CVE-2018-7522

Schneider Electric Triconex Tricon MP Model 3008 (firmware versions 10.0-10.4) is vulnerable to a memory corruption issue where system calls store registers to a fixed memory location . Attackers who can modify the data in this location may gain supervisor-level access and control system states. ...

PT-2018-18127

Name of the Vulnerable Software and Affected Versions Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0 through 10.4 Description The issue allows attackers to potentially gain supervisor-level access and control system states by modifying data in a fixed memory location wher...

CVE-2018-7522: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, when a system call is made, registers are stored to a fixed memory location. Modifying the data in this location could allow attackers to gain supervisor-level access and control system states...

Buffer overflow

The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access because of a Buffer Overflow...

CVE-2018-5359

The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access because of a Buffer Overflow...

PT-2018-16916

Name of the Vulnerable Software and Affected Versions Flexense SysGauge version 3.6.18 Description The issue allows for remote exploitation of the server, resulting in the attacker gaining system-level access due to a Buffer Overflow. This occurs when the server is operating on port 9221...

CVE-2018-5359: Improper Restriction of Operations within the Bounds of a Memory Buffer

The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access because of a Buffer Overflow...

Lenovo Patches Networking OS Vulnerability Dating Back to 2004

Lenovo patched a flaw in its networking operating system dating back to 2004 that allowed attackers to perform an authentication bypass attack via a mechanism called “HP Backdoor.” If exploited, an attacker could gain admin-level access on affected switches, Lenovo said. The vulnerability is rate...

CVE-2017-3765

In Enterprise Networking Operating System ENOS in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a Lenovo security audit in the serial console, Telnet, SSH, and Web interfaces. This bypass mechanism can be accessed when...

Authentication flaw

In Enterprise Networking Operating System ENOS in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a Lenovo security audit in the serial console, Telnet, SSH, and Web interfaces. This bypass mechanism can be accessed when...

CVE-2017-3765

CVE-2017-3765 affects Lenovo/IBM ENOS on RackSwitch/BladeCenter products, enabling an authentication bypass (the “HP Backdoor”) that, under specific local-authentication conditions, could grant admin-level access to the switch management interfaces (Telnet/Serial Console, SSH, Web). IBM/Lenovo ad...

CVE-2017-3765

In Enterprise Networking Operating System ENOS in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a Lenovo security audit in the serial console, Telnet, SSH, and Web interfaces. This bypass mechanism can be accessed when...

PT-2018-7263

Name of the Vulnerable Software and Affected Versions: Enterprise Networking Operating System ENOS affected versions not specified Description: A security issue was found in the Enterprise Networking Operating System ENOS used in Lenovo and IBM RackSwitch and BladeCenter products. This issue is...

CVE-2017-3765: Improper Authentication

In Enterprise Networking Operating System ENOS in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a Lenovo security audit in the serial console, Telnet, SSH, and Web interfaces. This bypass mechanism can be accessed when...

D-Link DNS-320 Backdoor Unauthorized Access

An unauthorized access vulnerability exists in D-Link DNS-320 ShareCenter. Successful exploitation of this vulnerability could allow a remote attacker to gain administrator level access on the affected device...

CVE-2017-17410

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

Cross site scripting

Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can...

Google Patches KRACK Vulnerability in Android

Google this week finally addressed the KRACK vulnerability in Android, three weeks after the WPA2 protocol flaw was publicly disclosed. The KRACK patches are the most high-profile fixes in the November Android Security Bulletin, which includes three patches levels; the KRACK patches are in the No...

Vulnerability Spotlight: Arbitrary Code Execution Bugs in Simple DirectMedia Layer Fixed

Today, Talos is disclosing two vulnerabilities that have been identified in the Simple DirectMedia Layer library. Simple DirectMedia Layer SDL is a cross-platform development library designed for use in video playback software, emulators, and games by providing low level access to audio, keyboard...

PT-2017-19433

Name of the Vulnerable Software and Affected Versions Nullsoft Scriptable Install System versions prior to 2.50 Description The issue allows for a DLL hijacking attack, which can provide administrative level access on the target Windows system. Recommendations For versions prior to 2.50, update t...