CVE-2016-0721

CVE-2016-0721 describes a session fixation vulnerability in pcsd (part of the PCS/Corosync-Pacemaker tooling) affecting pcs before 0.9.157. The issue arises from how sessions are managed, potentially allowing an attacker to hijack an authenticated session. Affected product: pcs/pcsd components pr...

Gigabyte BRIX Mini PCs are vulnerable to firmware update validation flaws

GIGABYTE is a professional motherboard manufacturer in Taiwan. GB-BSi7H-6500 and GB-BXi7-5775 are GIGABYTE Brix small computers, similar to Intel NUCs. UEFI, or Unified Extensible Firmware Interface, is a standard that describes the type of interface in detail. UEFI, or Unified Extensible Firmwar...

Fedora Update for pcs FEDORA-2017-7accc8010b

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for pcs FEDORA-2017-71e69a691b

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 25 : pcs (2017-71e69a691b)

Security fix for CVE-2017-2661: Improper node name field validation when creating clusters leads to XSS - Re-added support for clufter as it is now available for Python 3 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

[SECURITY] Fedora 25 Update: pcs-0.9.156-2.fc25

pcs is a corosync and pacemaker configuration tool. It permits users to easily view, modify and create pacemaker based clusters...

[SECURITY] Fedora 24 Update: pcs-0.9.156-2.fc24

pcs is a corosync and pacemaker configuration tool. It permits users to easily view, modify and create pacemaker based clusters...

GIGABYTE BRIX Mini PCs suffer from a flawed firmware protection mechanism vulnerability

GIGABYTE is a professional motherboard manufacturer in Taiwan, GB-BSi7H-6500 and GB-BXi7-5775 are the BRIX series of mini PCs. UEFI, or Unified Extensible Firmware Interface, is a standard that describes a detailed type of interface. This interface is used to automatically load the operating syst...

132 Google Play Apps Booted For Having Malicious IFrames

Google removed 132 apps infected with malicious iFrames from its Google Play store after security researchers discovered a development platform used to create the apps was infected with malware and in turn compromised the apps. Palo Alto Networks’ Unit 42 researchers said the apps were infected...

SIEMENS SIMATIC Logon Certification Bypass Vulnerability

SIMATIC WinCC, SIMATIC PCS 7, SIMATIC PDM and SIMATIC IT are industrial automation products from Siemens. An authentication bypass vulnerability exists in SIEMENS SIMATIC Logon. An attacker can exploit the vulnerability to bypass the authentication mechanism and perform unauthorized operations...

Siemens SIMATIC Authentication Bypass (Update C)

CVSS v3 9.0 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Siemens Equipment: SIMATIC Vulnerability: Improper Authentication UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-17-045-03B Siemens SIMATIC Authentication Bypass that was...

Siemens SIMATIC Authentication Bypass (Update A)

CVSS v3 9.0 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Siemens Equipment: SIMATIC Vulnerability: Authentication Bypass UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-17-045-03 Siemens SIMATIC Authentication Bypass that was...

Siemens SIMATIC Authentication Bypass (Update B)

CVSS v3 9.0 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Siemens Equipment: SIMATIC Vulnerability: Authentication Bypass UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-17-045-03A Siemens SIMATIC Authentication Bypass that was...

ICSA-17-045-03 Siemens SIMATIC Authentication Bypass (Update D)

1. EXECUTIVE SUMMARY CVSS v3 9.0 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Siemens Equipment: SIMATIC Vulnerability: Improper Authentication 2. UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-17-045-03C Siemens SIMATIC...

Raspberry Pi launches PIXEL OS for Mac and PCs

Here's the Raspberry Pi's Christmas treat for tech community! The Raspberry Pi Foundation has released an experimental version of its lightweight Linux-based Debian operating system called PIXEL OS that can run on most standard desktop computers ships with Windows and Mac OS X without the need of...

Design/Logic Flaw

A vulnerability in SIEMENS SIMATIC WinCC All versions SIMATIC WinCC V7.2 and SIEMENS SIMATIC PCS 7 All versions SIMATIC PCS 7 V8.0 SP1 could allow a remote attacker to crash an ActiveX component or leak parts of the application memory if a user is tricked into clicking on a malicious link under...

CVE-2016-9160

A vulnerability in SIEMENS SIMATIC WinCC All versions SIMATIC WinCC V7.2 and SIEMENS SIMATIC PCS 7 All versions SIMATIC PCS 7 V8.0 SP1 could allow a remote attacker to crash an ActiveX component or leak parts of the application memory if a user is tricked into clicking on a malicious link under...

CVE-2016-9160

The CVE-2016-9160 entry affects Siemens SIMATIC WinCC and PCS 7. Affected versions are WinCC before v7.2 and PCS 7 before v8.0 SP1. The vulnerability stems from improper restriction of operations within the bounds of a memory buffer in the ActiveX control, enabling a remote attacker to crash the ...

CVE-2016-9160

A vulnerability in SIEMENS SIMATIC WinCC All versions SIMATIC WinCC V7.2 and SIEMENS SIMATIC PCS 7 All versions SIMATIC PCS 7 V8.0 SP1 could allow a remote attacker to crash an ActiveX component or leak parts of the application memory if a user is tricked into clicking on a malicious link under...

JVN#42070907: Multiple SONY Videoconference Systems do not properly perform authentication

Multiple SONY Videoconference Systems have a default user account which does not require authentication to login to a device CWE-306. This user account has a privilege to view some of the system configuration files. As a result, the device may be manipulated by an attacker with administrative...