Delta Industrial Automation TPEditor

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Delta Electronics Equipment: TPEditor Vulnerabilities: Out-of-bounds Read, Stack-based Buffer Overflow, Heap-based Buffer Overflow, Write-what-where Condition, Improper Input Validation 2. RISK EVALUATION Successful...

ICSA-20-212-02_Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: Mitsubishi Electric, Multiple Factory Automation Engineering Software products Vulnerability: Permission Issues 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update...

OSV-2020-1473 Segv on unknown address in LValue::addUnsizedArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19704 Crash type: Segv on unknown address Crash state: LValue::addUnsizedArray PointerExprEvaluator::VisitCastExpr clang::StmtVisitorBase::Visit...

OSV-2020-1432 Segv on unknown address in EvaluateObjectArgument

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19880 Crash type: Segv on unknown address Crash state: EvaluateObjectArgument ExprEvaluatorBase::handleCallExpr clang::StmtVisitorBase::Visit...

OSV-2020-1319 Use-of-uninitialized-value in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15843 Crash type: Use-of-uninitialized-value Crash state: Interpreter::evaluate jsonnetvmexecute jsonnetevaluatesnippetaux...

OSV-2020-1116 Heap-use-after-free in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15888 Crash type: Heap-use-after-free READ 4 Crash state: Interpreter::evaluate jsonnetvmexecute jsonnetevaluatesnippetaux...

How CARTA Strategies for Web Applications are Met with Indusface AppTrana Solution

Gartner’s CARTA Continuous Adaptive Risk and Trust Assessment, which sets out their vision for security, is increasingly being adopted by several enterprises. Recently Gartner also called out CARTA strategic approach in the top 10 security projects for 2019. CARTA, being a strategic approach,...

kernel: use-after-free in arch/x86/lib/insn-eval.c

A vulnerability was found in the arch/x86/lib/insn-eval.c function in the Linux kernel. An attacker could corrupt the memory due to a flaw in use-after-free access to an LDT entry caused by a race condition between modifyldt and a BR exception for an MPX bounds violation...

Updated perl-YAML packages fix security vulnerability

Updated perl-YAML package fixes security vulnerability: This update enforces that $LoadCode must be enabled to use the feature of evaluating typeglobs, because with the typeglob feature you would be able to set the variable $YAML::LoadCode from a YAML file, and that would be a security issue. The...

Engel & Völkers Technology GmbH: Remote Code Execution (RCE) at "juid" parameter in /get_zip.php (printshop.engelvoelkers.com)

Summary Taking advantage of the vulnerability reported in 914194, it has been possible to analyze certain application code and detect remote code execution at https://printshop.engelvoelkers.com/getzip.php?juid=1 due to a lack of sanitization of the inputs received by the web application. This...

OSV-2020-587 UNKNOWN READ in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15844 Crash type: UNKNOWN READ Crash state: Interpreter::evaluate jsonnetvmexecute jsonnetevaluatesnippetaux...

The vulnerability of the eval function in the Python library for secure private machine learning, PySyft, allows a hacker to execute arbitrary code.

The vulnerability of the eval function in the Python library for secure private machine learning, PySyft, is related to insufficient validation of the data provided by users. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted...

Honeywell ControlEdge PLC and RTU

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Honeywell Equipment: ControlEdge PLC and RTU Vulnerabilities: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an...

Baxter Sigma Spectrum Infusion Pumps (Update B)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Baxter Equipment: Sigma Spectrum Infusion Pumps Vulnerabilities: Use of Hard-coded Password, Cleartext Transmission of Sensitive Data, Incorrect Permission Assignment for Critical Resource, Operation on...

The science behind Microsoft Threat Protection: Attack modeling for finding and stopping evasive ransomware

The linchpin of successful cyberattacks, exemplified by nation state-level attacks and human-operated ransomware, is their ability to find the path of least resistance and progressively move across a compromised network. Determining the full scope and impact of these attacks is one the most...

Arbitrary Code Execution

Overview cd-messenger is a console log logger gulp notification browser node message. Affected versions of this package are vulnerable to Arbitrary Code Execution. User input provided to the color argument executed by the eval function resulting in code execution. PoC var a = require"cd-messenger...

ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection

A flaw was found in the way ksh evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables...

Emerson OpenEnterprise

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Emerson Equipment: OpenEnterprise SCADA Software Vulnerabilities: Missing Authentication for Critical Function, Improper Ownership Management, Inadequate Encryption Strength 2. RISK EVALUATION...

Operational resilience in a remote work world

Microsoft CEO Satya Nadella recently said, “We have seen two years’ worth of digital transformation in two months.” This is a result of many organizations having to adapt to the new world of document sharing and video conferencing as they become distributed organizations overnight. At Microsoft, ...

CVE-2020-11070 Cross-Site Scripting in SVG Sanitizer

The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site...