787 matches found
Siemens SINEC NMS 命令注入漏洞
SINEC INS Infrastructure Network Services is a web-based application that combines various network services in a single tool. This simplifies the installation and management of all network services related to industrial networks.A command injection vulnerability exists in Siemens SINEC INS, which...
PT-2023-14602 · Siemens · Sinec Ins
Name of the Vulnerable Software and Affected Versions: SINEC INS versions prior to V1.0 SP2 Update 1 Description: A vulnerability has been identified that allows an authenticated remote attacker with access to the Web Based Management 443/tcp to potentially inject commands into the dhcpd...
Siemens SINEC INS
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...
APT Hackers Turn to Malicious Excel Add-ins as Initial Intrusion Vector
Microsoft's decision to block Visual Basic for Applications VBA macros by default for Office files downloaded from the internet has led many threat actors to improvise their attack chains in recent months. Now according to Cisco Talos, advanced persistent threat APT actors and commodity malware...
Threat Spotlight: XLLing in Excel - threat actors using malicious add-ins
Microsoft is phasing out support for executing VBA macros in downloaded Office documents. Cisco Talos investigates another vector for introduction of malicious code to Microsoft Excel--malicious add-ins, specifically XLL files. Although XLL files were supported since early versions of Excel,...
RLSA-2022:8208 Moderate: dovecot security and enhancement update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...
Moderate: Red Hat Security Advisory: dovecot security update
An update for dovecot is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
Malicious Package
Overview @moonactive-innersource/ins-profiles-service-sdk-nodejs is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore,...
PT-2022-6180 · Node.Js +8 · Node +8
Name of the Vulnerable Software and Affected Versions: Node versions 18.7.0 Description: The issue is related to the llhttp parser in the http module, which does not correctly handle header fields that are not terminated with CLRF, potentially resulting in HTTP Request Smuggling. There is also a...
Siemens SINEC INS
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Siemens Equipment: SINEC INS Vulnerabilities: Improper Input Validation, Integer Overflow or Wraparound, Uncontrolled Resource Consumption, Command Injection, Inadequate Encryption Strength, Missing...
The vulnerability of the ins-compl_infercase_gettext() function in the Vim text editor allows a hacker to execute arbitrary code or cause a service failure.
The vulnerability of the inscomplinfercasegettext function in the Vim text editor is related to the execution of operations outside the buffer’s boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service interruptions...
CLSA-2022-1657813374 Fix CVE(s): CVE-2022-2182, CVE-2022-2183, CVE-2022-2210, CVE-2022-2207
SECURITY UPDATE: Heap-based buffer overflow in function utfptr2char - debian/patches/CVE-2022-2182.patch: When on line zero check the column is valid for line one in doonecmd function - CVE-2022-2182 SECURITY UPDATE: Out-of-bounds read in function getlispindent - debian/patches/CVE-2022-2183.patc...
Moderate: Red Hat Security Advisory: dovecot security update
An update for dovecot is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
RLSA-2022:1950 Moderate: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. The following packages...
Ukraine government and pro-Ukrainian sites hit by DDoS attacks
The Computer Emergency Response Team in Ukraine CERT-UA has announced that Ukraine government web portals and pro-Ukraine sites are subjected to ongoing DDoS distributed denial of service attacks. They dont currently know who is behind these attacks. The attack involves injecting a malicious...
WordPress Wbcom BuddyPress Check-ins Pro premium plugin <= 1.3.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability
Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom BuddyPress Check-ins Pro premium plugin versions = 1.3.0. Solution Update the WordPress Wbcom BuddyPress Check-ins Pro premium plugin to the latest available version at least 1.4....
CLSA-2022-1649171018 Fix of CVE: CVE-2022-0547
CVE-2022-0547: Fix authentication bypass via multiple deferred authentication plug-ins...
CLSA-2022-1649170882 Fixed CVE-2022-0547 in openvpn
CVE-2022-0547: Fix authentication bypass via multiple deferred authentication plug-ins...
CLSA-2022-1649170601 Fix CVE(s): CVE-2022-0547
SECURITY UPDATE: authentication bypass via multiple deferred authentication plug-ins - debian/patches/CVE-2022-0547.patch: disallow multiple deferred authentication plug-ins in doc/openvpn.8, src/openvpn/plugin.c. - CVE-2022-0547...
