Pakistan-linked hackers targeted Indian power company with ReverseRat

A threat actor with suspected ties to Pakistan has been striking government and energy organizations in the South and Central Asia regions to deploy a remote access trojan on compromised Windows systems, according to new research. "Most of the organizations that exhibited signs of compromise were...

Utilities ‘Concerningly’ at Risk from Active Exploits

The amount of time that utility networks spend exposed to a known application exploit has spiked over the past two months — something analysts called out as a “concerning datapoint,” and an important reminder that ransomware isn’t the only threat utility networks need to secure against. A new...

elFinder Archive Command Injection

elFinder versions below 2.1.59 are vulnerable to a command injection vulnerability via its archive functionality. When creating a new zip archive, the name parameter is sanitized with the escapeshellarg php function and then passed to the zip utility. Despite the sanitization, supplying the -TmTT...

Circutor SGE-PLC1000 OS Command Injection Vulnerability

Circutor SGE-PLC1000 is a smart metering system device. The primary function is to manage utility power through CIRWATT meters or other meters with PRIME technology.An operating system command injection vulnerability exists in firmware version 0.9.2b of the Circutor SGE-PLC1000, which can be...

Circutor SGE-PLC1000 Licensing Issue Vulnerability

Circutor SGE-PLC1000 is a smart metering system device. The main function is to manage utility power through CIRWATT meters or other meters with PRIME technology.An authorization issue vulnerability exists in Circutor SGE-PLC1000 firmware version 0.9.2b, which can be exploited by attackers to pas...

Irzip Reuse After Release Vulnerability

Irzip is a compression utility that excels at compressing large files. A post-release reuse vulnerability exists in the lzmadecompressbuf function in stream.c in Irzip version 0.631, which can be exploited by an attacker to cause a denial of service via specially crafted compressed files...

CVE-2021-23024

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2021-23024

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Design/Logic Flaw

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2021-23024

The CVE-2021-23024 issue affects F5 BIG-IQ Centralized Management, specifically the BIG-IQ Configuration utility. Affected versions include BIG-IQ 8.x before 8.0.0.1 and all 6.x/7.x lines. The root cause is command injection via the configuration utility due to undisclosed/poor input handling, en...

CVE-2021-23024: Undefined Security Weakness

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Xxe

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity XXE attacks. When this developer utility is misused for purposes involving external or user submitted data in custom...

[SECURITY] Fedora 34 Update: transfig-3.2.8a-2.fc34

The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Install transfig...

F5 BIG-IQ Command Injection Vulnerability

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. BIG-IQ Centralized Management suffers from a command injection...

F5 BIG-IQ command injection vulnerability

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. BIG-IQ Centralized Management suffers from a command injection...

Vulnerability fixed in F5 BIG-IQ Centralized Management

F5 has fixed a vulnerability in BIG-IQ Centralized Management. An authenticated remote malicious party could potentially exploit the vulnerability potentially exploit it to execute arbitrary code under root privileges. The vulnerability is located in the BIG-IQ Configuration utility. Successful...

Important: Red Hat Security Advisory: glib2 security update

An update for glib2 is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact...

Important: glib2 security and bug fix update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: integer overflow in...

CVE-2021-33564

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features...

CVE-2021-33564

Summary: CVE-2021-33564 affects the Dragonfly Ruby Gem prior to 1.4.0. An argument injection flaw allows remote attackers to read and write arbitrary files via a crafted URL when the verify_url option is disabled, potentially enabling arbitrary code execution. The root cause is described as misha...