WordPress < 3.1.3 Multiple Vulnerabilities

According to its self-reported version number, the WordPress application running on the remote web server is prior to 3.1.3. It is, therefore, affected by multiple unspecified vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's...

Ubuntu 17.10 : linux vulnerability (USN-3548-1)

Jay Vosburgh discovered a logic error in the x86-64 syscall entry implementation in the Linux kernel, introduced as part of the mitigations for the Spectre vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Note that Tenable Network...

CVE-2018-4835

Siemens TeleControl Server Basic prior to v3.1 is affected by CVE-2018-4835: an attacker with network access to port 8000/tcp can bypass authentication and read limited information. It is reported under ICSA-18-030-02 with CVSS v3.0 base score 5.3 (network, low complexity, no user interaction). R...

SUSE SLED12 / SLES12 Security Update : libexif (SUSE-SU-2018:0193-1)

This update for libexif fixes several issues. These security issues were fixed : - CVE-2016-6328: Fixed integer overflow in parsing MNOTE entry data of the input file bsc1055857 - CVE-2017-7544: Fixed out-of-bounds heap read vulnerability in exifdatasavedataentry function in libexif/exif-data.c...

Siemens Desigo PXC (Update A)

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: Desigo PXC Vulnerability: Improper Authentication UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-18-025-02 Siemens Desigo PXC that was published January...

CVE-2018-4834

Summary: CVE-2018-4834 affects Siemens Desigo PXC family (and related components) via improper authentication. A remote, network-accessible attacker can upload a firmware image without authentication. Impacted products/versions include PXC00-E.D, PXC00/64/128-U with/without web module, PXC001-E.D...

Why Stand-Alone IDPS Matters More Than Ever, and the 2018 Gartner Magic Quadrant

First, What is IDPS and Why Do We Care? Intrusion Prevention Systems IPS emerged as an improvement on Intrusion Detection Systems IDS. IDS are out-of-band collectors of network traffic that analyze the information and provide alerts. The “eureka” of IPS was that instead of just alerting, why not...

CVE-2018-6017

CVE-2018-6017 : Tinder iOS and Tinder Android apps expose private sensitive data by transmitting images without encryption. Multiple sources (NVD/NVD mirror; CNVD/CNVD-2018-03079; CVE record) describe a lack of transport security that enables network sniffing to recover images. Affected software:...

Fedora 27 : glibc (2018-7714b514e2)

This update addresses two security vulnerabilities : - CVE-2017-16997: Check for empty tokens before dynamic string token expansion in the dynamic linker, so that pre-existing privileged programs with $ORIGIN rpaths/runpaths do not cause the dynamic linker to search the current directory,...

SUSE SLES11 Security Update : ncurses (SUSE-SU-2018:0178-1)

This update for ncurses fixes the following issues: Security issue fixed : - CVE-2017-13733: Fix illegal address access in the fmtentry function bsc1056127. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-001) (Meltdown)

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components : - Audio - curl - IOHIDFamily - Kernel - LinkPresentation - QuartzCore - Sandbox - Security - WebKit - Wi-Fi ...

CVE-2018-5114

If an existing cookie is changed to be "HttpOnly" while a document is open, the original value remains accessible through script until that document is closed. Network requests correctly use the changed HttpOnly cookie. This vulnerability affects Firefox 58...

SUSE SLES11 Security Update : rsync (SUSE-SU-2018:0172-1)

This update for rsync fixes one issues. This security issue was fixed : - CVE-2018-5764: The parsearguments function in options.c did not prevent multiple --protect-args uses, which allowed remote attackers to bypass an argument-sanitization protection mechanism bsc1076503 Note that Tenable Netwo...

SUSE SLES11 Security Update : kernel (SUSE-SU-2018:0171-1) (Meltdown) (Spectre)

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. This update is only provided as a fix update for IBM Z platform. - CVE-2017-5753 / 'Spectre Attack': IBM Z fixes were included but not enabled in the previous update. This update enables those fixes...

Ubuntu 17.10 : linux vulnerabilities (USN-3541-1) (Meltdown) (Spectre)

Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. This update provide...

Debian DLA-1249-2 : smarty3 regression update

It was previously discovered that there was a code-injection vulnerability in smarty3, a PHP template engine. A via specially crafted filename in comments could result in arbitrary code execution. However, the fix in 3.1.10-2+deb7u2 was incorrect. For Debian 7 'Wheezy', this regression has been...

Debian DLA-1252-1 : couchdb security update

CVE-2017-12635 Prevent non-admin users to give themselves admin privileges. CVE-2017-12636 Blacklist some configuration options to prevent execution of arbitrary shell commands as the CouchDB user For Debian 7 'Wheezy', these problems have been fixed in version 1.2.0-5+deb7u1. We recommend that y...

Fedora 26 : webkitgtk4 (2018-690989736a) (Spectre)

This update includes improvements to mitigate the effects of Spectre CVE-2017-5753 and CVE-2017-5715 : - Disable SharedArrayBuffers from Web API. - Reduce the precision of high resolution time to 1ms. Additional fixes : - Fix API documentation generation with newer gtk-doc. Note that Tenable...

CVE-2018-2603

CVE-2018-2603 is an OpenJDK/Oracle Java Libraries vulnerability: unbounded memory allocation when reading DER-encoded input in the Libraries (and related JNDI/AWT/JMX contexts). This can allow an unauthenticated attacker with network access via multiple protocols to cause a partial denial of serv...

CVE-2018-2673

CVE-2018-2673 affects the Oracle Hospitality Simphony component (POS) and is listed against Oracle Hospitality Applications. Affected versions are 2.7, 2.8, and 2.9. The vulnerability is described as difficult to exploit but allows an unauthenticated attacker with network access via HTTP to compr...