Siemens SIMATIC CP 343-1/CP 443-1 Modules and SIMATIC S7-300/S7-400 CPUs Vulnerabilities (Update B)

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

The vulnerability of the Thunderbird email client, related to the lack of protection for administrative data, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Thunderbird email client is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by using an embedded form field by pressing the enter key in t...

The vulnerability of the Web Services sub-component of the Oracle WebLogic Server application server, a software platform of Oracle Fusion Middleware, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Web Services sub-component of the Oracle WebLogic Server application server, a software platform of Oracle Fusion Middleware, is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

The vulnerability of the Core RDBMS component of the database management system Oracle Database Server allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Core RDBMS component of the database management system Oracle Database Server lies in the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using the...

The vulnerability of the Analytics Actions sub-component of the Oracle Business Intelligence Enterprise Edition software, specifically within the Oracle Fusion Middleware software platform, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Analytics Actions sub-component of the Oracle Business Intelligence Enterprise Edition software component of the Oracle Fusion Middleware platform is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating...

The vulnerability of the BI Publisher Security sub-component of the BI Publisher reporting tool (formerly XML Publisher), a software platform of Oracle Fusion Middleware, allows an attacker to gain unauthorized access to protected information.

The vulnerability of the BI Publisher Security sub-component of the BI Publisher reporting tool formerly XML Publisher, a software platform of Oracle Fusion Middleware, is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating...

The vulnerability of the eMail component of the Oracle FLEXCUBE Direct Banking system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the eMail component of the Oracle FLEXCUBE Direct Banking system relates to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using the HTTP protoc...

The vulnerability of the Client programs component of the MySQL Server database management system allows attackers to disclose sensitive information.

The vulnerability of the Client programs in the MySQL Server database management system is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to disclose the protected information...

Cisco Talos helps CISOs get back to basics with advisory series

At Cisco Talos, we try to build detections for every threat we see to provide customers with a portfolio capable of identifying and stopping threats at various stages of an attack's lifecycle. Deploying the best suite of layered security tools is an integral part of protecting an organization. Bu...

Insurance Pays Out a Sliver of Norsk Hydro's Cyberattack Damages

On the heels of a severe cyberattack, aluminum giant Norsk Hydro has received only $3.6 million in cyber-insurance – just a fraction of the total costs in damage. Overall, the Oslo, Norway-based company incurred between $60 million to $71 million in damages from the incident, which forced it to...

The vulnerability of the network web interface for controlling microprogrammed software in Cisco SPA100 Series IP phones allows a perpetrator to gain unauthorized access to read data.

The vulnerability of the network web interface for controlling Cisco SPA100 Series IP phones is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to read data...

Cynet’s free vulnerability assessment offering helps organizations significantly increase their security

Long before a cyberattack is underway, organizations need to be focused on improving their security. Part of this is to always be monitoring their environment, on the lookout for weaknesses and ready to take action if they are found. This is the best way to ensure the organization remains immune ...

Security Bulletin: A security vulnerability has been identified in IBM® General Parallel File System shipped with IBM PureData System for Operational Analytics (CVE-2015-1890)

Summary IBM General Parallel File System is shipped as a component of IBM PureData System for Operational Analytics. Information about a security vulnerability affecting IBM General Parallel File System has been published in a security bulletin. Vulnerability Details CVEID: CVE-2015-1890...

Security Bulletin: IBM PureData System for Operational Analytics V1.0 (A1791) is affected by vulnerabilities in GSKit (CVE-2015-0138, CVE-2015-0159 and CVE-2014-6221)

Summary The IBM PureData System for Operational Analytics V1.0 A1791 ships with IBM DB2 10.1. GSKit is an IBM component that is used by IBM DB2. The GSKit that is shipped with IBM DB2 contains multiple security vulnerabilities including the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL...

Security Bulletin: A security vulnerability has been identified in IBM® GPFS shipped with IBM PureData System for Operational Analytics (CVE-2015-4974, CVE-2015-4981)

Summary IBM GPFS is shipped as a component of IBM PureData System for Operational Analytics. Information about a security vulnerability affecting IBM GPFS has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: IBM Spectrum Scale an...

Security Bulletin: IBM PureData System for Operational Analytics is affected by multiple vulnerabilities in SSLv3 and OpenSSL

Summary The IBM PureData System for Operational Analytics is affected by multiple vulnerabilities in SSLv3 and OpenSSL. Vulnerability Details CVEID: CVE-2014-3566 DESCRIPTION: Multiple products could allow a remote attacker to obtain sensitive information, caused by a design error when using the...

Security Bulletin: Vulnerabilities in Bash affect IBM PureData System for Operational Analytics (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by the IBM PureData System for Operational Analytics. Vulnerability Detai...

Security Bulletin: IBM PureData System for Operational Analytics is affected by multiple vulnerabilities in OpenSSL

Summary The IBM PureData System for Operational Analytics is affected by multiple vulnerabilities in OpenSSL. Vulnerability Details CVEID: CVE-2014-3511 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused by the negotiation of TLS 1.0 instead of higher...

Security Bulletin: TLS padding vulnerability affects IBM PureData System for Operational Analytics (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM PureData System for Operational Analytics. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain...

Security Bulletin: IBM PureData for Operational Analytics A1791 is affected by the following OpenSSL vulnerabilities: CVE-2014-0076, CVE-2014-0195, CVE-2014-0224, CVE-2014-0221 and CVE-2014-3470

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0076 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by an implementation error in ECDSA...