other information. An access control error vulnerability exists in the Intel...

Adwind Spyware-as-a-Service Attacks Utility Grid Operators

A phishing campaign that spoofs a PDF attachment to deliver Adwind spyware has been taking aim at national grid utilities infrastructure. Adwind, a.k.a. JRAT or SockRat, is being used in a malware-as-a-service model in this campaign, researchers said. It offers a full cadre of info-gathering...

CVE-2019-11163

Insufficient access control in a hardware abstraction driver for IntelR Processor Identification Utility for Windows before version 6.1.0731 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access...

Improper access control

Insufficient access control in a hardware abstraction driver for IntelR Processor Identification Utility for Windows before version 6.1.0731 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access...