Adobe Customer Information and Source Code Compromises

US-CERT is aware of the public acknowledgement of a compromise of up to 3 million Adobe customers' information, including names and detailed account information. The source code for multiple Adobe products may also have been compromised. US-CERT advises that Adobe customers be aware of possible...

Cisco Releases Security Advisory for Cisco IOS XR

Cisco has released a security advisory to address a vulnerability in Cisco IOS XR Software version 4.3.1. If successful, this exploitation could result in complete packet memory exhaustion, rendering critical services on the affected device unable to allocate packets, resulting in a denial of...

ICS Vendor Fixes Hard-Coded Credential Bugs Nearly Two Years After Advisory

Nearly two years after a security researcher published details of the hard-coded credentials that ship with a slew of industrial control system products made by Schneider Electric, the company has released updated firmware that fix the problems. The vulnerabilities, which were discovered by...

Cisco Releases Security Advisory

Cisco has released a security advisory to address a vulnerability in the web framework of Cisco Prime Central for Hosted Collaboration Solution HCS Assurance. This vulnerability could allow an unauthenticated, remote attacker to access sensitive information on the system, including user...

Cisco Releases Security Advisory for Cisco Prime Data Center Network Manager (DCNM)

Cisco has released three security advisories to address multiple vulnerabilities affecting various components of Cisco Prime Data Center Network Manager DCNM. These vulnerabilities may allow an unauthenticated, remote attacker to disclose file components and access text files on an affected devic...

Microsoft Releases Security Advisory for Internet Explorer

Microsoft has released Security Advisory 2887505 regarding a remote code execution vulnerability CVE-2013-3893 impacting Internet Explorer versions 6 through 11. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability in Internet Explorer 8 and Internet Explorer 9. The...

DISA Security Readiness Review Scripts for Solaris Local Privilege Escalation

The remote host has a copy of the DISA Security Readiness Review SRR Scripts for Solaris that is affected by a local privilege escalation vulnerability. The vulnerability could be leveraged to execute files in arbitrary directories with root privileges, as long as such files are named 'java',...

Apple Releases OS X Mountain Lion v10.8.5 and Security Update 2013-004

Apple has released OS X v10.8.5 and Security Update 2013-004 to address multiple vulnerabilities. These vulnerabilities could lead to a denial of service, cross-site scripting, elevation of privilege, or the execution of arbitrary code. US-CERT encourages users and administrators to review Apple...

WellinTech Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on December 10, 2013, and is now being released to the NCCIC/ICS-CERT Web site. NCCIC/ICS-CERT received reports from the Zero Day Initiative ZDI regarding a remote code execution vulnerability and an information...

Microsoft Releases September 2013 Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Microsoft Office, Internet Explorer, and Microsoft Server Software as part of the Microsoft Security Bulletin Summary for September 2013. These vulnerabilities could allow remote code execution, elevation of privilege...

Security Update Available for Adobe Shockwave Player

Adobe has released a security update for Adobe Shockwave Player 12.0.3.133 and earlier versions for Windows and Macintosh to address multiple vulnerabilities. These vulnerabilities, if exploited, could allow an attacker to run malicious code on an affected system. US-CERT recommends that users an...

Siemens SINAMICS S/G Authentication Bypass Vulnerability

OVERVIEW Siemens has identified an authentication bypass vulnerability in the SINAMICS S/G product family. Siemens has produced a firmware update that mitigates this vulnerability and has tested the update to validate that it resolves the vulnerability. Exploitation of this vulnerability could...

Cisco Releases Security Advisory for Cisco WebEx Players

Cisco has released a security advisory to address multiple vulnerabilities in Cisco WebEx Recording Format WRF and Advanced Recording Format ARF Players. These vulnerabilities could allow a remote attacker to execute arbitrary code or cause a denial of service condition. US-CERT encourages users...

ClearSCADA Remote Authentication Bypass

Overview ICS-CERT originally released Advisory ICSA-11-173-01P “ClearSCADA Remote Authentication Bypass”, on the US-CERT Portal on June 22, 2011. This web page release was delayed to allow users sufficient time to download and install this update. Independent security researcher Jeremy Brown has...

Cisco Releases Security Advisory

Cisco has released a security advisory to address a vulnerability in Cisco Secure Access Control Server ACS versions 4.0 through 4.2.1.15. This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is only present when Cisco ACS is configur...

ICONICS GENESIS32 Multiple Memory Corruption

Overview Independent security researchers Billy Rios and Terry McCorkle have identified eight memory corruption vulnerabilities affecting the ICONICS GENESIS32 product. GENESIS32 is a web-deployable human-machine interface HMI supervisory control and data acquisition SCADA product. These...

Mozilla: Out-of-bounds array read in CERT_DecodeCertPackage (MFSA 2013-40)

The CERTDecodeCertPackage function in Mozilla Network Security Services NSS, as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial ...

Spear-Phishing E-mail with Missing Children Theme

The FBI is aware of a spear-phishing e-mail appearing as if it were sent from the National Center for Missing and Exploited Children. The subject of the e-mail is "Search for Missing Children," and a zip file containing three malicious files is attached. E-mail recipients should always treat link...

Microsoft Releases Security Advisory

Microsoft has released Security Advisory 2862973 impacting applications and services using certificates with the MD5 hashing algorithm. Usage of the MD5 hash algorithm in certificates could allow an attacker to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. US-CERT...

DotNetNuke DNNArticle Module 10.0 - SQL Injection

Title: DotNetNuke DNNArticle Module SQL Injection Vulnerability References: CVE-2013-5117 Discovered by: Sajjad Pourali Vendor http://www.zldnn.com/ , http://www.dnnarticle.com/‎ Vendor advisory: http://www.zldnn.com/Support/tabid/643/ctl/RecordList/mid/1691/ItemID/2979/Default.aspx Ticket iD:297...