kernel security, bug fix, and enhancement update

4.18.0-80.7.10.OL8 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 4.18.0-80.7.10 - x86 Update stepping values for Whiskey Lake U/Y David Arcari...

Encryption Key Negotiation of Bluetooth Vulnerability

Executive Summary Microsoft is aware of the Bluetooth BR/EDR basic rate/enhanced data rate, known as "Bluetooth Classic" key negotiation vulnerability that exists at the hardware specification level of any BR/EDR Bluetooth device. An attacker could potentially be able to negotiate the offered key...

'URGENT/11' Critical Infrastructure Bugs Threaten EternalBlue-Style Attacks

UPDATE A cadre of 11 vulnerabilities, six of them critical remote code-execution RCE bugs, have been uncovered that affect millions of critical infrastructure systems, such as SCADA gear at utilities, elevator and industrial controllers, patient monitors and MRI machines, programmable logic...

Schneider Electric Modicon Controllers (ICSA-19-136-01)

Binary data 720272.prm...

GHSA-958R-G534-CCMR MadsKristensen.AspNetCore.Miniblog subject to Improper Input Validation

madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in Controllers/BlogController.cs writes a decoded base64 string to a file without validating the extension...

MadsKristensen.AspNetCore.Miniblog subject to Improper Input Validation

madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in Controllers/BlogController.cs writes a decoded base64 string to a file without validating the extension...

Schneider Electric Modicon Controllers

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: Modicon Controllers Vulnerability: Improper Check for Unusual or Exceptional Conditions 2. RISK EVALUATION Successful exploitation of this vulnerability could result...

The vulnerability of the microprogrammed logic controllers from Modicon, related to access control errors, allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the programmable logic controller Modicon’s microprogramming software is related to access control errors. Exploiting this vulnerability could allow an intruder to cause service failures or execute arbitrary code by modifying the controller’s configuration using the Modbus...

The vulnerability of the microprogrammed programmable logic controller Modicon, related to the violation of trust boundaries, allows a intruder to gain unauthorized access by performing a “forceful” attack against the Modbus protocol.

The vulnerability of the microprogrammed logic controllers from Modicon relates to the violation of trust boundaries during connection. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access by performing a “forceful” attack using the Modbus protocol...

Schneider Electric Modicon M580 UMAS read memory block information disclosure vulnerability

Summary An exploitable information disclosure vulnerability exists in the UMAS read memory block function of the Schneider Electric Modicon M580 programmable automation controller, firmware version SV2.70. A specially crafted UMAS command can cause the device to return blocks of memory, resulting...

CVE-2019-12276

GrandNode 4.40 is affected by a Local File Inclusion (path traversal) in Controllers/LetsEncryptController.cs. Remote, unauthenticated attackers could retrieve arbitrary files on the web server via letsEncrypt/Index?fileName= requests. The issue is mitigated by a patch released on 2019-05-30 in G...

ZOO by YOOtheme,3.3.33,SQL Injection

ZOO by YOOtheme,3.3.33,SQL Injection Fix SQL injection vulnerability in Admin Controllers new version number 3.3.34 Update Notice URL https://yootheme.com/support/zoo/changelog...

The vulnerability of the mechanism for managing the identification of web interfaces of microprogramming software-based wireless access controller devices from Cisco Wireless LAN Controllers allows attackers to compromise the integrity of protected information.

The vulnerability of the mechanism for identifying web interfaces of microprogrammed software controllers for Cisco Wireless LAN Controllers WLC is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information by...

CVE-2016-8898

Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php...

Multiple Schneider Electric Products Input Validation Error Vulnerability (CNVD-2019-34827)

The Schneider Electric Modicon M580 is a programmable automation controller.The Schneider Electric Modicon Premium is a large programmable logic controller PLC for discrete or process applications.The Schneider Electric Modicon Quantum is a large programmable logic controller PLC for process...

CVE-2018-7856

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of Service when writing invalid memory blocks to the controller over Modbus...

CVE-2018-7853

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over Modbus...

CVE-2018-7855

A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service when sending invalid breakpoint parameters to the controller over Modbus...

CVE-2019-6807

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of service when writing sensitive application variables to the controller over Modbus...

CVE-2019-6806

A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading variables in the controller using Modbus...