Moxa NPort Device Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-336-02 Moxa NPort Device Vulnerabilities that was published December 1, 2016, on the NCCIC/ICS-CERT web site. Security researchers Reid Wightman of RevICS Security, Mikael Vingaard, and Maxim Rupp have identifie...

CVE-2016-2944

IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach...

Microsoft Edge CVE-2016-7208 Scripting Engine Remote Memory Corruption Vulnerability

Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. This could allow the attacker to execute arbitrary code in the context of the currently logged-in user. Failed...

Microsoft Edge CVE-2016-7201 Scripting Engine Remote Memory Corruption Vulnerability

Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. This could allow the attacker to execute arbitrary code in the context of the currently logged-in user. Failed...

Microsoft Windows Animation Manager CVE-2016-7205 Memory Corruption Vulnerability

Description Microsoft Windows is prone to a memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed attacks will cause denial-of-service conditions. Technologies Affected Microsoft Windows 10 Version 1607 for...

Microsoft SQL Server CVE-2016-7252 Information Disclosure Vulnerability

Description Microsoft SQL Server is prone to an information-disclosure vulnerability. An attacker can leverage this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft SQL Server 2016 for x64-based Systems Recommendations Block external access at...

Kabona AB WDC Brute Force Decryption Vulnerability

Kabona AB WDC is a web-based SCADA system from the Swedish company Kabona AB. A security vulnerability exists in Kabona AB WDC versions prior to 3.4.0, which stems from the program failing to limit the number of authentication attempts. An attacker could exploit this vulnerability to conduct a...

Microsoft Windows Graphics Component CVE-2016-3396 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits may allow an attacker to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Live Meeting...

Beckhoff Embedded PC Image and Automation Device Specification TwinCAT Component Security Bypass Vulnerability

Beckhoff Embedded PC Images and Automation Device Specification ADS TwinCAT Components are Beckhoff products for critical infrastructure applications in manufacturing, energy and wastewater systems. Beckhoff Embedded PC Images is a functionally configurable industrial control system for...

CVE-2014-5414

Beckhoff Embedded PC Images (pre-2014-10-22) and Automation Device Specification (ADS) TwinCAT components expose an authentication-bruteforce risk due to not limiting login attempts. This remote vulnerability could allow unauthorized access via brute-force over ADS-related services. Affected buil...

Vulnerability of the microprogramming software of the Onecell G3100v2 and Onecell G3001 modems, allowing a intruder to gain access to the device

The vulnerability of the microprogrammed software of the Onecell G3100v2 and Onecell G3001 modems lies in the improper limitation on the number of authentication attempts. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device through a...

CVE-2016-0922

EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force guessing attack...

The vulnerability of the SAP HANA database management system allows a hacker to bypass the authentication process.

The vulnerability of the SAP HANA database management system’s SQL interface stems from the lack of restrictions on the number of login attempts by the SYSTEM user when the passwordlockforsystemuser option is not supported or set to “False”. Exploiting this vulnerability allows a malicious actor ...

WordPress Cerber Limit Login Attempts Plugin <= 2.7.2 - Cross-Site Request Forgery (CSRF)

In version 2.7.2, WordPress Cerber Limit Login Attempts Plugin, doesn't check for a nonce. Solution Update the plugin...

WordPress Cerber Limit Login Attempts Plugin <= 2.7.2 - Cross-Site Request Forgery (CSRF)

In version 2.7.2, WordPress Cerber Limit Login Attempts Plugin, doesn't check for a nonce. Solution Update the plugin...

Microsoft Internet Explorer CVE-2016-3288 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-i...

CVE-2016-6145

The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists and is locked when the detailederroronconnect option is not supported or is configured as "False," which allows remote attackers to enumerat...

CVE-2016-6144

The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the passwordlockforsystemuser is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP...

CVE-2016-6144

The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the passwordlockforsystemuser is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP...

CVE-2016-6145

SAP HANA DB 1.00.091.00.1418659308 is affected by a user-enumeration vulnerability where the SQL interface leaks different error messages for failed logins depending on whether a username exists/ is locked due to the detailed_error_on_connect setting. Remote attackers could exploit a series of lo...