This Week in Security News: Tracking and Hacking

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Google revealed a secret deal with Mastercard that allows it to track what users buy offline. Also, Senate and House representatives warn th...

Securing the Convergence of IT with OT

The Industrial Internet of Things IIoT is the leading edge of the convergence of Operational Technology OT with IT. This convergence begins with network connectivity but requires enhancements in operational procedures, technology, and training as well. Beginning with the network, IT and OT use...

harfbuzz/hb-subset-fuzzer: Heap-buffer-overflow in OT::LigatureSubstFormat1::closure

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5651059347816448 Project: harfbuzz Fuzzer: aflharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Cra...

ot-valmarnaysien.com XSS vulnerability

Open Bug Bounty ID: OBB-659511 Description| Value ---|--- Affected Website:| ot-valmarnaysien.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Podcast: The Industrial World is Facing a Security Crisis

As more industrial systems become connected, so follows increased awareness of security issues surrounding industrial control systems, programmable logic controllers and SCADA. These once rare worlds of operational technology OT and IoT have now become part of the mainstream cybersecurity...

Hacking Serial Networks on Ships

Three different ways to intercept and modify serial data on ship networks. The serial data that controls steering, engine control and so much more on board ship… How-to Vessels typically have two distinct networks on board; one IP/ethernet network for business systems, crew mail & web browsing an...

Schneider Electric Patches Critical RCE Vulnerability

Researchers discovered a critical remote code execution vulnerability in two Schneider Electric industrial control related products that could give attackers the ability to disrupt or shut down plant operations. Tenable Research, who discovered the vulnerability CVE-2018-8840 and created a...

openthread/ip6-send-fuzzer: Stack-buffer-overflow in ot::KeyManager::SetMasterKey

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=4791101178249216 Project: openthread Fuzzer: aflopenthreadip6-send-fuzzer Fuzz target binary: ip6-send-fuzzer Job Type: aflasanopenthread Platform Id: linux Crash Type: Stack-buffer-overflow...

WS-2018-0641

OpenThread before 2018-06-19 has a stack-based buffer overflow in ot::KeyManager::SetMasterKey...

harfbuzz/hb-subset-fuzzer: Heap-buffer-overflow in OT::BEInt<unsigned char, 1>::operator unsigned char

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5609911946838016 Project: harfbuzz Fuzzer: aflharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Cra...

openthread/ip6-send-fuzzer: Stack-buffer-overflow in ot::NetworkData::ServiceTlv::GetServiceDataLength

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5433723441905664 Project: openthread Fuzzer: libFuzzeropenthreadip6-send-fuzzer Fuzz target binary: ip6-send-fuzzer Job Type: libfuzzerasanopenthread Platform Id: linux Crash Type:...

ot-portovecchio.com XSS vulnerability

Open Bug Bounty ID: OBB-531462 Description| Value ---|--- Affected Website:| ot-portovecchio.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Exploit for Path Traversal in Hoytech Antiweb

ICS/OT AntiWeb: Testing Suite Introducción Una vulnerabil...

ot-campings.com XSS vulnerability

Open Bug Bounty ID: OBB-458038 Description| Value ---|--- Affected Website:| ot-campings.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

openthread/radio-receive-done-fuzzer: Stack-buffer-overflow in ot::Mle::RouteTlv::GetRouteCost

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5295064105353216 Project: openthread Fuzzer: aflopenthreadradio-receive-done-fuzzer Fuzz target binary: radio-receive-done-fuzzer Job Type: aflasanopenthread Platform Id: linux Crash Type:...

CVE-2017-15607

Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters, aka OT-181...

CVE-2017-15607

Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters, aka OT-181...

Directory traversal

Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters, aka OT-181...

CVE-2017-15607

Inedo Otter prior to version 1.7.4 contains a directory traversal vulnerability in filesystem-based rafts, exploitable via vectors that involve '/' characters or an initial '.' character (OT-181). Affected product: Inedo Otter. Root cause: directory traversal in raft filesystem handling. Public r...

CVE-2017-15607

Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters, aka OT-181...