Yokogawa CENTUM and Exaopc

1. EXECUTIVE SUMMARY CVSS v3 6.5 Vendor : Yokogawa Equipment : CENTUM series and Exaopc Vulnerability : Permissions, Privileges, and Access Controls 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local attacker to generate false system or process alarms, or block...

CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure Vulnerability

Exploit for linux platform in category dos / poc Advisory: CyberArk Password Vault Memory Disclosure Data in the CyberArk Password Vault may be accessed through a proprietary network protocol. While answering to a client's logon request, the vault discloses around 50 bytes of its memory to the...

The vulnerability of Siemens EN100 Ethernet module’s microprogramming software, related to access control deficiencies, allows attackers to install their own microprogramming software.

The vulnerabilities of microprogramming software for communication modules such as EN100 Ethernet module IEC 61850, EN100 Ethernet module PROFINET IO, EN100 Ethernet module DNP3, EN100 Ethernet module Modbus TCP, and EN100 Ethernet module IEC 104 are related to access control deficiencies...

Incorrect Access Controls

koji uses incorrect access controls. This vulnerability allows attackers to read and write arbitrary files within the filesystem...

Updated php packages fix security vulnerability

Dumpable FPM child processes allow bypassing opcache access controls php75605...

MGASA-2018-0191 Updated php packages fix security vulnerability

Dumpable FPM child processes allow bypassing opcache access controls php75605...

CVE-2018-4115

An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves CFPreferences in the "System Preferences" component. It allows attackers to bypass intended access...

PT-2018-1287 · Igor Pavlov · 7-Zip

Name of the Vulnerable Software and Affected Versions: 7-Zip versions prior to 18.02 Description: The issue is related to the implementation of the "Large memory pages" option in 7-Zip, which uses the LsaAddAccountRights function to add the SeLockMemoryPrivilege privilege to the user's account...

PT-2018-18916 · Openresty · Openresty

Name of the Vulnerable Software and Affected Versions: OpenResty versions 1.13.6.1 and earlier Description: The issue arises from how OpenResty obtains URI parameters using the ngx.req.get uri args and ngx.req.get post args functions, which ignore parameters beyond the hundredth one. This might...

Incorrect Access Controls

github.com/cloudfoundry/bosh-cli uses incorrect access controls. If a user has access to an instance, they can use the contents of the BOSH CLI configuration file to perform authenticated requests to BOSH...

Getting ready for May 25th

How Wallarm helps with GDPR On May 25, 2018 the General Data Protection Regulation GDPR becomes enforceable. Both European and international companies are reviewing their existing data processing practices to ensure their are in compliance with the new standard, as the proposed non-GDPR complianc...

Design/Logic Flaw

A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attackers access to the PI System via the service account...

CVE-2018-7500

A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attackers access to the PI System via the service account...

CVE-2018-7500

CVE-2018-7500 affects OSIsoft PI Web API (versions 2017 R2 and prior). The issue is Privileges may be escalated, allowing access to the PI System via the service account. CVSS information in NVD indicates high/critical impact (CS: high for confidentiality, integrity, availability; network vector;...

OSIsoft PI Web API

CVSS v3 9.3 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: OSIsoft Equipment: PI Web API Vulnerabilities: Permissions, Privileges, and Access Controls; Cross-site Scripting AFFECTED PRODUCTS OSIsoft reports that the vulnerabilities affect the following PI Web API products: PI...

Gemalto SafeNet Authentication Service End User Software Tools for Windows Elevation of Privilege Vulnerability

Gemalto SafeNet Authentication Service End User Software Tools for Windows is a Windows-based SafeNet Authentication Service tool from Gemalto USA. A security vulnerability exists in SafeNet Authentication Service End User Software Tools for Windows that stems from the program's use of weak acces...

Gemalto SafeNet Authentication Service for NPS Agent Elevation of Privilege Vulnerability

Gemalto SafeNet Authentication Service for NPS Agent is a network access policy agent from Gemalto USA. A security vulnerability exists in Gemalto SafeNet Authentication Service for NPS Agent due to the program's use of weak access control lists for installation directories and executable modules...

Gemalto SafeNet Authentication Service Remote Web Workplace Agent Elevation of Privilege Vulnerability

Gemalto SafeNet Authentication Service Remote Web Workplace Agent is a SafeNet Authentication Service Remote Web Workplace Agent from Gemalto USA. A security vulnerability exists in the Gemalto SafeNet Authentication Service Remote Web Workplace Agent that stems from the program's use of weak...

Gemalto SafeNet Authentication Service IIS Agent Elevation of Privilege Vulnerability

The Gemalto SafeNet Authentication Service IIS Agent is a Gemalto agent that provides two-factor authentication for systems running Microsoft Internet Information Services IIS including Outlook Web Access, the mail client component. The security vulnerability in the Gemalto SafeNet Authentication...

Gemalto SafeNet Authentication Service for Outlook Web App Agent Elevation of Privilege Vulnerability

Gemalto SafeNet Authentication Service for Outlook Web App Agent is a SafeNet Authentication Service agent for Outlook applications from Gemalto USA. A security vulnerability exists in Gemalto SafeNet Authentication Service for Outlook Web App Agent, which stems from the program's use of weak...