CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-32409 Apple Multiple Products WebKit Sandbox Escape Vulnerability CVE-2023-28204 Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability CVE-2023-323...

Security Bulletin: IBM Operational Decision Manager April 2023 - Multiple CVEs

Summary This Security Bulletin addresses the security vulnerabilities that have been fixed within the IBM Operational Decision Manager. This product now includes fixes for the following security vulnerabilities. Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote...

How to Reduce Exposure on the Manufacturing Attack Surface

Digitalization initiatives are connecting once-isolated Operational Technology OT environments with their Information Technology IT counterparts. This digital transformation of the factory floor has accelerated the connection of machinery to digital systems and data. Computer systems for managing...

Cyolo Product Overview: Secure Remote Access to All Environments

Operational technology OT cybersecurity is a challenging but critical aspect of protecting organizations' essential systems and resources. Cybercriminals no longer break into systems, but instead log in – making access security more complex and also more important to manage and control than ever...

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server packages allows a perpetrator to disclose protected information.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server lies in the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to disclose protected information remotely...

The vulnerability of NETGEAR RAX30 router microprogramming software lies in the lack of protection for service data. This allows attackers to disclose sensitive information and completely compromise the device.

The vulnerability of NETGEAR RAX30 router microprogramming software is related to the lack of protection for operational data. Exploiting this vulnerability can allow attackers to disclose sensitive information and completely compromise the device by sending specially crafted SOAP requests...

CVE-2023-1934

The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerability. Present within the hitlogcsv.jsp endpoint, this security flaw permits unauthenticated attackers to engage with the underlying database seamlessly and...

PT-2023-3021 · Postgresql · Postgresql

Name of the Vulnerable Software and Affected Versions: PnPSCADA affected versions not specified Description: The PnPSCADA system is affected by a critical unauthenticated error-based PostgreSQL Injection vulnerability. This security flaw is present within the "hitlogcsv.jsp" endpoint, allowing...

The vulnerability of the pre-viewing function for macros in Atlassian Confluence Server and the date of the Confluence Data Center, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the preview function for macros on Atlassian Confluence Server and the Confluence Data Center is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected informati...

The vulnerability of the Fortinet FortiNAC network access control mechanism lies in the lack of protection for service data, which allows attackers to exploit this weakness to disclose protected information.

The vulnerability of the Fortinet FortiNAC network access control device is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

The vulnerability of the implementation of the technology for quickly identifying and configuring Cisco Network Plug-and-Play (PnP) devices in the Cisco DNA Center allows a hacker to disclose protected information.

The vulnerability of the implementation of the technology for rapid identification and configuration of Cisco Network Plug-and-Play PnP devices in the Cisco DNA Center is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to disclos...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-1389 TP-Link Archer AX-21 Command Injection Vulnerability CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data Vulnerability CVE-2023-21839 Oracle...

Security Bulletin: A security vulnerability has been identified in OpenSSL in IBM® AIX® shipped with IBM PureData System for Operational Analytics ( CVE-2022-1292)

Summary IBM® AIX® is shipped as a component of IBM PureData System for Operational Analytics. Information about the security vulnerability in OpenSSL affecting IBM AIX has been published in a security bulletin CVE-2022-1292. Vulnerability Details CVEID:CVE-2022-1292 DESCRIPTION: OpenSSL could all...

Beyond Traditional Security: NDR's Pivotal Role in Safeguarding OT Networks

Why is Visibility into OT Environments Crucial? The significance of Operational Technology OT for businesses is undeniable as the OT sector flourishes alongside the already thriving IT sector. OT includes industrial control systems, manufacturing equipment, and devices that oversee and manage...

Security Bulletin: IBM Operational Decision Manager March 2023 - CVE-2014-0114, CVE-2019-10086, CVE-2023-24998

Summary This Security Bulletin addresses the security vulnerabilities that have been fixed within the IBM Operational Decision Manager. This product now includes fixes for the following security vulnerabilities. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and...

Siemens SCALANCE W1750D Cryptographic Issues (CVE-2017-13099)

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as ROBOT. This plugin only works with Tenable.ot...

The vulnerability of the IBM DB2 database management system, related to insufficient protection of operational data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the IBM DB2 database management system is related to insufficient protection of operational data during table processing. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Security Bulletin: Multiple vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU -April 2022 to January 2023 affects AIX LPARs in IBM PureData System for Operational Analytics

Summary Multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 7, and 8 that are used in IBM PureData System for Operational Analytics AIX based LPARs. These issues were disclosed as part of the IBM Java SDK updates in April 2022 to January 2023. These issues were disclosed as pa...

Security Bulletin: One or more security vulnerabilities has been identified in IBM® DB2® shipped with IBM PureData System for Operational Analytics (CVE-2022-43927,CVE-2022-43929)

Summary IBM® DB2® is shipped as a component of IBM PureData System for Operational Analytics. Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin CVE-2022-43927,CVE-2022-43929. Vulnerability Details CVEID:CVE-2022-43929 DESCRIPTION: IBM Db2 for...

The vulnerability of the Cisco Unified Intelligence Center reporting software lies in the lack of protection for operational data, which allows attackers to execute SSRF attacks and expose the protected information.

The vulnerability of the Cisco Unified Intelligence Center reporting software lies in the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks and disclose sensitive information through a specially crafted HTTP request...