CVE-2017-6040

CVE-2017-6040 concerns an Information Exposure in Belden Hirschmann GECKO Lite Managed switch (Version 2.0.00 and earlier). The vulnerability arises from saving a copy of the downloaded configuration file (which includes password hashes) in a location accessible without authentication, enabling a...

PT-2017-16852

Name of the Vulnerable Software and Affected Versions Belden Hirschmann GECKO Lite Managed switch versions 2.0.00 and prior Description A Cross-Site Request Forgery issue was found in the web application, where it does not sufficiently verify that requests were provided by the user who submitted...

CVE-2017-6038: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request...

CVE-2017-6036: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web server receives a request, but does not sufficiently verify that the request is being sent to the expected destination...

PT-2017-16854

Name of the Vulnerable Software and Affected Versions Belden Hirschmann GECKO Lite Managed switch versions 2.0.00 and prior Description An Information Exposure issue allows non-sensitive information to be obtained anonymously. Recommendations For versions 2.0.00 and prior, at the moment, there is...

CVE-2017-6040: Exposure of Sensitive Information to an Unauthorized Actor

An Information Exposure issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. Non-sensitive information can be obtained anonymously...

PT-2017-16850

Name of the Vulnerable Software and Affected Versions Belden Hirschmann GECKO Lite Managed switch versions prior to 2.0.00 Description A Server-Side Request Forgery issue was discovered. The web server receives a request but does not sufficiently verify that the request is being sent to the...

4 Cybersecurity Principles That Withstand the Test of Time

Information security can be a noisy place. I’ve been a “security guy” my entire career and have been lucky enough to have a wide range of experiences: software development, IT security in a very large enterprise, vulnerability research and exploitation, and now as an enterprise software vendor...

[SECURITY] Fedora 26 Update: ansible-2.3.1.0-1.fc26

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

VPP Required Apps Might Fail to Install on XenMobile Managed Devices

When too many VPP apps are pushed as required apps, installation may fail. The logs will show the following error. ErrorCode returned by Apple: code=9632, reason='Too many recent calls to manage licenses with identical requests'...

Protecting Your Small Business From WannaCry

May 12, 2017 saw the world’s first ever worm-based ransomware attack, WannaCry. Typically ransomware spreads via email as spam and phishing attacks, and relies on human intervention to initiate the infection. However, WannaCry is different in that it combines ransomware with a recently published...

ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587)

An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server...

[SECURITY] Fedora 25 Update: ansible-2.3.0.0-3.fc25

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

CVE-2017-2320

A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various denials of services leading to targeted information disclosure, modification of any component of the...

CVE-2017-2319

A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker to compromise the systems confidentiality or integrity without authentication, leading to managed systems being compromised or services being denied to authent...

CVE-2017-2319

A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker to compromise the systems confidentiality or integrity without authentication, leading to managed systems being compromised or services being denied to authent...

Tenable Appliance Unauthorized Administrator Password Manipulation Vulnerability

The Tenable Appliance is a browser-managed application that hosts a variety of Tenable enterprise applications, including Nessus, SecurityCenter SC and Passive Vulnerability Scanner PVS. An unauthorized administrator password manipulation vulnerability exists in Tenable Appliance, which can be...

April 18, 2017—KB4015553 (Preview of Monthly Rollup)

None None...

CVE-2017-7590

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting XSS attacks within the Admin UI, as demonstrated by a crafted Managed Object Name...

CVE-2017-7591: Improper Neutralization of Input During Web Page Generation

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting XSS attacks within the Admin UI, as demonstrated by the sortKeys parameter to the authzRoles script under managed/user/...