CVE-2020-24633

CVE-2020-24633: Multiple buffer-overflow flaws in Aruba’s PAPI over UDP port 8211 allow unauthenticated remote code execution on ArubaOS devices. Affected are Aruba 9000 Gateway, Aruba 7000 Series Mobility Controllers, and Aruba 7200 Series Mobility Controllers with versions: 2.1.0.1, 2.2.0.0 and...

CVE-2020-24634

The CVE-2020-24634 vulnerability affects ArubaOS/PAPI on Aruba AP management UDP port 8211 (Aruba 9000 Gateway, Aruba 7000 and 7200 series mobility controllers). A remote attacker can inject arbitrary commands by sending specially crafted packets. Affected versions include Aruba 9000 gateway, and...

CVE-2020-7541

A CWE-425: Direct Request 'Forced Browsing' vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules see security notification for affected versions, that could cause disclosure of sensitive data when sending a...

CVE-2020-7543

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium see security notifications for affected versions, that could cause denial of service when a specially crafted Read Physical Memo...

CVE-2020-7537

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium see security notifications for affected versions, that could cause denial of service when a specially crafted Read Physical Memo...

CVE-2020-7542

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium see security notifications for affected versions, that could cause denial of service when a specially crafted Read Physical Memo...

Design/Logic Flaw

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium see security notifications for affected versions, that could cause denial of service when a specially crafted Read Physical Memo...

CVE-2020-7537

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium see security notifications for affected versions, that could cause denial of service when a specially crafted Read Physical Memo...

Aruba Networks ArubaOS Command Injection Vulnerability

Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks including Mobility Controllers and Mobility Access Switches from Aruba Networks, Inc. A security vulnerability exists in ArubaOS. No information about this vulnerability is available at this time, so please stay tun...

HPESBNW04072 rev.2 - HPE ArubaOS, Multiple Remote Vulnerabilities

Potential Security Impact: Remote: Arbitrary Code Execution, Arbitrary Command Execution, Compromise of System Integrity SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 7000 Series Mobility Controllers 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and bel...

The vulnerability in the web interface for managing data collection and aggregation from Cisco DNA Spaces Connector controllers and access points allows a hacker to execute arbitrary commands.

The vulnerability in the web interface for managing data collection and aggregation from Cisco DNA Spaces Connector controllers and access points is related to the failure to eliminate special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor...

The vulnerability of the XHCI interface of USB controllers in VMware ESXi, VMware Workstation, VMware Fusion, and the VMware Cloud Foundation virtualization platform allows a perpetrator to execute arbitrary code.

The vulnerability of the XHCI Extensible Host Controller Interface interface of USB controllers in VMware ESXi, VMware Workstation, VMware Fusion, and VMware Cloud Foundation virtualization platforms is related to the use of memory after release. Exploiting this vulnerability can allow an attacke...

The vulnerability of Intel Ethernet Series 700 controllers, which stems from the improper use of security mechanisms, allows attackers to trigger a service failure or increase their privileges.

The vulnerability of Intel Ethernet Series 700 controllers is related to the improper use of security mechanisms. Exploiting this vulnerability can allow attackers to cause service failures or increase their privileges...

Zerologon is now detected by Microsoft Defender for Identity

There has been a huge focus on the recently patched CVE-2020-1472 Netlogon Elevation of Privilege vulnerability, widely known as ZeroLogon. While Microsoft strongly recommends that you deploy the latest security updates to your servers and devices, we also want to provide you with the best...

Symantec Reports on Cicada APT Attacks against Japan

Symantec is reporting on an APT group linked to China, named Cicada. They have been attacking organizations in Japan and elsewhere. Cicada has historically been known to target Japan-linked organizations, and has also targeted MSPs in the past. The group is using living-off-the-land tools as well...

APT Exploits Microsoft Zerologon Bug: Targets Japanese Companies

China-backed APT Cicada joins the list of threat actors leveraging the Microsoft Zerologon bug to stage attacks against their targets. In this case, victims are large and well-known Japanese organizations and their subsidiaries, including locations in the United States. Researchers observed a...

Unspecified Vulnerability in Intel Ethernet 700 Series Controllers

Intel Ethernet 700 Series Controllers is a 700 series Ethernet controller from Intel Corporation USA. A security vulnerability exists in IntelR Ethernet 700 Series Controllers prior to version 7.3, which stems from a protection mechanism failure that can be exploited by a privileged user to...

November 19, 2020—KB4594441 (OS Build 14393.4048) Out-of-band

None None...

November 17, 2020—KB4594442 (OS Build 17763.1579) Out-of-band

None None...

Saia Burgess Controls PCD Controller Hard-coded Password Vulnerability

OVERVIEW Independent researcher Artyom Kurbatov has identified a hard-coded password vulnerability in Saia Burgess Controls’s family of PCD controllers. Saia Burgess Controls has produced a new firmware version to mitigate this vulnerability. Artyom Kurbatov has tested the new firmware version to...