SRC-2019-0083 : Cisco Prime Infrastructure Health Monitor HA TarArchive Command Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco Prime Infrastructure. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TarArchive class. The issue results from the lac...

SRC-2019-0036 : Cisco Prime Infrastructure XmpLogFilesDownloadServlet Directory Traversal Information Disclosure Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Cisco Prime Infrastructure. Authentication is required to exploit this vulnerability. The specific flaw exists within the XmpLogFilesDownloadServlet servlet. The issu...

SRC-2019-0035 : Cisco Prime Infrastructure XmpLogFilesDownloadServlet Directory Traversal Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco Prime Infrastructure. Authentication is required to exploit this vulnerability. The specific flaw exists within the XmpLogFilesDownloadServlet servlet. The issue result...

NSA Releases Updated Guidance on Side-Channel Vulnerabilities

The National Security Agency NSA has released updated information on a set of side-channel vulnerabilities affecting modern computer processors. An attacker can exploit these vulnerabilities to obtain sensitive information. The National Cybersecurity and Communications Integration Center NCCIC,...

CVE-2018-11938

Improper input validation for argument received from HLOS can lead to buffer overflows and unexpected behavior in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT,...

SRC-2019-0040 : Cisco Prime Infrastructure DbTableListAction orderByColumn SQL Injection Information Disclosure Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Cisco Prime Infrastructure. Authentication is required to exploit this vulnerability. The specific flaw exists within the DbTableListAction struts class. The issue...

SRC-2019-0039 : Cisco Prime Infrastructure SampleFileDownloadServlet Directory Traversal Information Disclosure Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Cisco Prime Infrastructure. Authentication is required to exploit this vulnerability. The specific flaw exists within the SampleFileDownloadServlet servlet. The issue...

SRC-2019-0038 : Cisco Prime Infrastructure XmpFileUploadServlet Directory Traversal Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco Prime Infrastructure. Authentication is required to exploit this vulnerability. The specific flaw exists within the XmpFileUploadServlet servlet. The issue results from...

Schneider Electric EVLink Parking

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: EVLink Parking Vulnerabilities: Use of Hard-coded Credentials, Code Injection, SQL Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could...

MGASA-2019-0055 Updated virtualbox packages fix security vulnerabilities

Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM...

Product update: Virtuozzo Infrastructure Platform 2.5 Update 1 (2.5.0-1599)

This update provides stability and usability fixes. Vulnerability id: VSTOR-19695, VSTOR-19857 Improved automatic firewall rules configuration. Vulnerability id: VSTOR-19909 Unable to register Backup Gateway in Acronis Backup Advanced with an IP address...

Japan to Hunt Down Citizens' Insecure IoT Devices

The Japanese government is taking the problem of insecure IoT devices into its own hands, with what some say is an audacious plan to carry out wide-scale penetration testing on its citizens’ gadgets. The country’s National Institute of Information and Communications Technology NICT has been taske...

Police Shut Down xDedic – An Online Market for Cyber Criminals

In an international operation involving law enforcement authorities from the U.S. and several European countries, feds have shut down an online underground marketplace and arrested three suspects in Ukraine. Dubbed xDedic, the illegal online marketplace let cybercriminals buy, sell or rent out...

Yokogawa License Manager Service

1. EXECUTIVE SUMMARY CVSS v8.1 ATTENTION : Exploitable remotely Vendor : Yokogawa Equipment : License Manager Service Vulnerability : Unrestricted Upload of Files with Dangerous Type 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to remotely upload files,...

This Week in Security News: Ransomware and Cyber Threats

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about new routines for encryption of JobCrypter ransomware. Also, understand how Emotet has managed to evolve into one of the most...

Cisco Enterprise NFV Infrastructure Software Input Validation Vulnerability (CNVD-2019-02750)

Cisco Enterprise NFV Infrastructure Software NFVIS is a suite of NVF infrastructure software platforms from Cisco. The platform can be achieved through the central coordinator and controller of the virtualization services of the full lifecycle management. An input validation vulnerability exists ...

Input validation

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation in the affected software. An...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (CNVD-2019-02814)

Cisco Prime Infrastructure PI is a set of Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS technologies for wireless management. solution. A cross-site scripting vulnerability exists in the web-based management interface of Cisco PI, which stems from a failure of...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient...

CVE-2019-1643

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient...