Siemens Mendix

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Mendix Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a non-administrative user to gain administrative...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2021-9141)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9141 advisory. - bpf, selftests: Fix up some testverifier cases for unprivileged Piotr Krysiuk Orabug: 32656761 CVE-2020-27170 CVE-2020-27171 - bpf: Add sanity...

JTEKT TOYOPUC products

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: JTEKT Corporation Equipment: TOYOPUC products Vulnerability: Improper Resource Shutdown or Release 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthorized user to...

Siemens and Milestone Siveillance Video Open Network Bridge

1. EXECUTIVE SUMMARY CVSS v3 9.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens and Milestone Equipment: Siveillance Video Open Network Bridge ONVIF Vulnerability: Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of this vulnerability could...

Siemens Nucleus DNS (Update A)

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Nucleus Vulnerability: Use of Insufficiently Random Values 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-21-103-14 Siemens Nucleus...

Siemens LOGO! Soft Comfort

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Siemens Nucleus Products IPv6 Stack

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens --------- Begin Update A Part 1 of 3 --------- Equipment: Capital VSTAR, Nucleus NET, Nucleus ReadyStart v3, Nucleus ReadyStart v4, Nucleus Source Code --------- End Update A Part 1 of 3...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2021:0532-1 Rating: important References: 1152472 1152489 1153274 1154353 1155518 1156256 1159280 1160634 1167773 1168777 1169514 1169709 1171295 1173485 1177326 1178163 1178330 1179454 1180197 1180980...

FATEK Automation WinProladder

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: FATEK Automation Equipment: WinProladder Vulnerability: Integer Underflow 2. RISK EVALUATION Successful exploitation of this vulnerability could cause execution of arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS...

Hitachi Energy Relion 670, 650 and SAM600-IO

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Relion 670, 650, and SAM600-IO Vulnerabilities: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...

Security Bulletin: IBM DataQuant is vulnerable to CVE-2020-14803

Summary CVE-2020-14803 is an unspecified vulnerability in Java SE could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. Vulnerability Details CVEID: CVE-2020-14803 DESCRIPTION: An unspecified vulnerability i...

Security Bulletin: IBM DataQuant is vulnerable to CVE-2020-14782

Summary IBM DataQuant is vulnerable to CVE-2020-14782, an unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. Vulnerability Details CVEID: CVE-2020-147...

Vulnerability discovered in Ansible

A vulnerability has been found in Ansible. The vulnerability allows a locally authenticated malicious person to obtain sensitive information. Certain information such as private keys is displayed in log files even when the system is so configured that this should not be possible. Ansible has not...

FBI-CISA Joint Advisory on Exploitation of Fortinet FortiOS Vulnerabilities

The Federal Bureau of Investigation FBI and CISA have released a Joint Cybersecurity Advisory CSA to warn users and administrators of the likelihood that advanced persistent threat APT actors are actively exploiting known Fortinet FortiOS vulnerabilities CVE-2018-13379, CVE-2020-12812, and...

Security Bulletin: Vulnerability in the Fabric OS used by IBM b-type SAN directors and switches.

Summary Brocade Fabric OS versions before v9.0.0 and after version v8.1.0, configured in Virtual Fabric mode contain a weakness in the ldap implementation . Vulnerability Details CVEID: CVE-2020-15376 DESCRIPTION: Broadcom Brocade Fabric OS could allow a remote attacker to bypass security...

Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM Virtualization Engine TS7700 - October 2020 & January 2021

Summary There are multiple vulnerabilities in IBM® SDKs Java™ Technology Edition, Versions 7 and 8, as used by IBM Virtualization Engine TS7700. These issues were disclosed as part of the IBM Java SDK updates in October 2020 and January 2021. IBM Virtualization Engine TS7700 has addressed the...

New Bugs Could Let Hackers Bypass Spectre Attack Mitigations On Linux Systems

Cybersecurity researchers on Monday disclosed two new vulnerabilities in Linux-based operating systems that, if successfully exploited, could let attackers circumvent mitigations for speculative attacks such as Spectre and obtain sensitive information from kernel memory. Discovered by Piotr Krysi...

Zoom Client Screen Sharing Vulnerability (ZSB-21001) - Windows

The Zoom Client is prone to a vulnerability in the Application Window Screen Sharing Functionality. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory aka CID-10d2bb2e6b1d.

...

JVN#37179202: Yomi-Search vulnerable to cross-site scripting

Yomi-Search provided by WonderLink is a directory type search engine program. Yomi-Search contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing a website that uses Yomi-Search. Solution Consider stop using...