Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to read arbitrary files on the underlying operating system OS of an affected device. For more information about these vulnerabilities, see the Details "details" section of...

Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced...

Cisco Webex Meetings Server Open Redirection Vulnerability

A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to...

Cisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based interface of the Cisco SPA112 2-Port Phone Adapter could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against another user of the device. The vulnerability is due to insufficient validation of user-supplied input by the...

Security Advisory - Information Leak Vulnerability on Some Huawei Smart Phones

There is an information leak vulnerability on some Huawei smart phones. An attacker may trick a user into installing a malicious application. Due to coding error during layer information processing, attackers can exploit this vulnerability to obtain some layer information. Vulnerability ID:...

Security Advisory - Double Free Vulnerability in Some Huawei Smart Phones

There is a double free vulnerability in some Huawei smart phones. An attacker can trick a user to click a URL to exploit this vulnerability. Successful exploitation may cause the affected phone abnormal. Vulnerability ID: HWPSIRT-2019-04065 This vulnerability has been assigned a Common...

Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability

A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arbitrary files. The vulnerability is due to incomplete authorization checks in the web management interface. An attacker could exploit this...

Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability

A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this...

Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities

Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the underlying operating system. The...

DCMS Practical Guidelines. Actionable information

The DCMS guidelines for IoT security are an excellent set of recommendations. They help developers secure devices by outlining the basic ways one can prevent common security weaknesses from being present in their devices and infrastructure. The recommendations are well thought out, and encourage...

Security Advisory - TLS Certificate Verification Vulnerability in Huawei 7900 IP Phones

There is a TLS certificate verification vulnerability in the SIP TLS module of Huawei 7900 IP Phones. Due to insufficient verification of specific parameters of the TLS server certificate, attackers can perform man-in-the-middle attacks, leading to the affected phones registered abnormally,...

Security Advisory - Improper Authentication Vulnerability on PC Manager

There is an improper authentication vulnerability on PC Manager. The certain driver interface of the software does not perform a validation of user-mode data properly, successful exploit could result in malicious code execution. Vulnerability ID: HWPSIRT-2019-04061 This vulnerability has been...

Cisco FindIT Network Management Software Static Credentials Vulnerability

A vulnerability in the Cisco FindIT Network Management Software virtual machine VM images could allow an unauthenticated, local attacker who has access to the VM console to log in to the device with a static account that has root privileges. The vulnerability is due to the presence of an account...

Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability

A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by...

Oracle Communications Billing and Revenue Management CVE-2019-12086 Remote Security Vulnerability

Description Oracle Communications Billing and Revenue Management is prone to a remote security vulnerability. The vulnerability can be exploited over the 'HTTP' protocol. The 'Billing Care' and 'Business Operations Center jackson-databind' components are affected. This vulnerability affects the...

Foxit PhantomPDF CVE-2019-17139 Out of Bounds Write Remote Code Execution Vulnerability

Description Foxit PhantomPDF is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code within the context of the affected application or gain sensitive information. Failed exploit attempts will likely cause a denial-of-service condition...

Security Advisory - Intel Microarchitectural Data Sampling (MDS) vulnerabilities

Intel officially released a group of microarchitecture data sampling MDS vulnerabilities. An attacker with local access to a targeted system may exploit these vulnerabilities to obtain data on the targeted system, causing some information leakage. Vulnerability ID: HWPSIRT-2019-05136,...

Security Advisory - Three Vulnerabilities in Huawei PCManager Product

There are two code execution vulnerabilities in Huawei PCManager product. Successful exploitation may cause the attacker to execute code and read/write information. Vulnerability ID: HWPSIRT-2019-05105 and HWPSIRT-2019-05131 The two vulnerabilities have been assigned two Common Vulnerabilities an...

Patch Tuesday Lowdown, July 2019 Edition

Microsoft today released software updates to plug almost 80 security holes in its Windows operating systems and related software. Among them are fixes for two zero-day flaws that are actively being exploited in the wild, and patches to quash four other bugs that were publicly detailed prior to...

Microsoft Windows GDI Component CVE-2019-1094 Information Disclosure Vulnerability

Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 16...