Apache Releases Security Updates for Apache Tomcat

The Apache Software Foundation has released Apache Tomcat 9.0.1 and 8.5.23 to address a vulnerability in previous versions of the software. A remote attacker could exploit this vulnerability to take control of an affected server. US-CERT encourages users and administrators to review the Apache...

Dnsmasq Contains Multiple Vulnerabilities

Dnsmasq versions 2.77 and prior contain multiple vulnerabilities. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review VUL Note VU973527 for more information and update to dnsmasq...

Apple Releases Security Update for iOS

Apple has released iOS 11.0.2 to address vulnerabilities in previous versions of iOS. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Apple security page for iOS 11.0.2 and...

October is National Cybersecurity Awareness Month

October is National Cybersecurity Awareness Month NCSAM. NCSAM is a collaborative effort between DHS and its public and private partners--including the National Cyber Security Alliance NCSA--to raise awareness about the vital role cybersecurity plays in the lives of U.S. citizens. US-CERT will be...

Siemens Patches Improper Access Vulnerability in Ruggedcom Protocol

Industrial manufacturer Siemens is encouraging users running devices that use its Ruggedcom Discovery Protocol RCDP to apply firmware updates this week. The updates resolve a serious and remotely exploitable vulnerability that could let an attacker carry out administrative actions. The issue, an...

DNSSEC Key Signing Key Rollover Postponed

The Internet Corporation for Assigned Names and Numbers ICANN has announced that the change to the Root Zone Key Signing Key KSK scheduled for October 11, 2017, has been postponed. A new date for the Key Roll has not yet been determined. DNSSEC is a set of DNS protocol extensions used to digitall...

LAquis SCADA 4.1.0.2385 Directory Traversal

require 'msf/core' class MetasploitModule 'LAquis SCADA Web Server Directory Traversal Information Disclosure', 'Description' = %q This module exploits a directory traversal vulnerability found in the LAquis SCADA application. The vulnerability is triggered when sending a series of dot dot slashe...

Mozilla Releases Security Updates

Mozilla has released security updates to address multiple vulnerabilities in Firefox ESR 52.4 and Firefox 56. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the Mozilla Security Advisories...

LAquis SCADA 4.1.0.2385 - Directory Traversal (Metasploit)

LAquis SCADA 4.1.0.2385 - Directory Traversal Metasploit require 'msf/core' class MetasploitModule 'LAquis SCADA Web Server Directory Traversal Information Disclosure', 'Description' = %q This module exploits a directory traversal vulnerability found in the LAquis SCADA application. The...

Oracle Patches Apache Struts, Reminds Users to Update Equifax Bug

Oracle released fixes for a handful of recently patched Apache Struts 2 vulnerabilities, including a critical remote code execution vulnerability CVE-2017-9805 that could let an attacker take control of an affected system, late last week. The Apache Software Foundation patched the RCE...

Apple Releases Security Update for iOS

Apple has released iOS 11.0.1 to address vulnerabilities in previous versions of iOS. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Apple security page for iOS 11.0.1 and...

Linux kernel 'x509_cert_parser.c' information disclosure vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the U.S. The NFSv4 implementation is one of the distributed file system protocols. An information disclosure vulnerability exists in Linux kernel. An attacker can exploit this vulnerability to...

Oracle Patches Apache Vulnerabilities

Oracle has released security updates to address Apache Struts 2 vulnerabilities found across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the Oracle Security Alert and...

Google Releases Security Updates for Chrome

Google has released Chrome version 61.0.3163.100 for Windows, Mac, and Linux. This update addresses multiple vulnerabilities that an attacker may exploit to cause a denial-of-service condition. US-CERT encourages users and administrators to review the Chrome Releases page and apply the necessary...

Joomla! Releases Security Update

Joomla! has released version 3.8.0 of its Content Management System CMS software to address a vulnerability. A remote attacker could exploit this vulnerability to obtain access to sensitive information. US-CERT encourages users and administrators to review the Joomla! Security Release and apply t...

Saia Burgess Controls PCD Controllers

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Saia Burgess Controls Equipment: PCD Controllers Vulnerability: Information Exposure REPOSTED INFORMATION This advisory was originally posted to the NCCIC Portal on August 22, 2017, and is being released to the...

Digium Asterisk GUI

CVSS v3 8.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Digium Equipment: Asterisk GUI Vulnerability: Improper Neutralization of Special Elements used in an OS Command AFFECTED PRODUCTS The following versions of Asterisk GUI, a framework for configuring graphical user...

FTC Releases Alerts on Protecting Against Identity Theft

The Federal Trade Commission FTC has released two alerts to educate consumers on recommended protections against identity theft after the recent data breach at Equifax. Users should consider placing security freezes with the three major credit reporting agencies: Equifax, Transunion, and Experian...

WordPress Releases Security Update

WordPress versions prior to 4.8.2 are affected by multiple vulnerabilities. A remote attacker could exploit some of these vulnerabilities to take control of an affected website. US-CERT encourages users and administrators to review the WordPress Security Release and upgrade to WordPress 4.8.2. Th...

Samba Releases Security Updates

The Samba Team has released security updates to address several vulnerabilities in Samba. An attacker could exploit any of these vulnerabilities to obtain access to potentially sensitive information. US-CERT encourages users and administrators to review the Samba Security Announcements for...