EulerOS 2.0 SP3 : openssl110f (EulerOS-SA-2018-1434)

According to the version of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A microprocessor side-channel vulnerability was found on SMT e.g, Hyper-Threading architectures. An attacker running a malicious process on th...

The RPC vulnerability mining case studies, on-vulnerability and early warning-the black bar safety net

2018 8 the end of the month, a self-proclaimed“sandbox escape”SandboxEscaperof female researchers released a Windows local privilege escalation 0 day vulnerability. In addition, also attach a proof of concept attack that allows hackers to read the system in unauthorized areas, but at the moment...

Debian DLA-1617-1 : libvncserver security update

Kaspersky Lab discovered several vulnerabilities in libvncserver, a C library to implement VNC server/client functionalities. CVE-2018-6307 a heap use-after-free vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be...

Debian DLA-1612-1 : libarchive security update

Daniel Axtens discovered a double-free and use-after-free vulnerability in libarchive's RAR decoder that can result in a denial of service application crash or may have other unspecified impact when a malformed RAR archive is processed. For Debian 8 'Jessie', these problems have been fixed in...

Foxit PhantomPDF < 9.1 Multiple Vulnerabilities

According to its version, the Foxit PhantomPDF application formally known as Phantom installed on the remote Windows host is prior to 9.1. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid119838; scriptversion"1.6...

CVE-2018-19240

The CVE-2018-19240 entry concerns TRENDnet devices: the TV-IP110WN (V1.2.2 build 68, V1.2.2.65, V1.2.2 build 64) and the TV-IP121WN (V1.2.2 build 28). A buffer overflow in network.cgi allows an attacker to hijack the control flow to an attacker-specified location by crafting a POST request payloa...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2018:4185-1)

This update for qemu fixes the following issues : Security issues fixed : CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use...

The AI cybersecurity impact for IoT

I meet with customers around the globe in all sectorsbanks with ATM networks, energy companies with critical infrastructure, natural resource companies with remote automated operations, healthcare organizations with medical devices, manufacturing companies with production environmentsand they all...

Advantech WebAccess/SCADA

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WebAccess/SCADA Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a stack buffer overflow condition. 3...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:4154-1)

This update for the Linux Kernel 3.12.74-6064104 fixes one issue. The following security issue was fixed : CVE-2018-9568: Prevent possible memory corruption due to type confusion in skclonelock. This could lead to local privilege escalation bsc1118319. Note that Tenable Network Security has...

Zero Trust part 1: Identity and access management

Once in a while, a simple phrase captures our imagination, expressing a great way to think about a problem. Zero Trust is such a phrase. Today, Ill define Zero Trust and then discuss the first step to enabling a Zero Trust modelstrong identity and access management. In subsequent blogs, well cove...

Security Bulletin: A vulnerability in NSS affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Mozilla Network Security Services NSS. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2018-12384 DESCRIPTION: Mozilla Network Security Services NSS, as used in Mozilla Firefox, could allow a remote attacker to obtain...

Debian DLA-1605-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or bypass of the same-origin policy. For Debian 8 'Jessie', these problems have been fixed in version 60.4.0esr-1deb8u1. We recommend that you upgrade you...

AIX 7.1 TL 4 : solaris (IJ10275)

https://vulners.com/cve/CVE-2017-3623 https://vulners.com/cve/CVE-2017-3623 An unspecified vulnerability in Oracle Sun Systems related to the Solaris Kernel RPC component could allow an unauthenticated attacker to take control of the system. C Tenable Network Security, Inc. The text in the...

Schneider Electric GUIcon Eurotherm

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low skill level to exploit Vendor : Schneider Electric Equipment : Eurotherm by Schneider Electric GUIcon Vulnerabilities : Type Confusion, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow an...

AIX 7.1 TL 5 : solaris (IJ10132)

https://vulners.com/cve/CVE-2017-3623 https://vulners.com/cve/CVE-2017-3623 An unspecified vulnerability in Oracle Sun Systems related to the Solaris Kernel RPC component could allow an unauthenticated attacker to take control of the system. C Tenable Network Security, Inc. The text in the...

CVE-2018-15719

Open Dental before version 18.4 ships with a MySQL database and uses default credentials of root with a blank password, enabling anyone on the network with access to the server to access all database information. Remediate by upgrading to version 18.4 or later (details in provided sources).

CVE-2018-11466

A vulnerability has been identified in SINUMERIK 808D V4.7 All versions, SINUMERIK 808D V4.8 All versions, SINUMERIK 828D V4.7 All versions V4.7 SP6 HF1, SINUMERIK 840D sl V4.7 All versions V4.7 SP6 HF5, SINUMERIK 840D sl V4.8 All versions V4.8 SP3. Specially crafted network packets sent to port...

CVE-2018-11466

Siemens SINUMERIK controllers are affected by CVE-2018-11466. A remote attacker with network access to port 102/tcp (ISO-TSAP) could cause a Denial-of-Service or execute code in the context of the integrated software firewall. Affected products include SINUMERIK 808D v4.7/v4.8, SINUMERIK 828D v4....

CVE-2018-11457

Siemens SINUMERIK controllers (828D v4.7, 840D sl v4.7/v4.8) expose an unpatched remote code execution flaw in the integrated web server on port 4842/TCP. An attacker with network access and without privileges can send specially crafted requests to this port to execute code with system privileges...