Schneider Electric homeLYnk Controller

CVSS V3 6.3 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Schneider Electric Equipment: homeLYnk Controller, LSS100100 Vulnerability: Cross-site Scripting AFFECTED PRODUCTS Schneider Electric reports that the vulnerability affects the following products: homeLYnk Controller,...

GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-336-05 GE Proficy HMI/SCADA IFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian Vulnerability that was published January 17, 2017, on the NCCIC/ICS-CERT web site. GE has reported an insufficiently protecte...

Advantech WebAccess

CVSS V3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Advantech Equipment: WebAccess Vulnerabilities: Authentication Bypass, SQL Injection AFFECTED PRODUCTS The following WebAccess version is affected: WebAccess Version 8.1 IMPACT Successful exploitation of this...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe Acrobat, Reader, and Flash Player. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Adobe Security Bulletin...

ICSMA-17-009-01A_St. Jude Merlin@home Transmitter Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSMA-17-009-01 St. Jude Merlin@home Transmitter Vulnerability that was published January 9, 2017, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 5 -------- MedSec Holdings has identified a channel...

Cogent DataHub Elevation of Privilege Vulnerability

OVERVIEW Steven Seeley of Source Incite has identified a privilege elevation vulnerability in the Cogent DataHub application produced by Cogent Real-Time Systems, Inc. Cogent has produced a new version to mitigate this vulnerability. Steven Seeley has tested the new version to validate that it...

Siemens APOGEE Insight Incorrect File Permissions Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-16-082-01 Siemens APOGEE Insight Incorrect File Permissions Vulnerability that was published March 22, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 3 -------- Siemens has identified an...

Siemens Patches Insufficient Entropy Vulnerability in ICS Systems

German industrial giant Siemens has provided a firmware update addressing vulnerabilities that are found in a popular line of its Desigo PX industrial control hardware used in controlling primarily HVAC systems in commercial buildings . On Wednesday, Siemens, in coordination with ICS-CERT, issued...

FTC Releases Alert on Fake Apps for Mobile Devices

The Federal Trade Commission FTC has released an alert on fraudulent mobile apps designed to exploit consumers. Some fake apps may steal personal information such as credit card numbers. By taking precautions, users can protect themselves and their private data. US-CERT encourages users and...

VMware Releases Security Update

VMware has released a security update to address a vulnerability in vSphere Hypervisor ESXi. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review VMware Security Advisory VMSA-2016-0023 and...

Siemens SIMATIC S7-1200 CPU Protection Mechanism Failure

OVERVIEW Siemens has identified a protection mechanism failure vulnerability in old firmware versions of SIMATIC S7-1200. Maik Brüggemann and Ralf Spenneberg from Open Source Training reported this issue directly to Siemens. Siemens provides SIMATIC S7-1200 CPU product, release V4.0 or newer, to...

NetGear lot of router remote command injection vulnerability analysis(Update Patch analysis)-vulnerability warning-the black bar safety net

0x01 introduction Two days before the NTP just doing the complete thing, the NetGear routerNETGEAR routerand to engage in things of T. T. The current CERT in the last week, five have issued a notice,“if the user comes to the router, it is recommended to stop use until the official release of the...

Joomla! Releases Security Update for CMS

Joomla! has released version 3.6.5 of its Content Management System CMS software to address multiple vulnerabilities. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected website. US-CERT encourages users and administrators to review the Joomla!...

Beta Firmware Updates Available for Vulnerable Netgear Routers

Netgear has begun pushing out beta versions of firmware updates that will address a critical vulnerability that was disclosed late last week. The networking vendor also confirmed that many more routers in its Nighthawk line are vulnerable than originally reported. The flaw allows attackers to car...

Microsoft Releases December 2016 Security Bulletin

Microsoft has released 12 updates to address vulnerabilities in Microsoft software. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the following Microsoft Security Bulletins...

Netgear R7000/R6400 like router exposure remote arbitrary command injection vulnerability, CERT recommends that a comprehensive moratorium on the use-vulnerability warning-the black bar safety net

You with Netgear NETGEAR router? The recent need to be extra careful, especially router model R7000 and R6400 users-Netgear other models the users also need to beware. CERT/CC-us computer Emergency Response Team Coordination Center on Friday issued a security Bulletin, users are advised to suspen...

Apple Releases Security Updates

Apple has released security updates to address vulnerabilities in tvOS and iOS. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators review the Apple security pages for tvOS and iOS and apply t...

INTERSCHALT VDR G4e Path Traversal Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified a path traversal vulnerability in INTERSCHALT Maritime Systems’s INTERSCHALT VDR G4e application. INTERSCHALT has produced a patch to mitigate this vulnerability. Maxim Rupp has tested the patch to validate that it resolves the...

Netgear R7000 and R6400 cgi-bin Command Injection

This module exploits an arbitrary command injection vulnerability in Netgear R7000 and R6400 router firmware version 1.0.7.21.1.93 and possibly earlier. Module Options msf use exploit/linux/http/netgear/r7000cgibinexec msf undefinedr7000cgibinexec show actions ...actions... msf...

Schneider Electric Building Operation Automation Server Vulnerability

OVERVIEW Independent researcher Karn Ganeshen has identified a vulnerability in servers programmed with Schneider Electric’s StruxureWare Building Operation software. Schneider Electric has produced a new version to mitigate this vulnerability. This vulnerability could be exploited remotely...