CVE-2015-4253

The CVE-2015-4253 issue affects Cisco TelePresence Serial Gateway devices running software 1.0(1.42). The vulnerability is a Cross-Site Request Forgery (CSRF) flaw that could allow an unauthenticated, remote attacker to hijack the authentication of arbitrary users due to insufficient CSRF protect...

Cisco TelePresence Serial Gateway Cross-Site Request Forgery Vulnerability

A vulnerability in the Cisco TelePresence Serial Gateway Series could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to insufficient cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking the user of a...

The vulnerability of the microprogramming software of the Cisco TelePresence Serial Gateway allows a intruder to execute arbitrary code with privileges of the root user.

The vulnerability of the web-based framework of the microprogramming software for Cisco TelePresence Serial Gateway relates to deficiencies in access control for files. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code with privileges of th...

Charter Communications Fixes Data Leaking Vulnerability

Internet-cable-television provider Charter Communications recently fixed an issue with its website that was inadvertently leaking the information of tens of thousands of customers. Customers’ payment details, modem serial numbers, device names, account numbers, home addresses, were being spilled...

UBUNTU-CVE-2015-1319

The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows physically proximate attackers to mount removable media while the screen is locked as demonstrated by inserting a US...

KLA10504 Multiple vulnerabilities in Cisco products

Multiple serious vulnerabilities have been found in Cisco products. Below is a complete list of vulnerabilities 1. Improper serial port restrictions in Cisco Virtual TelePresence Server Software can be exploited locally via a specially designed OS commands; 2. An unknown vulnerability in Cisco CS...

Cisco Virtual TelePresence Server Software Arbitrary Command Execution Vulnerability

Cisco Virtual TelePresence Server Software is a set of virtual telepresence server software from Cisco USA. The software provides audio, video space and other features. A security vulnerability exists in Cisco Virtual TelePresence Server Software that stems from the program's failure to properly...

CVE-2015-0660

The CVE-2015-0660 issue affects Cisco Virtual TelePresence Server Software (all versions) where improper restrictions on the serial port enable a local attacker with vSphere controller admin privileges to execute arbitrary OS commands as root (privilege escalation). Root cause: undocumented privi...

Code injection

The OLE Point of Sale OPOS drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSPOSPrinter.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt...

Code injection

The OLE Point of Sale OPOS drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSCheckScanner.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt...

CVE-2014-7895

CVE-2014-7895 affects HP Point of Sale Windows PCs with OPOS Common Control Objects (OPOS CCO) drivers older than 1.13.003. The vulnerability is in OPOSCashDrawer.ocx and enables remote code execution via the OPOS driver family (notably on PUSB/SERIAL USB receipts, MICR/hybrid printers, and relat...

kernel: usb: buffer overflow in ttusb-dec

A stack-based buffer overflow flaw was found in the TechnoTrend/Hauppauge DEC USB device driver. A local user with write access to the corresponding device could use this flaw to crash the kernel or, potentially, elevate their privileges on the system...

Kernel: USB serial: memory corruption flaw

A memory corruption flaw was found in the way the USB ConnectTech WhiteHEAT serial driver processed completion commands sent via USB Request Blocks buffers. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the...

BadUSB Vulnerabilities in ICS Gear

CANCUN – BadUSB was the hot hack of the summer of 2014. Noted researcher Karsten Nohl delivered a talk at Black Hat during which he explained how USB controller chips in peripheral devices that connect over USB can be reprogrammed. The result is a completely compromised device hosting undetectabl...

Cisco Ironport Appliances Privilege Escalation Exploit

Cisco Ironport appliances are vulnerable to authenticated "admin" privilege escalation. By enabling the Service Account from the GUI or CLI allows an admin to gain root access on the appliance, therefore bypassing all existing "admin" account limitations. The vulnerability is due to weak algorith...

Schneider Electric Serial Modbus Driver Buffer Overflow (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-14-086-01A Schneider Electric Serial Modbus Driver Buffer Overflow that was published March 27, 2014, on the NCCIC/ICS-CERT web site. Carsten Eiram of Risk-Based Security has identified a stack-based buffer overflo...

Cisco Meraki MS MRMX has a shell acquisition vulnerability

The Cisco-Meraki MS MRMX is a cloud-managed wireless networking device from Cisco. A shell acquisition vulnerability exists in the Cisco Meraki MS MRMX shell, which allows an attacker to gain shell access by opening the device and connecting the cable to a serial port...

CVE-2014-7995

Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow physically proximate attackers to obtain shell access by opening a device's case and connecting a cable to a serial port, aka Cisco-Meraki defect ID 00302077...

F5 Networks BIG-IP : Linux kernel driver vulnerabilities (K15912)

CVE-2014-3185 Multiple buffer overflows in the commandportreadcallback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service memory corruption and...

Oracle Linux 7 : kernel (ELSA-2014-1971)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1971 advisory. - alsa control: Make sure that id-index does not overflow Jaroslav Kysela 1117313 1117314 CVE-2014-4656 - alsa control: Handle numid overflow Jaroslav...