CPU Side-Channel Information Disclosure Vulnerabilities

On January 3, 2018, researchers disclosed three vulnerabilities that take advantage of the implementation of speculative execution of instructions on many modern microprocessor architectures to perform side-channel information disclosure attacks. These vulnerabilities could allow an unprivileged...

Impact of Meltdown and Spectre on Akamai

Overview On Wednesday, January 3rd, researchers from Google Project Zero, Cyberus Technology, Graz University of Technology, and other organizations released details about a pair of related vulnerabilities, dubbed Meltdown and Spectre. These vulnerabilities appear to affect all modern processors...

Vendors Share Patch Updates on Spectre and Meltdown Mitigation Efforts

Intel, Amazon, Microsoft and others are playing down concerns over the impact of the massive Spectre and Meltdown vulnerabilities affecting computers, servers and mobile devices worldwide. The two flaws, Spectre and Meltdown, are far reaching and impact a wide range of microprocessors used in the...

Cisco Warns 69 Products Impacted by KRACK

Cisco said Wednesday that multiple Cisco wireless products are vulnerable to the recently identified Key Reinstallation Attacks KRACK. On Monday, researchers revealed how the KRACK vulnerabilities plagued the WPA2 protocol used to secure all modern Wi-Fi networks. In their report, researchers...

CVE-2017-12251

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

CVE-2017-12251

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

Denial of service

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

CVE-2017-12251

The CVE-2017-12251 issue affects Cisco Cloud Services Platform (CSP) 2100 running software releases 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1, or 2.2.2. The vulnerability arises from weaknesses in the generation of authentication mechanisms in the CSP web console URL, enabling an authenticated, remote at...

CVE-2017-12251

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

Cisco Cloud Services Platform Unauthorized Access Vulnerability

Cloud Services Platform 2100 is a unified and optimized x86 software and hardware platform for virtualizing data center network functions. The Cisco Cloud Services Platform CSP 2100 operates with a security vulnerability in the implementation of the Web console that could allow an authenticated,...

Cisco Cloud Services Platform 2100 Unauthorized Access Vulnerability

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

Cisco Releases Security Updates

Cisco has released updates to address vulnerabilities affecting multiple products. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply the...

CVE-2017-14417

registersend.php on D-Link DIR-850L REV. B with firmware through FW208WWb02 devices does not require authentication, which can result in unintended enrollment in mydlink Cloud Services...

Authentication flaw

registersend.php on D-Link DIR-850L REV. B with firmware through FW208WWb02 devices does not require authentication, which can result in unintended enrollment in mydlink Cloud Services...

Design/Logic Flaw

The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 and REV. B with firmware through FW208WWb02 devices, participates in mydlink Cloud Services by establishing a TCP relay service for HTTP, even though a TCP relay service for HTTPS is also...

CVE-2017-14419

The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 and REV. B with firmware through FW208WWb02 devices, participates in mydlink Cloud Services by establishing a TCP relay service for HTTP, even though a TCP relay service for HTTPS is also...

CVE-2017-14417

D-Link DIR-850L REV. B devices (firmware up to FW208WWb02) are affected by CVE-2017-14417 due to register_send.php not requiring authentication, enabling unintended enrollment in mydlink Cloud Services. Root cause: missing auth on register_send.php. Impact: potential attacker could gain access or...

CVE-2017-14419

CVE-2017-14419 affects the D-Link DIR-850L NPAPI extension used with REV A (FW114WWb07_h2ab_beta1) and REV B (FW208WWb02). The issue is that this NPAPI component participates in mydlink Cloud Services by establishing a TCP relay service for HTTP, in addition to an existing TCP relay for HTTPS. CN...

CVE-2017-14417

registersend.php on D-Link DIR-850L REV. B with firmware through FW208WWb02 devices does not require authentication, which can result in unintended enrollment in mydlink Cloud Services...

CVE-2017-14418

The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B with firmware through FW208WWb02 devices, sends the cleartext admin password over the Internet as part of interaction with mydlink Cloud Services...