PT-2018-12959

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 12.1.0 through 12.1.3.6 F5 BIG-IP versions 13.0.0 through 13.1.1.1 Description There is a reflected Cross Site Scripting XSS issue in an undisclosed Configuration Utility page. Recommendations For F5 BIG-IP versions 12.1.0...

Podcast: A Utility Ransomware Attack, Post-Hurricane

A “critical water utility” was hit by a recent ransomware attack, significantly impeding the service in the week after Hurricane Florence hit the East Coast of the U.S. The Onslow Water and Sewer Authority ONWASA said in a Monday release that a “sophisticated ransomware attack… has left the utili...

Design/Logic Flaw

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Utility. The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this...

CVE-2018-3150

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Utility. The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this...

CVE-2018-3150

CVE-2018-3150 affects OpenJDK/OpenJDK 11 in Java SE (Utility) deployments when loading untrusted code. The issue relates to jar attribute checks / Multi-Release handling, enabling potential unauthorized data modification with network access under certain conditions. Public advisories (openSUSE/Op...

CVE-2018-3150: Undefined Security Weakness

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Utility. The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this...

Oracle Java SE Security Updates-05 (oct2018-4428296) - Linux

Oracle Java SE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Java SE Security Updates-05 (oct2018-4428296) - Windows

Oracle Java SE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:jdk"; ifdescription...

UBUNTU-CVE-2018-3150

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Utility. The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this...

openSUSE Security Update : soundtouch (openSUSE-2018-1146)

This update for soundtouch fixes the following security issue : - CVE-2018-1000223: Prevent buffer overflow in WavInFile::readHeaderBlock that could have resulted in arbitrary code execution when opening maliocius file in soundstretch utility bsc1103676 This update was imported from the...

Intel NUC FW kits input validation error vulnerability

Intel NUC FW kits is a mini-desktop from Intel Corporation USA.BIOS update utility is one of the BIOS update utilities. An input validation error vulnerability exists in Intel NUC FW kits. An attacker could exploit this vulnerability to cause a denial of service or information disclosure...

Default configuration

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...

CVE-2018-12441

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...

CVE-2018-12441

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...

CVE-2018-12441

The CorsairService in Corsair Utility Engine has insecure default permissions: the Everyone group is granted SERVICE_ALL_ACCESS, enabling unprivileged local users to modify CorsairService BINARY_PATH_NAME and execute arbitrary commands, resulting in complete control of the system. Connected docum...

CVE-2018-12441: Incorrect Default Permissions

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...

PT-2018-11177

Name of the Vulnerable Software and Affected Versions Corsair Utility Engine affected versions not specified Description The issue is related to the CorsairService Service in Corsair Utility Engine, which has insecure default permissions. This allows unprivileged local users to execute arbitrary...

CVE-2018-12158

The CVE-2018-12158 issue affects Intel NUC Firmware Kits’ BIOS update utility. Insufficient input validation in the BIOS update executable for kits downloaded before May 24, 2018 could allow a local, privileged user to trigger a denial of service or information disclosure. Affected devices are In...

CVE-2018-12158: Exposure of Sensitive Information to an Unauthorized Actor

Insufficient input validation in BIOS update utility in Intel NUC FW kits downloaded before May 24, 2018 may allow a privileged user to potentially trigger a denial of service or information disclosure via local access...

PT-2018-2697

Name of the Vulnerable Software and Affected Versions Intel NUC FW kits versions prior to May 24, 2018 Description The issue is related to insufficient input validation in the BIOS update utility, which may allow a privileged user to trigger a denial of service or information disclosure via local...