Latest Microsoft Updates Patch 4 Critical Flaws In Windows RDP Client

Get your update caps on. Microsoft today released its monthly Patch Tuesday update for September 2019, patching a total of 79 security vulnerabilities in its software, of which 17 are rated critical, 61 as important, and one moderate in severity. Two of the security vulnerabilities patched by the...

Some D-Link and Comba WiFi Routers Leak Their Passwords in Plaintext

What could be worse than your router leaking its administrative login credentials in plaintext? Cybersecurity researchers from Trustwave's SpiderLabs have discovered multiple security vulnerabilities in some router models from two popular manufacturers—D-Link and Comba Telecom—that involve insecu...

Adobe Releases Security Patches For Critical Flash Player Vulnerabilities

It's Patch Tuesday again—the day of the month when both Adobe and Microsoft release security patches for vulnerabilities in their software. Adobe has just released its monthly security updates to address a total of 3 security vulnerabilities in only two of its products this time—Adobe Flash Playe...

SUSE-SU-2019:2309-1 Security update for nginx

This update for nginx fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization bsc1145579. - CVE-2019-9513: Fixed a denial of service caused by resource loops bsc1145580. - CVE-2019-9516: Fixed a denial...

The vulnerability of the Web Runtime component of the JD Edwards EnterpriseOne Tools system allows a hacker to disclose protected information.

The vulnerability of the Web Runtime component of the JD Edwards EnterpriseOne Tools system relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information using the HTTP protocol...

The vulnerability of the Core RDBMS component of the database management system Oracle Database Server allows a hacker to gain full control over the DBMS.

The vulnerability of the Core RDBMS component of the database management system Oracle Database Server is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full control over the DBMS...

The vulnerability of the Portable Clusterware component of the Oracle Database Server management system allows a hacker to gain full control over the database management system.

The vulnerability of the Portable Clusterware component of the Oracle Database Server management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain full control over the database management system...

Cisco UCS Director Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco UCS Director Unauthenticated Remote Code Execution', 'Description' = %q The Cisco UCS Director virtual appliance contains two flaws that ca...

Google Uncovers How Just Visiting Some Sites Were Secretly Hacking iPhones For Years

Beware Apple users! Your iPhone can be hacked just by visiting an innocent-looking website, confirms a terrifying report Google researchers released earlier today. The story goes back to a widespread iPhone hacking campaign that cybersecurity researchers from Google's Project Zero discovered...

The vulnerability of the NTFS file system of the Windows operating system, which allows a perpetrator to increase their privileges

The vulnerability of the NTFS file system in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

Improper input validation in Apache Santuario XML Security for Java

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this...

CVE-2019-12400

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this...

CVE-2019-12400

Affected software: Apache Santuario XML Security for Java 2.0.x (from 2.0.3) and all 2.1.x releases before 2.1.4. Root cause: a caching mechanism using a static pool of DocumentBuilders can cache a malicious thread-context class loader implementation registered by untrusted code, leading to reuse...

Important: pacemaker

Issue Overview: A flaw was found in pacemaker. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS. CVE-2018-16878 A use-after-free flaw was found in pacemaker which could result in certain sensitive information to be leaked via the system logs. CVE-2019-38...

Ghostscript -- Security bypass vulnerabilities

Cedric Buissart Red Hat reports: A flaw was found in, ghostscript versions prior to 9.50, in the .pdfhookDSCCreator procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security protecti...

The vulnerability of the DOSBox emulator, related to access control deficiencies, allows a perpetrator to compromise data integrity, gain access to confidential information, and cause service failures.

The vulnerability of the DOSBox emulator is related to access control deficiencies. Exploiting this vulnerability allows a remote attacker to compromise data integrity, gain access to confidential information, and cause service failures...

The vulnerability of the PlaintextPasswordEncoder class implementation in the Java framework for securing Spring Security industrial applications allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the PlaintextPasswordEncoder class implementation in the Spring Security Java framework, which is designed for securing industrial applications, is related to deficiencies in managing registration data. Exploiting this vulnerability could allow an attacker, operating remotely...

Software Vulnerabilities in the Boeing 787

Boeing left its software unprotected, and researchers have analyzed it for vulnerabilities: At the Black Hat security conference today in Las Vegas, Santamarta, a researcher for security firm IOActive, plans to present his findings, including the details of multiple serious security flaws in the...

Zoho ManageEngine OpManager Permission License and Access Control Issues Vulnerability

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. A vulnerability exists in Zoho ManageEngine OpManager due to privilege permission and access control issues. An attacker could use this vulnerability to execute commands on the server...

icsmaster

This repository, cnforyou/icsmaster, is an ICS/SCADA security resource collection. It contains various tools and scripts for identifying and exploiting vulnerabilities in industrial control systems. The repository includes a list of dorks search terms for identifying vulnerable systems, as well a...