IBM Security Guardium Information Disclosure Vulnerability (CNVD-2016-09647)

IBM Security Guardium is a data activity monitor product from IBM USA. The product offers features such as automated controls for compliance and protection against internal and external threats. An information disclosure vulnerability exists in IBM Security Guardium that originates from...

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions Information Disclosure Vulnerabilities

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions are Auto-Matrix USA's building automation front-end solutions for infrastructure, which are primarily deployed stateside in commercial facilities, critical manufacturing and energy and wastewater systems I&C. A...

Unbreakable Enterprise kernel security and bugfix update

kernel-uek 3.8.13-118.13.2 - HID: hiddev: validate numvalues for HIDIOCGUSAGES, HIDIOCSUSAGES commands Scott Bauer Orabug: 24798695 CVE-2016-5829 3.8.13-118.13.1 - Revert 'rds: skip rx/tx work when destroying connection' Brian Maly Orabug: 24790116 3.8.13-118.12.1 - scsisysfs: protect against...

Vulnerabilities in Insulin Pumps Can Lead to Overdose

Patients who use insulin pumps made by Johnson & Johnson are being warned this week that vulnerabilities in the devices could be exploited to trigger an overdose. The bugs exist in OneTouch Ping, a medical device made by Animas Corp. – a subsidiary of Johnson & Johnson – which allows diabetic...

USN-3087-2: OpenSSL regression

USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was incomplete and caused a regression when parsing certificates. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Shi Lei discovered that OpenSSL incorrectly handled the OCSP Statu...

OmniMetrix OmniView Vulnerabilities

OVERVIEW Bill Voltmer of Elation Technologies LLC has identified vulnerabilities in OmniMetrix’s OmniView web application. OmniMetrix has produced a new software version for its web interface that mitigates these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCT...

FortiClient SSL-VPN 5.4 Clear Text Password Extraction

Title : Extracting clear text passwords from running processesFortiClient CVE-ID : none Product : FortiClient SSLVPN Service : FortiTray.exe Affected : =5.4 Impact : Critical Remote : No Website link : http://forticlient.com/ Reported : 31/08/2016 Authors : Viktor Minin https://1-33-7.com Alexand...

IBM BixFix Platform Man-in-the-Middle Information Disclosure Vulnerability

IBM BigFix formerly known as IBM Endpoint Manager, Tivoli Endpoint Manager is a set of system management software from the American company IBM. The software provides remote control, patch management, software distribution, operating system deployment, network access protection and other function...

Phoenix Contact ILC PLC Authentication Vulnerabilities

OVERVIEW Matthias Niedermaier and Michael Kapfer of HSASec Hochschule Augsburg have identified authentication vulnerabilities in Phoenix Contact’s ILC inline controller PLCs. Phoenix Contact GmbH & Co. KG has produced a mitigation plan that includes an update and recommended security practices to...

UBUNTU-CVE-2016-2837

Heap-based buffer overflow in the ClearKey Content Decryption Module CDM in the Encrypted Media Extensions EME API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media...

IBM QRadar SIEM Information Disclosure Vulnerability (CNVD-2016-05955)

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. IBM QRadar SIEM ha...

Clear Voyager Hotspot IMW-C910W File Disclosure

Exploit Title: clear voyager hotspot IMW-C910W - file disclosure - Date: 2016/jul/15 - Exploit Author: Damaster - Vendor Homepage: https://www.sprint.com/ - Software Link: https://web.archive.org/web/20150526042938/http://www.clearwire.com/downloads/IMW-C910WV2234R4383A.bin - Version: R4383 - -...

Clear Voyager Hotspot IMW-C910W - Arbitrary File Disclosure

Clear Voyager Hotspot IMW-C910W - Arbitrary File Disclosure - Exploit Title: clear voyager hotspot IMW-C910W - file disclosure - Date: 2016/jul/15 - Exploit Author: Damaster - Vendor Homepage: https://www.sprint.com/ - Software Link:...

Paragon Initiative Enterprises: [URGENT] Password reset emails are sent in clear-text (without encryption)

Hey, I've found that when we use the 'forgot password' page to recover our password, bridge.cspr.ng sends an email to us, and when I tried to get more information about the email from [email protected], I saw that the email is sent in clear-text instead of TLS which is so vulnerable since any...

DEBIAN-CVE-2014-9773

modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the 1 LIST, 2 CLEAR, or 3 MODIFY keyword nicks...

IBM UrbanCode Deploy Information Disclosure Vulnerability (CNVD-2016-03996)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

The vulnerability of Safari browser and iOS operating system allows attackers to obtain confidential information.

The vulnerability of the “Clear History and Website Data” function in the Safari browser and the iOS operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow a local attacker to obtain confidential information...

Unspecified vulnerability in ntpd (CNVD-2016-03822)

ntpd Network Time Protocol daemon is an operating system daemon that uses the Network Time Protocol NTP to keep synchronized with the system time of a time server. An unspecified vulnerability exists in NTP.org ntpd versions prior to 4.2.8p8. An attacker can exploit this vulnerability by sending...

Apple iOS Safari Information Disclosure Vulnerability (CNVD-2016-03485)

Apple iOS is an operating system on Apple phones. The Safari 'Clear History and Website Data' feature in Apple iOS fails to clear history, allowing attackers to exploit a vulnerability to build malicious web pages to trick users into parsing them, which can crash applications or execute arbitrary...

CVE-2016-1849

The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory...