CVE-2018-20807

CVE-2018-20807 affects Pulse Secure Pulse Connect Secure (PCS) via an XSS in welcome.cgi. Affected: PCS 8.1.x before 8.1R12, 8.2.x before 8.2R9, 8.3.x before 8.3R3. Root cause: improper sanitization of a URL parameter in the WEB app, enabling client-side script execution. Impact: client-side code...

CVE-2018-20807

An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure PCS 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly...

CVE-2018-20814

The CVE-2018-20814 issue is a cross-site scripting (XSS) vulnerability in Psaldownload.cgi affecting Pulse Connect Secure (PCS) 8.3R2 and earlier and Pulse Policy Secure (PPS) 5.4RX and earlier (not applicable to PCS 8.1RX or PPS 5.2RX). Root cause is insufficient validation of client data in the...

Siemens Automation License Manager Detection (Windows SMB Login)

SMB login-based detection of Siemens Automation License Manager. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Cross-site Request Forgery (CSRF)

pcs is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists in pcsd web UI in pcs before 0.9.149...

Privilege Escalations

pcs is vulnerable to privilege escalation attacks. The vulnerability exists through a race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after...

SSL Cookie Without Secure Flag

pcs is vulnerable to SSL cookie without secure flag. The vulnerability exists as the pcs daemon pcsd in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within ...

Fedora 28 : pcs (2018-bbfb0f5bc9)

Security fix for CVE-2018-1086 and CVE-2018-1079 Rebased to latest upstream sources Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible witho...

CVE-2018-6320

A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure PCS 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an https Host header received from the browser is trusted without validation...

CVE-2018-6320

CVE-2018-6320 affects Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) where login.cgi improperly validates the http(s) Host header. Affected versions: PCS 8.1RX pre-8.1R12 and 8.3RX pre-8.3R2; PPS 5.2RX pre-5.2R9 and 5.4RX pre-5.4R2. The issue arises from trusting the Host header receive...

Intel® Management Engine 11.x issue - Lenovo Support US

No description provided...

Intel® Management Engine 11.x issue - US

Lenovo Security Advisory: LEN-21032 Potential Impact: Elevation of Privilege Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2018-3627 Summary Description: Intel performed a security review of their Intel® Management Engine ME 11.x firmware, and identified a security vulnerabili...

Intel® Converged Security Management Engine (Intel® CSME) 11.x issue

Summary: In an effort to continuously improve the robustness of the Intel® Converged Security Management Engine Intel® CSME, Intel has performed a security review of its Intel® CSME with the objective of continuously enhancing firmware resilience. Description: In an effort to continuously improve...

Scientific Linux Security Update : pcs on SL6.x i386/x86_64 (20180619)

Security Fixes : - pcs: Debug parameter removal bypass, allowing information disclosure CVE-2018-1086 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid110889; scriptversion"1.6";...

ThreatList: Exploit Kits Still a Top Web-based Threat

What we can glean from a 2018 roundup of current web-threats is old vulnerabilities die hard. In a report, released by Palo Alto Networks Unit 42, researchers said so far this year cybercriminals are targeting unpatched PCs with ancient CVEs and well-known exploit kits. Here is a ThreatList from...

PBot adware spams ads & installs cryptominer on Windows PCs

By Waqas The IT security researchers at Kaspersky have discovered an adware This is a post from HackRead.com Read the original post: PBot adware spams ads & installs cryptominer on Windows PCs...

CentOS 6 : pcs (CESA-2018:1927)

An update for pcs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

Moderate: Red Hat Security Advisory: pcs security update

An update for pcs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

RHEL 6 : pcs (RHSA-2018:1927)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:1927 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: pcs: Debug parameter removal...

InvisiMole Burrows into Targets with Rich Espionage Tools

Researchers are expressing concern over a versatile spyware called InvisiMole that has been spotted in highly targeted campaigns targeting Windows PCs in Russia and the Ukraine. The malicious code, which comes in 32-bit and 64-bit versions, has a modular architecture, with two different,...