HPSBHF3549 rev.2 - ThinkPwn UEFI BIOS SmmRuntime Escalation of Privilege

Potential Security Impact System downtime, or privilege escalation. Source:HP, HP Product Security Response Team PSRT Reported by: Dmytro Oleksiuk VULNERABILITY SUMMARY A security vulnerability identified with UEFI firmware, dubbed ThinkPwn, has been addressed in certain HP commercial notebook PC...

Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional Vulnerabilities (Update C)

OVERVIEW This updated advisory is a follow-up to the advisory update titled ICSA-16-208-01B Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional Vulnerabilities that was published October 4, 2016, on the NCCIC/ICS-CERT web site. Siemens has identified two vulnerabilities in SIMATIC WinCC,...

CVE-2016-5743

Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.1 Update 3 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.2 Update 1 as distributed in...

The vulnerability of the Simatic PCS 7 software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The implementation of SQL code on the Web Navigator system’s input screen allows malicious actors operating remotely to execute arbitrary SQL commands...

CVE-2016-4786

Pulse Connect Secure (PCS) is affected by CVE-2016-4786, a denial-of-service vulnerability that allows remote attackers to cause high CPU usage. Affected ranges include PCS 7.4 up to 7.4r13.3; 8.0 up to 8.0r10; 8.1 up to 8.1r2; and 8.2 up to 8.2r0. The issue has been resolved in PCS releases 7.4r...

CVE-2016-4792

The CVE-2016-4792 issue affects Pulse Connect Secure (PCS) versions 8.2 and earlier up to 8.2r1. The vulnerability allows remote disclosure of sign-in pages via unspecified vectors and does not indicate exploitation details in the provided documents. Affected components are the PCS sign-in/pages ...

CVE-2016-4787

Pulse Connect Secure (PCS) is affected by a read-access information disclosure in multiple versions: 7.4 up to 7.4r13.4, 8.0 up to 8.0r10, 8.1 up to 8.1r2, and 8.2 up to 8.2r0, where remote attackers could read sensitive system authentication files from an unspecified directory via unknown vector...

CVE-2016-4788

Pulse Connect Secure (PCS) contains an information-disclosure vulnerability (CVE-2016-4788) that allows remote attackers to read an unspecified system file via unknown vectors. Affected versions include PCS 7.4 before 7.4r13.4, 8.0 before 8.0r10, 8.1 before 8.1r2, and 8.2 before 8.2r1. The issue ...

CVE-2016-4789

Pulse Connect Secure (PCS) has an XSS vulnerability in the system configuration section of the administrative UI. Affected versions are 7.4 through 7.4r13.3, 8.0 through 8.0r8, 8.1 through 8.1r1, and 8.2 through 8.2r0. The issue allows remote attackers to inject arbitrary script/HTML via unspecif...

CVE-2016-4790

Pulse Connect Secure (PCS) administrators are impacted by a cross-site scripting (XSS) vulnerability in the admin UI described in CVE-2016-4790. Affected PCS versions include 7.4 before 7.4r13.4, 8.0 before 8.0r9, 8.1 before 8.1r2, and 8.2 before 8.2r1, with the issue caused by an XSS flaw in the...

Remote Vulnerability Testing Framework: Pocsuite

Pocsuite is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec Security Team. It comes with a powerful proof-of-concept engine, many niche features for the ultimate penetration testers and security researchers. Requirements Python 2.6...

Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional Vulnerabilities (Update C)

OVERVIEW This updated advisory is a follow-up to the advisory update titled ICSA-16-208-01B Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional Vulnerabilities that was published October 4, 2016, on the NCCIC/ICS-CERT web site. Siemens has identified two vulnerabilities in SIMATIC WinCC,...

Fedora Update for pcs FEDORA-2016-3

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-2243

Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service BIOS recovery failure by leveraging administrative access...

CVE-2016-2243

Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service BIOS recovery failure by leveraging administrative access...

CVE-2016-2243

Summary: CVE-2016-2243 concerns the Sure Start BIOS recovery on certain HP Commercial PCs (2015) that can be exploited locally by an administrator/root to cause a denial of service (BIOS recovery failure). What is affected: Sure Start implementation on listed HP 2015 commercial platforms (HP ZBoo...

Fedora 23 : pcs-0.9.149-2.fc23 (2016-cdd4228cc7)

Re-synced to upstream sources Security fix for CVE-2016-0720, CVE-2016-0721 - Rubygems built with RELRO Spec file cleanup Fixed multilib .pyc/.pyo issue ---- Re-synced to upstream sources Security fix for CVE-2016-0720, CVE-2016-0721 Rubygems built with RELRO Spec file cleanup Fixed multilib...

Fedora 22 : pcs-0.9.149-2.fc22 (2016-3b20c4ec9d)

Added missing python-lxml dependency ---- Re-synced to upstream sources Security fix for CVE-2016-0720, CVE-2016-0721 Rubygems built with RELRO Spec file cleanup Fixed multilib .pyc/.pyo issue Note that Tenable Network Security has extracted the preceding description block directly from the Fedor...

[SECURITY] Fedora 22 Update: pcs-0.9.149-2.fc22

pcs is a corosync and pacemaker configuration tool. It permits users to easily view, modify and created pacemaker based clusters...

HPSBHF03439 rev.2 - HP Commercial PCs with Sure Start, Local Denial of Service

Potential Security Impact Denial of Service DoS Source: Hewlett­Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY HP has identified a potential security vulnerability with the Sure Start implementation on certain 2015 commercial platforms. This vulnerability could be...