Updating Airplanes

If you think updating Windows etc is painful, spare a thought for avionics maintenance engineers. Flight Management System FMS and related navigation databases navaids, airspace etc have to be updated monthly, locally. On older planes, it’s sometimes still done on 3.5” floppy. It’s more common to...

CVE-2010-2473

Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked could maintain their session on the Drupal site despite being blocked...

Insurance Pays Out a Sliver of Norsk Hydro's Cyberattack Damages

On the heels of a severe cyberattack, aluminum giant Norsk Hydro has received only $3.6 million in cyber-insurance – just a fraction of the total costs in damage. Overall, the Oslo, Norway-based company incurred between $60 million to $71 million in damages from the incident, which forced it to...

Notice of Status Change Announcement for Version 12.1 of the Citrix ADM

Citrix Systems, Inc. announces an update to End of Maintenance and End of Life dates for version 12.1 of the Citrix Application Delivery Management formerly referred to as NetScaler Management & Analytics System Citrix Application Delivery Management ADM product lifecycle model will change from 3...

Notice of Change Announcement for Version 11.1 of the Citrix Application Delivery Management (ADM)

Citrix Systems, Inc. announces End of Maintenance for version 11.1 of the Citrix Application Delivery Management formerly referred to as NetScaler Management & Analytics System Citrix Application Delivery Management ADM follows a 3-year product lifecycle model. Table 1. Release Milestones and Dat...

Softing uaGate SI Elevation of Privilege Vulnerability

Softing uaGate SI is a compact industrial gateway product from Softing Germany. An elevation of privilege vulnerability exists in the maintenance script in Softing uaGate SI version 1.60.01, which can be exploited by an attacker to write to a file with superuser privileges...

CVE-2019-11526

An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injection. This enables the Attacker to write files with superuser privileges in specific locations...

CVE-2019-11526

An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injection. This enables the Attacker to write files with superuser privileges in specific locations...

Path traversal

An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injection. This enables the Attacker to write files with superuser privileges in specific locations...

CVE-2019-17050

CVE-2019-17050 affects the Voyager package for Laravel up to version 1.2.7. An attacker with admin privileges and Compass access can read or delete arbitrary files, including the .env file. The public references cite this issue and note a suggested mitigation: disable Compass in production. The c...

CVE-2019-11753

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the...

CVE-2019-11736

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during...

CVE-2019-11736

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during...

Race condition

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during...

CVE-2019-11753

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the...

Privilege escalation

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the...

CVE-2019-11736

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during...

UBUNTU-CVE-2019-11753

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the...

CVE-2019-11736

CVE-2019-11736 describes a local-privilege-escalation vulnerability in the Mozilla Maintenance Service on Windows. The issue arises because the service does not guard against hardlinks in the updates directory, enabling replacement of local files (including the Maintenance Service executable) and...

CVE-2019-11736

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during...