Year-Old Critical Vulnerabilities Patched in ISP Broadband Gear

Patches for three critical vulnerabilities impacting broadband gateways made by Advanced Digital Broadcast ADB have been released to the public, nearly two years after the bugs were first found. Issues range from a privilege escalation flaw, an authorization bypass vulnerability and a local...

CVE-2017-17317

Common Open Policy Service Protocol COPS module in Huawei USG6300 V100R001C10; V100R001C20; V100R001C30; V500R001C00; V500R001C20; V500R001C30; V500R001C50; Secospace USG6500 V100R001C10; V100R001C20; V100R001C30; V500R001C00; V500R001C20; V500R001C30; V500R001C50; Secospace USG6600 V100R001C00;...

CVE-2018-10662

An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface...

CVE-2018-10663

An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation...

CVE-2018-10664

An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption...

CVE-2018-10661

An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control...

The need and opportunity for adaptive prevention in the cloud

This post is authored by Michael Bargury, Data Scientist, C+E Security. The need The cloud introduces new security challenges, which differ from classic ones by diversity and scale. Once a Virtual Machine VM is up and running with an open internet port, it is almost instantaneously subject to...

Security Bulletin: A vulnerability affects the IBM FlashSystem model V840

Summary There is a vulnerability which the IBM FlashSystem™ V840 is susceptible. An exploit of this vulnerability CVE-2018-1495 could make the system susceptible to attacks which could allow an attacker to overwrite arbitrary files. Vulnerability Details CVEID: CVE-2018-1495 DESCRIPTION: IBM...

Security Bulletin: IBM Security Network Protection is vulnerable to Cross-Site Scripting. (CVE-2014-6189)

Summary IBM Security Network Protection contains a Cross-Site Scripting vulnerability. Vulnerability Details CVEID:CVE-2014-6189 DESCRIPTION: IBM Security Network Protection is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploi...

Security Bulletin: TLS padding vulnerability affects IBM Security Network Protection (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Security Network Protection. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive informatio...

Security Bulletin: IBM Security Network Protection is affected by ClickJacking vulnerability CVE-2014-6197

Summary A ClickJacking also known as a "UI redress attack" vulnerability has been discovered in IBM Security Network Protection. Vulnerability Details CVE-ID: CVE-2014-6197 Description: A clickjacking vulnerability in IBM Security Network Protection could allow a remote attacker to hijack the...

Security Bulletin: IBM Security Network Protection is affected by Shell Command Injection vulnerability (CVE-2014-6183)

Summary A Shell Command Injection vulnerability has been discovered in IBM Security Network Protection. Vulnerability Details CVE-ID: CVE-2014-6183 Description: IBM Security Network Protection could allow a remote attacker to execute arbitrary commands on the system. An authenticated attacker cou...

Security Bulletin: Vulnerability in SSLv3 affects Network Protection (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in the IBM Security Network Protection Local Management Interface LMI. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allo...

Security Bulletin: IBM Security Network Protection System CPU Utilization (CVE-2014-0963)

Summary IBM Security Network Protection System is affected by a problem related to the SSL implementation which, under very specific conditions, can cause CPU utilization to rapidly increase. Vulnerability Details CVE ID: CVE-2014-0963 DESCRIPTION: IBM Security Network Protection System is affect...

Airba.sh - A POSIX-compliant, Fully Automated WPA PSK Handshake Capture Script Aimed At Penetration Testing

Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing. It is compatible with Bash and Android Shell tested on Kali Linux and Cyanogenmod 10.2 and uses aircrack-ng to scan for clients that are currently connected to access points AP. Those...

BMW Automotive Telematics Control Unit Design Vulnerability

BMW vehicles etc. are automotive products of the German company BMW Bayerische Motoren Werke AG.Telematics Control Unit Telematic Communication Box or TCB is one of the automatic transmission control units used. A security vulnerability exists in the Telematics Control Unit on BMW vehicles models...

Multiple BMW Vehicle Head Unit HU_NBT Component Design Vulnerabilities (CNVD-2018-11310)

BMW i Series, etc. are different series of automobile products of BMW Bayerische Motoren Werke AG, Germany.Head Unit HUNBT Infotainment component is a set of infotainment system of the system. A security vulnerability exists in the Head Unit HUNBT component on several BMW vehicles vehicles...

CVE-2016-10533

express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for GET /User?distinct=password and get all the passwords for all the users in the...

CVE-2016-10533

express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for GET /User?distinct=password and get all the passwords for all the users in the...

Intelligent Baseboard Management authentication bypass vulnerability in multiple Huawei products

Huawei 1288H V5 and others are different models of server equipment from Huawei, China.Intelligent Baseboard Management Controller iBMC is one of the embedded server intelligent management system. An authentication bypass vulnerability exists in the iBMC module in multiple Huawei products, which...