VMware vSphere, Workstation and Fusion updates enable Hypervisor-Assisted Guest Mitigations for Speculative Store Bypass issue.

vCenter Server, ESXi, Workstation, and Fusion update speculative execution control mechanism for Virtual Machines VMs. As a result, a patched Guest Operating System GOS can remediate the Speculative Store bypass issue CVE-2018-3639 using the Speculative-Store-Bypass-Disable SSBD control bit. This...

VMSA-2018-0012:VMware vSphere, Workstation and Fusion updates enable Hypervisor-Assisted Guest Mitigations for Speculative Store Bypass issue.

VMSA-2018-0012.1 VMware vSphere, Workstation and Fusion updates enable Hypervisor-Assisted Guest Mitigations for Speculative Store Bypass issue. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0012.1 VMware Security Advisory Severity: Moderate VMware Security Advisory...

CVE-2018-10729

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated user...

Hardcoded credentials

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed...

CVE-2016-9335

CVE-2016-9335 affects Red Lion Controls Sixnet-Managed Industrial Switches (firmware 5.0.196) and AutomationDirect/Stride-Managed Ethernet Switches (firmware 5.0.190). The root cause is hard-coded HTTP SSL/SSH keys that cannot be regenerated, causing all devices to share the same key. Consequence...

CVE-2016-9335

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed...

CVE-2016-9335: Use of Hard-coded Cryptographic Key

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed...

Don’t just add the Security “S” to your Managed Services

Expanding and putting more focus on your current security offerings is a great way to find new business opportunities. Adding the “S” is the easy part; just ask any managed service provider that views security as just a “checkbox” and offers one of the cheaper or RMM-integrated security offerings...

Microsoft Office: Protect document metadata for rights managed Office Open XML Files

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013protectrightsmanagedfilesmetadata.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Protect document metadata for rights managed Office Open XML Files Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbon...

ICSA-18-107-05_Rockwell Automation Stratix Industrial Managed Ethernet Switch

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit. Vendor : Rockwell Automation Equipment : Allen-Bradley Stratix Industrial Managed Ethernet Switch Vulnerabilities : Improper Input Validation, Resource Management Errors, 7PK – Errors, Improper...

Microsoft Office: Prevent users from changing permissions on rights managed content

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013preventuserchangepermissions.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Prevent users from changing permissions on rights managed content Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone...

Authentication flaw

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

PT-2018-8671

Name of the Vulnerable Software and Affected Versions: Cisco 550X Series Stackable Managed Switches affected versions not specified Description: A vulnerability in the Simple Network Management Protocol SNMP subsystem communication channel could allow an authenticated, remote attacker to cause th...

CVE-2018-0209: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability in the Simple Network Management Protocol SNMP subsystem communication channel through the Cisco 550X Series Stackable Managed Switches could allow an authenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service DoS condition. The device n...

NEW: Vulnerability and Assessment Scanning for Your AWS Cloud Databases

Scuba is a free and easy-to-use tool that uncovers hidden security risks. Scuba is frequently updated with content from Imperva’s Defense Center researchers. With Scuba you can: Scan enterprise databases for vulnerabilities and misconfigurations Identify risks to your databases Get recommendation...

PT-2018-1517

Name of the Vulnerable Software and Affected Versions Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products versions 1.0 through 1.33 Description The issue is related to OS command injection due to the lack of neutralization of special elements in OS command inputs. This can allow a remote...

CVE-2017-6230

The CVE-2017-6230 entry concerns Ruckus Networks Solo APs (firmware R110.x or earlier) and SZ managed APs (firmware R5.x or earlier). It describes an authenticated Root Command Injection vulnerability in the web-GUI, enabling an authenticated user to execute privileged commands on affected system...

CVE-2017-6230: Improper Neutralization of Special Elements used in an OS Command

Ruckus Networks Solo APs firmware releases R110.x or before and Ruckus Networks SZ managed APs firmware releases R5.x or before contain authenticated Root Command Injection in the web-GUI that could allow authenticated valid users to execute privileged commands on the respective systems...

PT-2018-8325

Name of the Vulnerable Software and Affected Versions Ruckus Networks Solo APs versions R110.x or before Ruckus Networks SZ managed APs versions R5.x or before Description The issue concerns an authenticated Root Command Injection in the web-GUI. This could allow authenticated valid users to...

Default configuration

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this...