HP SiteScope Monitors Information Disclosure Vulnerability

HP SiteScope Monitors is a platform-level management software. An information disclosure vulnerability exists in HP SiteScope Monitors. The vulnerability can be exploited by an attacker to obtain sensitive information...

Receiver Crashes When Extending Full-Screen Display to Dual Monitors

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Citrix Receiver crashes when extending full-screen display to dual monitors...

[SECURITY] Fedora 26 Update: xorgxrdp-0.2.1-1.fc26

xorgxrdp is a set of X11 modules that make Xorg act as a backend for xrdp. Xorg with xorgxrdp is the most advanced xrdp backend with support for screen resizing and multiple monitors...

Jenkins < 2.44 / 2.32.x < 2.32.2, Jenkins Operations Center < 1.625.22.1 / 2.7.22.0.1 / 2.32.2.1, and Jenkins Enterprise < 1.651.22.1 / 2.7.22.0.1 / 2.32.2.1 Multiple Vulnerabilities

The remote web server hosts a version of Jenkins that is prior to 2.44, or a version of Jenkins LTS prior to 2.32.2, or else a version of Jenkins Operations Center that is 1.625.x.y prior to 1.625.22.1, 2.7.x.0.y prior to 2.7.22.0.1, or 2.x.y.x prior to 2.32.2.1, or else a version of Jenkins...

CVE-2017-2604

In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks SECURITY-371...

New Relic: Restricted User is able to edit Alert Conditions of Synthetics Monitors even if Synthetics Permissions is enabled by an admin

In this vulnerability, a restricted user is able to edit the alert conditions of a synthetics monitor, even if he is unauthorized to do so. Steps to reproduce: - Admin user invites User1 to New Relic account as a restricted user - User1 accepts invitation, joins the account - Admin goes to...

Moderate: Red Hat Security Advisory: Red Hat Storage Console 2 security and bug fix update

An update is now available for Red Hat Storage Console 2 for Red Hat Enteprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

crash: mon_command crashes ceph monitors on receiving empty prefix

A flaw was found in the way handlecommand function would validate prefix value from user. An authenticated attacker could send a specially crafted prefix value resulting in ceph monitor crash...

crash: mon_command crashes ceph monitors on receiving empty prefix

A flaw was found in the way handlecommand function would validate prefix value from user. An authenticated attacker could send a specially crafted prefix value resulting in ceph monitor crash...

New Relic: No CSRF validation on Account Monitors in Synthetics Block

Hello, There is no CSRF token validation on DELETING "monitor" which we create in synthetics section. DELETE /accounts/1338635/monitors/de70ee8d-2fa0-416c-8592-47ebde01aa7e.json HTTP/1.1 Host: synthetics.newrelic.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:45.0 Gecko/20100101 Firefox/45...

Command injection

The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers to send arbitrary CAN commands by leveraging access to a device inside or adjacent to the vehicle, as demonstrated by a CAN command to...

CVE-2016-2354

The CVE-2016-2354 vulnerability affects Lemur Vehicle Monitors BlueDriver (pre-2016-04-07) where Bluetooth pairing requires no PIN. This enables an attacker within Bluetooth range to access the vehicle’s CAN bus and issue arbitrary CAN commands, potentially affecting safety-critical systems such ...

CVE-2016-2354

The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers to send arbitrary CAN commands by leveraging access to a device inside or adjacent to the vehicle, as demonstrated by a CAN command to...

Lemur Vehicle Monitors BlueDriver LSB2 does not authenticate users for Bluetooth access

Overview The Lemur Vehicle Monitors BlueDriver is an aftermarket automotive device that connects to a vehicle's OBD-II port and provides information about the vehicle's performance. The BlueDriver does not require a PIN for Bluetooth access, which allows anyone in range to send arbitrary commands...

New Relic: Server Side Browsing - localhost open port enumeration

Hi again to all, I've found that is possible to scan all the open ports and network information of internal instances of your amazon DC that are related with synthetics monitors. NOTE: I do not have a pro account so I can use the more advanced synthetics functions or the Insights db query to get...

SOL86772626 - OpenSSL vulnerability CVE-2015-3194

Vulnerability Recommended Actions BIG-IP Configuration utility The Configuration utility is not vulnerable by default. To be vulnerable, the system administrator must modify the configuration to perform client-side certification authentication, such as when you perform the procedures in either of...

SUSE SLED12 / SLES12 Security Update : xscreensaver (SUSE-SU-2015:2053-1)

The xscreensaver package was updated to fix the following security issue : - CVE-2015-8025: Fixed a crash when hot-swapping monitors while locked bsc952062. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

The vulnerability of the microprogramming software in Janitza UMG 508, 509, 511, 604, 605 power supply monitoring systems allows a perpetrator to read and write files or execute JASIC code.

The vulnerability of the debugging interface of Microprogramming Software for Control System Chains of Janitza UMG models 508, 509, 511, 604, and 605 is related to the absence of an authentication procedure. Exploiting this vulnerability allows a malicious actor to read and write files, or execut...

The vulnerability of the microprogramming software in Janitza UMG 508, 509, 511, 604, 605 power supply monitoring systems allows a intruder to authenticate as an arbitrary user.

The vulnerability of the Microprogramming Software in Janitza UMG 508, 509, 511, 604, 605 power supply monitoring systems is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to bypass authentication by acting as an arbitrary user...

The vulnerability of the microprogramming software in Janitza UMG 508, 509, 511, 604, 605 power supply monitoring systems allows a intruder to gain access to information about the status of network connections.

The vulnerability of the Microprogramming Software in Janitza UMG 508, 509, 511, 604, 605 power supply monitoring systems is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to information about the...