European Central Bank Shuts Down 'BIRD Portal' After Getting Hacked

The European Central Bank ECB confirmed Thursday that it had been hit by a cyberattack that involved attackers injecting malware into one of its websites and potentially stealing contact information of its newsletter subscribers. Headquartered in Germany, the European Central Bank ECB is the...

CVE-2019-0346

Unencrypted communication error in SAP Business Objects Business Intelligence Platform Central Management Console, version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure...

CVE-2019-0335

Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console, versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the...

CVE-2019-0346

The CVE-2019-0346 entry concerns SAP Business Objects Business Intelligence Platform (Central Management Console) v4.2, where an unencrypted communication error can disclose the list of user names and roles imported from SAP NetWeaver BI systems. The affected component is the Central Management C...

CVE-2019-0335

SAP BusinessObjects BI Platform Central Management Console (versions 4.1–4.3) is affected by a stored XSS in the user description field. An attacker can store a payload in a user’s description that executes when the mouse hovers over the description in the UI’s info popup. The available documents...

eQ-3 Homematic CCU2 and CCU3 Command Injection Vulnerabilities

The eQ-3 Homematic CCU3 and eQ-3 HomeMatic CCU2 are both central control units for a smart home system from eQ-3 Germany. A command injection vulnerability exists in the eQ-3 Homematic CCU2 and CCU3, which can be exploited by an attacker to execute an illegal command if a networked system or...

eQ-3 Homematic CCU2 and CCU3 Input Validation Error Vulnerability

The eQ-3 Homematic CCU3 and eQ-3 HomeMatic CCU2 are both central control units for a smart home system from eQ-3 Germany. An input validation error vulnerability exists in eQ-3 Homematic CCU2 and CCU3, which can be exploited by an unauthenticated attacker to achieve remote code execution...

eQ-3 HomeMatic CCU2 and eQ-3 Homematic CCU3 Access Control Error Vulnerabilities

The eQ-3 Homematic CCU3 and the eQ-3 HomeMatic CCU2 are both central control units for a smart home system from eQ-3 Germany. An access control error vulnerability exists in the JSON API in the eQ-3 Homematic CCU2 version prior to 2.47.10 and the eQ-3 Homematic CCU3 version prior to 3.47.10, whic...

Why XDR Is A Big Deal, and Is Different from SIEM and Platforms

In Jon Clay’s post, he does a great job of explaining the evolution from EDR to XDR. In short, he explained that Endpoint Detection and Response EDR is great, but that having sources of information beyond endpoint is better. The ‘X’ in XDR is essentially ‘many’ or whatever we can add to provide a...

eQ-3 Homematic CCU3 Input Validation Error Vulnerability

The eQ-3 Homematic CCU3 is a central control unit for smart home systems from eQ-3 Germany. An input validation error vulnerability exists in the 'Call' function of the ReGa core logic process in eQ-3 Homematic CCU3 3.47.15 and earlier versions, which can be exploited by an attacker to cause a...

CVE-2019-14474

eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can...

qt5-qtimageformats: QTgaFile CPU exhaustion

An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption...

Central Dogma vulnerable to cross-site scripting

Overview Central Dogma provided by LINE Corporation contains a cross-site scripting vulnerability CWE-79. LINE Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LINE Corporation coordinated under the Information Security Early Warning...

PrinterOn Central Print Services Information Disclosure Vulnerability

PrinterOn Central Print Services CPS is a print service center management solution from PrinterOn Canada. An information disclosure vulnerability exists in PrinterOn CPS version 4.1.4 and earlier. The vulnerability stems from an error in configuration or other errors in the operation of a network...

JVN#94889214: Central Dogma vulnerable to cross-site scripting

Central Dogma provided by LINE Corporation contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provided by the developer. Products Affecte...

Central Dogma Cross-Site Scripting Vulnerability

Central Dogma is an open source service configuration version control repository based on Git, ZooKeeper and HTTP/2. A cross-site scripting vulnerability exists in Central Dogma versions 0.17.0 through 0.40.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB...

CVE-2018-17211

An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request...

CVE-2018-17213

An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. A user without valid credentials can bypass the authentication process, obtaining a valid session cookie with guest/pseudo-guest level privileges. This cookie can then be further used to perform other attacks...

Cross site request forgery (csrf)

An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request...

CVE-2018-17213

CVE-2018-17213 affects PrinterOn Central Print Services (CPS) up to version 4.1.4. The issue allows a user without valid credentials to bypass authentication and obtain a valid session cookie with guest/pseudo-guest privileges, which can then be used to perform other attacks. The Red Hat and NVD ...