KB4598243: Windows 10 Version 1607 and Windows Server 2016 January 2021 Security Update

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Windows AppX Deployment Extensions Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1685. CVE-2021-1642 - Windows DNS Query Information Disclosure Vulnerability...

Multiple NEC Products vulnerable to authentication bypass

Overview In Intelligent Platform Management Interface IPMI v1.5, Remote Management Control Protocol RMCP to access BMC through LAN is prescribed. Multiple NEC products which conduct RMCP access using IPMI over LAN contain an issue in implementations of the BMC firmware and when accessing BMC...

Qualcomm Wlan Hal Input Validation Error Vulnerability

Qualcomm Wlan Hal is a Bluetooth support firmware from Qualcomm Incorporated. APQ8096AU, AQT1000, AR7420, AR8031, AR8035, AR8151, AR9380, CSR6030, CSR8811, CSRA6620, CSRA6640, CSRB31024, IPQ4018, IPQ4019, IPQ4028, IPQ4029. ipq5010, ipq5018, ipq6000, ipq6005, ipq6010, ipq6018, ipq6028, ipq8064,...

JVN#38752718: Multiple NEC Products vulnerable to authentication bypass

In Intelligent Platform Management Interface IPMI v1.5, Remote Management Control Protocol RMCP to access BMC through LAN is prescribed. Multiple NEC products which conduct RMCP access using IPMI over LAN contain an issue in implementations of the BMC firmware and when accessing BMC through RMCP...

Philips Hue Denial Of Service Vulnerability

Credits: Ilia Shnaidman + @0x496c on Twitter + https://www.iliashn.com Vendor: ============= Philips Lighting Holding B.V Product: ============= Philips Hue Hub - all Vulnerability Type: ====================== Denial of Service Security Issue: =============== Philips Hue is vulnerable to Denial...

CVE-2020-12523

On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports g...

Design/Logic Flaw

On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports g...

CVE-2020-12523 Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configuration

On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports g...

CVE-2020-12523

Affected product: Phoenix Contact mGuard Devices (versions before 8.8.3) with LAN ports or an integrated LAN switch. Root cause: On reboot, the device exhibits Missing Initialization of Resource, causing LAN ports that were disabled by configuration to become functional again. In devices with an ...

Directory traversal

In Lan ATMService M3 ATM Monitoring System 6.1.0, due to a directory-listing vulnerability, a remote attacker can view log files, located in /websocket/logs/, that contain a user's cookie values and the predefined developer's cookie value...

CVE-2020-29667

In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system because of Insufficient Session Expiration...

CVE-2020-29667

The CVE-2020-29667 entry affects Lan ATMService M3 ATM Monitoring System 6.1.0. Reported weakness: Insufficient session expiration enabled by using a default cookie value (e.g., PHPSESSID=LANIT-IMANAGER), which an unauthenticated remote attacker can exploit to gain control over the system. Connec...

CVE-2020-29666

The CVE-2020-29666 issue affects Lan ATMService M3 ATM Monitoring System 6.1.0. A directory-listing vulnerability in the web interface allows a remote attacker to read log files under /websocket/logs/ that contain a user cookie and the predefined developer cookie value. The underlying root cause ...

Lan ATMService M3 ATM Code Issue Vulnerability

Lan ATMService M3 ATM Monitoring System is a software that can be used to monitor ATM machines from the Russian company Lan ATMService. A security vulnerability exists in Lan ATMService M3 ATM 6.1.0, which can be exploited by an attacker to gain control over system sessions that do not expire...

Lan ATMService M3 ATM 安全漏洞

Lan ATMService M3 ATM Monitoring System is a software for monitoring ATM machines from the Russian company Lan ATMService. A directory traversal vulnerability exists in Lan ATMService M3 ATM Monitoring System 6.1.0. An attacker can use this vulnerability to view log files in /websocket/logs/ that...

D-Link Routers at Risk for Remote Takeover from Zero-Day Flaw

Buggy firmware opens a number of D-Link VPN router models to zero-day attacks. The flaws, which lack a complete vendor fix, allow adversaries to launch root command injection attacks that can be executed remotely and allow for device takeover. Impacted are D-Link router models DSR-150, DSR-250,...

WARNING — Critical Remote Hacking Flaws Affect D-Link VPN Routers

Some widely sold D-Link VPN router models have been found vulnerable to three new high-risk security vulnerabilities, leaving millions of home and business networks open to cyberattacks—even if they are secured with a strong password. Discovered by researchers at Digital Defense, the three securi...

Schneider Electric Easergy T300

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely Vendor: Schneider Electric Equipment: Easergy T300 Vulnerability : Missing Authentication for Critical Function, Missing Authorization, Missing Encryption of Sensitive Data, Improper Restriction of Rendered UI Layers or Frames 2...

AnyView Denial of Service Vulnerability

AnyView Network Police is a LAN network monitoring software. AnyView 4.6.0.1 is vulnerable to a denial of service. An attacker can exploit this vulnerability via a specially crafted program to cause a computer crash...

Mitsubishi Electric MELSEC iQ-R Series (Update C)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: MELSEC iQ-R series Vulnerability: Uncontrolled Resource Consumption 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled ICSA-20-324-05...