Securing the Three Families of IoT

Securing the Internet of Things is difficult. One reason is the Internet of things consists of three different groups of technology. Each group has radically different architectural constraints. Securing each group requires a distinct approach. IoT 0.9 The primitive group contains all legacy...

Fedora 26 : firefox (2018-fb582aabcc)

Update to 57.0.4 - Security fixes to address the Meltdown and Spectre timing attacks - https://blog.mozilla.org/security/2018/01/03/mitigations -landing-new-class-timing-attack/ - Require new nss 3.34 fixed 1531031 - Disabled ARM on all Fedoras due to 1523912 Note that Tenable Network Security...

PHOENIX CONTACT FL SWITCH

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: PHOENIX CONTACT Equipment: FL SWITCH Vulnerabilities: Improper Authorization, Information Exposure AFFECTED PRODUCTS All FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32 are affecte...

SUSE SLES11 Security Update : wireshark (SUSE-SU-2018:0054-1)

This update for wireshark to version 2.2.11 fixes several issues. These security issues were fixed : - CVE-2017-13767: The MSDP dissector could have gone into an infinite loop. This was addressed by adding length validation bsc1056248 - CVE-2017-13766: The Profinet I/O dissector could have crash...

Debian DSA-4082-1 : linux - security update (Meltdown)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. - CVE-2017-5754 Multiple researchers have discovered a vulnerability in Intel processors, enabling an attacker controlling an unprivileged process to...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:0055-1)

This update for ImageMagick fixes several issues. These security issues were fixed : - CVE-2017-1000476: A CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allowed attackers to cause a denial of service bsc1074610. - CVE-2017-9409: The ReadMPCImage functio...

Microsoft Access CVE-2018-0799 Cross Site Scripting Vulnerability

Description Microsoft Access is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow...

Microsoft ASP.NET Core CVE-2018-0785 Cross Site Request Forgery Vulnerability

Description Microsoft ASP.NET Core is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks. Technologies Affected Microsoft ASP.NET Core...

Dell SonicWall SonicOS NSA Cross-Site Scripting Vulnerability (CNVD-2018-03085)

The Dell SonicWall Network Security Appliance NSA 2017 Q4 devices is a firewall appliance from Dell USA.SonicWall SonicOS is a system that runs on it.CFS Custom Category and Cloud AV DB Exclusion Settings are among the modules. A cross-site scripting vulnerability exists in the CFS Custom Categor...

Microsoft Office CVE-2018-0801 Remote Code Execution Vulnerability

Description Microsoft Office is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected Microsoft...

Virtuozzo 7 : crit / criu / criu-devel / ksm-vz / libcompel / etc (VZA-2018-003)

According to the versions of the crit / criu / criu-devel / ksm-vz / libcompel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies ...

Information disclosure

SonicWall SonicOS on Network Security Appliance NSA 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens...

Dell SonicWall SonicOS NSA CVE-2018-5281 Multiple HTML Injection Vulnerabilities

SonicWall SonicOS on Network Security Appliance NSA 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens. CVE: CVE-2018-5281 Last updated: Jan. 30, 2018, 4:12 p.m...

Design/Logic Flaw

SonicWall SonicOS on Network Security Appliance NSA 2016 Q4 devices has XSS via the Configure SSO screens...

Dell SonicWall SonicOS NSA CVE-2018-5280 HTML Injection Vulnerability

SonicWall SonicOS on Network Security Appliance NSA 2016 Q4 devices has XSS via the Configure SSO screens. CVE: CVE-2018-5280 Last updated: Jan. 30, 2018, 4:04 p.m...

CVE-2018-5280

SonicWall SonicOS on Network Security Appliance NSA 2016 Q4 devices has XSS via the Configure SSO screens...

CVE-2018-5281

SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices is affected by a cross-site scripting (XSS) vulnerability via the CFS Custom Category and Cloud AV DB Exclusion Settings screens. The available connected data confirms the affected product and the vulnerability class, but does ...

[SECURITY] Fedora 26 Update: dracut-046-8.git20180105.fc26

dracut contains tools to create a bootable initramfs for 2.6 Linux kernels. Unlike existing implementations, dracut does hard-code as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as...

SonicWall SonicOS NSA UTM Firewall - Bypass & Persistent Vulnerability

Exploit for cgi platform in category web applications Document Title: =============== SonicWall SonicOS NSA - Bypass & Persistent Vulnerability Product & Service Introduction: =============================== Achieve a deeper level of security with the SonicWALL Network Security Appliance NSA Seri...

SUSE SLED12 / SLES12 Security Update : ucode-intel (SUSE-SU-2018:0006-1) (Spectre)

This update for ucode-intel fixes the following issues: The CPU microcode for Haswell-X, Skylake-X and Broadwell-X chipsets was updated to report both branch prediction control via CPUID flag and ability to control branch prediction via an MSR register. This update is part of a mitigation for a...