Schneider Electric Quantum Ethernet Network Module Improper Check for Unusual or Exceptional Conditions (CVE-2020-7477)

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 Versions 7.0 and prior, Quantum processors with integrated Ethernet 140CPU65xxxxx all Versions, and Premium processors with integrated Ethernet all Versions, which...

Schneider Electric Modicon Forced Browsing (CVE-2020-7541)

A CWE-425: Direct Request 'Forced Browsing' vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules see security notification for affected versions, that could cause disclosure of sensitive data when sending a...

The vulnerabilities of microprogrammed logic controllers such as Modicon M580, Modicon M340, Modicon MC80, Modicon Momentum Ethernet, Modicon Quantum, Modicon Premium, and the programming software for these controllers—EcoStruxure Control Expert and EcoStruxure Process Expert—allow a hacker to trigger malfunctions during maintenance operations.

The vulnerability of microprogrammed logic controllers such as Modicon M580, Modicon M340, Modicon MC80, Modicon Momentum Ethernet, Modicon Quantum, Modicon Premium, and the programming software for these controllers—EcoStruxure Control Expert and EcoStruxure Process Expert—is related to the...

CVE-2022-0010

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

The vulnerability of the microprogramming software of Schneider Electric’s programmable logic controllers Modicon M340, Modicon Quantum, and Modicon Premium allows a intruder to gain access to confidential data.

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium is related to the falsification of inter-site requests. Exploiting this vulnerability can allow a remote attacker to gain access to...

MAL-2023-1236 Malicious code in microsoft.quantum.sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6cfe7f01c2851d89caea2832921f637fe33c9ba87bb2421a8005fcb0295cb2e6 The OpenSSF Package Analysis project identified 'microsoft.quantum.sdk' @ 0.28.263081 npm as malicious. It is considered malicious because: - Th...

NIST Draft Document on Post-Quantum Cryptography Guidance

NIST has released a draft of Special Publication1800-38A: "Migration to Post-Quantum Cryptography: Preparation for Considering the Implementation and Adoption of Quantum Safe Cryptography." Its only four pages long, and it doesnt have a lot of detail--more "volumes" are coming, with more...

Akamai and the Adoption of Post-Quantum Cryptography

...

UBUNTU-CVE-2023-1906

A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of servi...

SUSE CVE-2023-1906

A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of servi...

Improve Post-Quantum Cryptography Security with CSPM

Gain valuable insight into the emerging world of post-quantum computing and how a security posture management CSPM can bolster your post quantum cryptography defenses...

Emotet Rises Again: Evades Macro Security via OneNote Attachments

The notorious Emotet malware, in its return after a short hiatus, is now being distributed via Microsoft OneNote email attachments in an attempt to bypass macro-based security restrictions and compromise systems. Emotet, linked to a threat actor tracked as Gold Crestwood, Mummy Spider, or TA542,...

Emotet Rises Again: Evades Macro Security via OneNote Attachments

The notorious Emotet malware, in its return after a short hiatus, is now being distributed via Microsoft OneNote email attachments in an attempt to bypass macro-based security restrictions and compromise systems. Emotet, linked to a threat actor tracked as Gold Crestwood, Mummy Spider, or TA542,...

Quantum DXi Storage With Firmware 3.x Does Not Work with Veeam Backup & Replication 12

Challenge When attempting to add Quantum DXi storage with firmware 3.x to Veeam Backup & Replication, the following error is shown: Failed to StartAgent: Failed to construct ClientAgentProtocol. If the Quantum DXi storage was added to Veeam Backup & Replication prior to upgrading to Veeam Backup ...

Schneider Electric EcoStruxure Products, Modicon PLCs, and Programmable Automation Controllers Improper Check For Unusual or Exceptional Conditions (CVE-2022-45788)

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure Control Expert All...

Experts Discover Flaw in U.S. Govt's Chosen Quantum-Resistant Encryption Algorithm

A group of researchers has revealed what it says is a vulnerability in a specific implementation of CRYSTALS-Kyber, one of the encryption algorithms chosen by the U.S. government as quantum-resistant last year. The exploit relates to "side-channel attacks on up to the fifth-order masked...

Side-Channel Attack against CRYSTALS-Kyber

CRYSTALS-Kyber is one of the public-key algorithms currently recommended by NIST as part of its post-quantum cryptography standardization process. Researchers have just published a side-channel attack--using power consumption--against an implementation of the algorithm that was supposed to be...

SUSE CVE-2005-2056

The Quantum archive decompressor in Clam AntiVirus ClamAV before 0.86.1 allows remote attackers to cause a denial of service application crash via a crafted Quantum archive...

SUSE CVE-2010-1311

The qtmdecompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service memory corruption and application crash via a crafted CAB archive that uses the Quantum aka .Q compression format. NOTE: some of these details are obtained from third party...

SUSE CVE-2010-2801

Integer signedness error in the Quantum decompressor in cabextract before 1.3, when archive test mode is used, allows user-assisted remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted Quantum archive in a .cab file, related to the...