CVE-2017-7251

Pi Engine vulnerability CVE-2017-7251 affects pi-engine/pi 2.5.0. The issue arises from insufficient filtration of user-supplied data in the preview path (pi-develop/www/script/editor/markitup/preview/markdown.php), allowing an attacker to execute arbitrary HTML and script code in a victim browse...

CVE-2017-7251

A Cross-Site Scripting XSS was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data preview passed to the "pi-develop/www/script/editor/markitup/preview/markdown.php" URL. An attacker could execute arbitrary HTML and script code in a...

JasPer integer overflow vulnerability (CNVD-2017-03802)

JasPer is a Canadian software developer Michael Adams developed an open source implementation of the JPEG-2000 codec. An integer overflow vulnerability exists in the jpcpinextcprl function in the jpct2cod.c file in versions of JasPer prior to 1.900.20. A remote attacker can exploit this...

USN-3221-1: Linux kernel vulnerability

Alexander Popov discovered that the NHDLC line discipline implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly gain administrative privileges...

Windows Botnet Spreading Mirai Variant

A Chinese-speaking attacker is spreading a Mirai variant from a repurposed Windows-based botnet. Researchers at Kaspersky Lab published a report today, and said the code was written by an experienced developer who also built in the capability to spread the IoT malware to Linux machines under...

Simple OpenVPN Raspberry Pi Installer: piVPN

Simple OpenVPN Raspberry Pi Installer This is a set of shell scripts that serve to easily turn your Raspberry Pi TM into a VPN server using the free, open-source OpenVPN software. The master branch of this script installs and configures OpenVPN on Raspbian Jessie and has been tested on Ubuntu 14....

CVE-2017-5153

An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords...

Design/Logic Flaw

An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords...

CVE-2016-8353

An issue was discovered in OSIsoft PI Web API 2015 R2 Version 1.5.1. There is a weakness in this product that may allow an attacker to access the PI system without the proper permissions...

Design/Logic Flaw

An issue was discovered in OSIsoft PI Web API 2015 R2 Version 1.5.1. There is a weakness in this product that may allow an attacker to access the PI system without the proper permissions...

USB Key Cleaner: CIRCLean

USB Key Cleaner Malware regularly uses USB sticks to infect victims, and the abuse of USB sticks is a common vector of infection. CIRCLean is an independent hardware solution to clean documents from untrusted obtained USB keys / USB sticks. The device automatically converts untrusted documents in...

CVE-2017-5153

An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords...

CVE-2016-8353

An issue was discovered in OSIsoft PI Web API 2015 R2 Version 1.5.1. There is a weakness in this product that may allow an attacker to access the PI system without the proper permissions...

CVE-2017-5153

The CVE-2017-5153 issue affects OSIsoft PI Coresight 2016 R2 and earlier, and PI Web API 2016 R2 when deployed with the PI AF Services 2016 R2 integrated installer. It is an information exposure vulnerability through server log files that may allow exposure of service account passwords, potential...

CVE-2016-8353

The CVE-2016-8353 issue affects OSIsoft PI Web API 2015 R2 (Version 1.5.1). A weakness in the PI Web API service could let an attacker access the PI system without proper permissions, with remote exploitation possible depending on configuration. The NVD/ICS-CERT entries describe the vulnerability...

USN-3190-2: Linux kernel (Raspberry Pi 2) vulnerabilities

Mikulas Patocka discovered that the asynchronous multibuffer cryptographic daemon mcryptd in the Linux kernel did not properly handle being invoked with incompatible algorithms. A local attacker could use this to cause a denial of service system crash. CVE-2016-10147 It was discovered that a...

USN-3189-1: Linux kernel vulnerabilities

Mikulas Patocka discovered that the asynchronous multibuffer cryptographic daemon mcryptd in the Linux kernel did not properly handle being invoked with incompatible algorithms. A local attacker could use this to cause a denial of service system crash. CVE-2016-10147 Qidan He discovered that the...

Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3169-3)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3169-3 advisory. Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound Architecture ALSA subsystem of the Linux kernel...

USN-3170-2: Linux kernel (Raspberry Pi 2) vulnerabilities

Andrey Konovalov discovered that the ipv6 icmp implementation in the Linux kernel did not properly check data structures on send. A remote attacker could use this to cause a denial of service system crash. CVE-2016-9919 Andrey Konovalov discovered that signed integer overflows existed in the...

USN-3169-3 linux-raspi2 vulnerabilities

Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound Architecture ALSA subsystem of the Linux kernel. A local attacker could use this to cause a denial of service system crash. CVE-2016-9794 Andrey Konovalov discovered that signed integer...