CVE-2019-3765: Incorrect Permission Assignment for Critical Resource

Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance IDPA versions 2.0, 2.1, 2.2, 2.3 and 2.4 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A remote authenticated malicious user potentially could...

The story of Adobe Reader symbols

Posted by Mateusz Jurczyk, Project Zero Modern day security analysis of client applications is often hindered by the inaccessibility of their source code and other aids such as debug symbols. As a result, it is necessary to perform completely black-box reverse engineering of the software, in orde...

Multiple Dell EMC Products CVE-2019-3765 Remote Security Bypass Vulnerability

Description Multiple Dell EMC products are prone to a remote security-bypass vulnerability. An attacker can exploit this issue to obtain sensitive information, bypass security restrictions and perform unauthorized actions. This may aid in further attacks. The following products are vulnerable: De...

The vulnerability in the implementation of ISDN functions in the Cisco IOS XE operating system for Cisco 4000 Series Integrated Services Routers allows a attacker to transmit IPv4 traffic through an unauthenticated ISDN connection for several seconds, from the initial setup of the ISDN connection until a failure in authentication of the PPP connection occurs.

The vulnerability of the Cisco IOS XE operating system’s ISDN function implementation for Cisco 4000 Series Integrated Services Routers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to transmit IPv4 traffic through an unauthenticated...

Dell EMC Integrated Data Protection Appliance ACM Password Storage Vulnerability

Dell EMC Integrated Data Protection Appliance is a disk-based backup and recovery solution from Dell, Inc.ACM is one of the application configuration management components. A password storage vulnerability exists in the Dell EMC Integrated Data Protection Appliance ACM. An attacker could exploit...

CVE-2019-3747

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users...

Authentication flaw

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system...

CVE-2019-3747

Dell EMC Integrated Data Protection Appliance (IDPA) versions prior to 2.3 are affected by a stored cross-site scripting vulnerability in the Cloud DR add-on field. A remote attacker with ACM admin privileges can store malicious HTML/JavaScript, which is then executed by victim users’ browsers in...

PT-2019-16688

Name of the Vulnerable Software and Affected Versions Dell EMC Integrated Data Protection Appliance versions prior to 2.3 Description The issue allows an authenticated remote user to launch a brute-force authentication attack against the ACM API, potentially gaining access to the system, due to t...

PT-2019-16680

Name of the Vulnerable Software and Affected Versions Dell EMC Integrated Data Protection Appliance versions prior to 2.3 Description The issue concerns a password storage vulnerability in the ACM component. A remote authenticated malicious user with root privileges may potentially use a support...

PT-2019-16689

Name of the Vulnerable Software and Affected Versions Dell EMC Integrated Data Protection Appliance versions prior to 2.3 Description The issue allows a remote malicious admin user to store malicious HTML or JavaScript code in a specific field. When victim users access the page, the malicious cod...

CVE-2019-3746: Improper Restriction of Excessive Authentication Attempts

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system...

CVE-2019-3736: Storing Passwords in a Recoverable Format

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malicious user with root privileges may potentially use a support tool to decrypt encrypted passwords stored locally on the system to use it to...

CVE-2019-3747: Improper Neutralization of Input During Web Page Generation

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users...

Hardcoded credentials

In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs Network Video Recorders, which can be accessed without authentication over the network...

CVE-2019-13523

In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs Network Video Recorders, which can be accessed without authentication over the network...

CVE-2019-12664 Cisco IOS XE Software ISDN Data Leak Vulnerability

A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers ISRs could allow an unauthenticated, adjacent attacker to pass IPv4 traffic through an ISDN channel prior to successful PPP authentication. The...

Cisco IOS XE Software ISDN Data Leak Vulnerability

A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers ISRs could allow an unauthenticated, adjacent attacker to pass IPv4 traffic through an ISDN channel prior to successful PPP authentication. The...

The vulnerability affects the Cisco Integrated Management Controller (IMC) Supervisor web interface, as well as tools for managing physical infrastructure and virtual environments from Cisco UCS Director and Cisco UCS Director Express for Big Data. This allows attackers to execute arbitrary commands.

The vulnerability of the Cisco Integrated Management Controller IMC Supervisor web interface, as well as the tools for managing physical infrastructure and virtual environments such as Cisco UCS Director and Cisco UCS Director Express for Big Data, is related to insufficient validation of input...

Integer Overflow Vulnerability in S7hcom_x.dll Control for Siemens SIMATIC STEP 7

Siemens SIMATIC STEP 7 TIA Portal is a suite of programming software for SIMATIC controllers from Siemens, Germany. The software provides PLC programming, design option packages and advanced drive technology. An integer overflow vulnerability exists in the S7hcomx.dll control for Siemens SIMATIC...