CVE-2019-1649

CVE-2019-1649 concerns Cisco’s Secure Boot Trust Anchor module (TAm). The flaw stems from an improper check in the FPGA/ Trust Anchor bitstream handling, enabling an authenticated, local attacker with OS access to write a modified firmware image to the FPGA. Consequences include potential device ...

Cisco Secure Boot Hardware Tampering Vulnerability

A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an authenticated, local attacker to write a modified firmware image to the component. This vulnerability affects multiple Cisco products that...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in multiple Cisco products. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review th...

Mitsubishi R16MTCPU PLC Detection

Binary data 751833.prm...

Siemens SIPLUS CPU317-2 PN/DP PLC Detection

Binary data 750250.prm...

D-Link DWL-2600AP Upgrade Firmware Command Injection

Document Title: =============== D-Link DWL-2600AP - Authenticated OS Command Injection Upgrade Firmware Product & Service Introduction: =============================== The D-Link DWL-2600AP has a web interface for configuration. You can use any web browser you like to login to the D-Link...

GE STXPBS824 RSTi Slice PROFIBUS V1 Slave Network Interface Detection

Binary data 755566.prm...

D-Link DWL-2600AP Save Configuration Command Injection Vulnerability

D-Link DWL-2600AP suffers from an authentication OS command injection vulnerability via the save configuration functionality. Document Title: =============== D-Link DWL-2600AP - Authenticated OS Command Injection Save Configuration Product & Service Introduction: =============================== T...

Fedora Update for openocd FEDORA-2019-0a5e82cea8

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

D-Link DWL-2600AP Authenticated OS Command Injection Vulnerability

D-Link DWL-2600AP suffers from an authentication OS command injection vulnerability via the tftp restore functionality. Document Title: =============== D-Link DWL-2600AP - Authenticated OS Command Injection Restore Configuration Product & Service Introduction: =============================== The...

Fedora Update for ceph FEDORA-2019-6a2e72916a

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora Update for adplug FEDORA-2018-de3a0ba76e

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora Update for cairo FEDORA-2018-3a195026f5

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

D-Link DWL-2600AP Authenticated OS Command Injection

Document Title: =============== D-Link DWL-2600AP - Authenticated OS Command Injection Restore Configuration Product & Service Introduction: =============================== The D-Link DWL-2600AP has a web interface for configuration. You can use any web browser you like to login to the D-Link...

Researchers Compromise Netflix Content in Widevine DRM Hack

Researchers have used a proof-of-concept PoC side-channel attack to download an unencrypted raw file for Netflix’ Stranger Things, in a format that’s ready to distribute out to any buyer on the internet. This pirate’s booty is the result of breaking open the widely deployed digital rights...

[SECURITY] Fedora 29 Update: wpewebkit-2.24.1-1.fc29

WPE allows embedders to create simple and performant systems based on Web platform technologies. It is designed with hardware acceleration in mind, leveraging common 3D graphics APIs for best performance...

Sierra #Wireless #AirLink ES450 #ACEManager upload.cgi Unverified Password Change Exploit

Exploit for hardware platform in category web applications...

[SECURITY] Fedora 30 Update: wpewebkit-2.24.1-1.fc30

WPE allows embedders to create simple and performant systems based on Web platform technologies. It is designed with hardware acceleration in mind, leveraging common 3D graphics APIs for best performance...

JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scripting

Exploit Title: cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter. Exploit Author: Vikas Chaudhary Date: 21-01-2019 Vendor Homepage: https://www.jio.com/ Hardware Link:...

Memory corruption

It was found that the netdma code in tcprecvmsg in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg for the same network socket in parallel executed on ioatdma-enabled hardware with netdma enabled can leak the memory,...