GE Industrial Solutions UPS SNMP Adapter 4.8 - Multiple Vulnerabilities

GE Industrial Solutions UPS SNMP Adapter 4.8 - Multiple Vulnerabilities Exploit Title: GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Storage of Sensitive Information Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.geindustrial.com/ Versions...

GE Industrial Solutions UPS SNMP Adapter < 4.8 - Multiple Vulnerabilities

Exploit Title: GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Storage of Sensitive Information Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.geindustrial.com/ Versions Reported: All SNMP/Web Interface cards with firmware version prior to 4.8...

GE Industrial Solutions UPS SNMP Adapter < 4.8 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Storage of Sensitive Information Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.geindustrial.com/ Versions Reported: All...

NETGEAR ProSafe Network Management System 300 Authenticated File Download

Netgear's ProSafe NMS300 is a network management utility that runs on Windows systems. The application has a file download vulnerability that can be exploited by an authenticated remote attacker to download any file in the system. This module has been tested with versions 1.5.0.2, 1.4.0.17 and...

Comodo Chromodo Browsers Vulnerable to Cross-Domain Attacks

Some Comodo Chromodo browser versions 45.8.12.392, 45.8.12.391, and possibly earlier are vulnerable to cross-domain attacks. When a user of a vulnerable Chromodo browser visits a specially crafted web page, an attacker may obtain access to web content from another domain. US-CERT recommends users...

FTC Announces Enhancements to IdentityTheft.gov

The Federal Trade Commission FTC has upgraded its IdentityTheft.gov site to provide improved help to victims of identity theft. Enhancements include more personalized response plans for consumers, automatic generation of documents to aid in recovery, and better integration of the site with the...

OpenSSL Releases Security Advisory

OpenSSL versions 1.0.2f and 1.0.1r have been released to address vulnerabilities in prior versions. Exploitation of these vulnerabilities may allow a remote attacker to obtain sensitive information. US-CERT encourages users and administrators to review the OpenSSL Security Advisory and apply the...

Cisco Releases Security Update

Cisco has released a security update to address a vulnerability in the web-based management interface of Cisco RV220W Wireless Network Security Firewall devices. Exploitation of this vulnerability could allow a remote attacker to take control of an affected device. Users and administrators are...

Mozilla Releases Security Updates

Mozilla has released security updates to address multiple vulnerabilities in Firefox. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system. Available updates include: Firefox 44 Firefox ESR 38.6 US-CERT encourages users and administrators ...

Apple Releases Security Update for tvOS

Apple has released a security update for tvOS to address multiple vulnerabilities. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Apple security update for tvOS 9.1.1 Apple ...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in Modular Encoding Platform D9036 software, Unified Computing System UCS Manager software, and Firepower 9000 Series devices. Exploitation of these vulnerabilities could allow a remote attacker to take control of an affected device...

Linux Kernel Vulnerability

US-CERT is aware of a Linux kernel vulnerability affecting Linux PCs and servers and Android-based devices. Exploitation of this vulnerability may allow an attacker to take control of an affected system. US-CERT recommends that users and administrators review the Redhat Security Blog and the Debi...

IRS Releases Ninth Security Tip

The Internal Revenue Service IRS has released the ninth in a series of tips intended to help the public protect personal and financial data online and at home. This tip describes new procedures taken by the IRS, state governments, and the tax industry to provide a safer, more secure filing...

Oracle Releases Security Bulletin

Oracle has released its Critical Patch Update for January 2016 to address 248 vulnerabilities across multiple products. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Oracle...

Accuenergy Acuvim II Series AXM-NET Module Vulnerabilities

OVERVIEW Independent researcher Maxim Rupp has identified authentication bypass vulnerabilities in Accuenergy’s Acuvim II Series AXM-NET module. Accuenergy has produced guidelines to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS The following...

Siemens SCALANCE S613 Denial-of-Service Vulnerability

OVERVIEW Siemens has identified a resource exhaustion vulnerability that causes a denial-of-service condition in the Siemens SCALANCE S613 device. Siemens recommends that customers contact Siemens customer support in order to obtain advice on a solution for the customer’s specific environment. Th...

Microsoft Releases January 2016 Security Bulletin

Microsoft has released nine updates to address vulnerabilities in Microsoft software. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Microsoft Security Bulletins MS16-001...

imap-ntlm-info NSE Script

This script enumerates information from remote IMAP services with NTLM authentication enabled. Sending an IMAP NTLM authentication request with null credentials will cause the remote service to respond with a NTLMSSP message disclosing information to include NetBIOS, DNS, and OS build version...

VMware Releases Security Updates

VMware has released security updates to address a vulnerability in VMware ESXi, Fusion, Player, and Workstation. Exploitation of this vulnerability may allow escalation of privileges. US-CERT encourages users and administrators to review VMware Security Advisory VMSA-2016-0001 and apply the...

Directory Browsing Enabled on /cgi-bin (deprecated)

The /cgi-bin directory on the remote web server is browsable. An unauthenticated, remote attacker can exploit this to disclose sensitive information. This plugin has been deprecated. Use webmirror3.nbin plugin ID 10662 instead to identify browsable directories. %NASLMINLEVEL 999999 C Tenable...