Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 Vaadin 10.0.0 through 10.0.7, and Vaadin 11.0.0 through 11.0.2 allows attacker to update element property values via crafted synchronization message. See CWE-754: Improper Check for Unusual or Exceptional...

Yi Home Camera Firmware Downgrade Vulnerability

Yi Home Camera is an IoT home camera sold worldwide. A firmware downgrade vulnerability exists in the time synchronization feature of the Yi Home Camera 27US 1.8.7.0D. An attacker can cause a buffer overflow by intercepting and altering network traffic and exploiting the vulnerability via special...

[SECURITY] Fedora 28 Update: systemd-238-10.git438ac26.fc28

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

Intel (Skylake Kaby Lake) - PortSmash CPU SMT Side-Channel

Intel Skylake Kaby Lake - PortSmash CPU SMT Side-Channel Summary This is a proof-of-concept exploit of the PortSmash microarchitecture attack, tracked by CVE-2018-5407. Setup Prerequisites A CPU featuring SMT e.g. Hyper-Threading is the only requirement. This exploit code should work out of the b...

Yi Technology Home Camera 27US TimeSync Code Execution Vulnerability

Summary An exploitable firmware downgrade vulnerability exists in the time syncing functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted packet can cause a buffer overflow, resulting in code execution. An attacker can intercept and alter network traffic to trigger this vulnerability...

SUSE-SU-2018:3467-1 Security update for smt

SMT was updated to version 3.0.38. Following security issue was fixed: - CVE-2018-12472: Harden hostname check during sibling check by forcing double reverse lookup bsc1104076 Following non security issues were fixed: - Add migration path check when registration sharing is enabled - Fix sibling...

Voice of the Customer: Walmart embraces the cloud with Azure Active Directory

Todays post was written by Sue Bohn, partner director of Program Management and Ben Byford and Gerald Corson, senior directors of Identity and Access Management at Walmart. Greetings! Im Sue Bohn, partner director of Program Management at Microsoft. Im an insatiable, lifelong learner and I lead t...

CVE-2018-0473

A vulnerability in the Precision Time Protocol PTP subsystem of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition of the Precision Time Protocol. The vulnerability is due to insufficient processing of PTP packets. An attacker could explo...

Design/Logic Flaw

A vulnerability in the Precision Time Protocol PTP subsystem of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition of the Precision Time Protocol. The vulnerability is due to insufficient processing of PTP packets. An attacker could explo...

CVE-2018-0473 Cisco IOS Software Precision Time Protocol Denial of Service Vulnerability

A vulnerability in the Precision Time Protocol PTP subsystem of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition of the Precision Time Protocol. The vulnerability is due to insufficient processing of PTP packets. An attacker could explo...

[SECURITY] Fedora 27 Update: ntp-4.2.8p12-1.fc27

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts are in the ntp-perl package, ntpdate is in...

Cisco IOS Software Precision Time Protocol Denial of Service Vulnerability

A vulnerability in the Precision Time Protocol PTP subsystem of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition of the Precision Time Protocol. The vulnerability is due to insufficient processing of PTP packets. An attacker could explo...

Cloudflare Embraces Google Roughtime, Giving Internet Security a Boost

Syncing clocks online is vital to web security...

[SECURITY] Fedora 29 Update: nspr-4.20.0-1.fc29

NSPR provides platform independence for non-GUI operating system facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval timing and calendar time, basic memory management malloc and free and shared library linking...

September 20, 2018—KB4457133 (Preview of Monthly Rollup)

None None...

Error : "An error occurred while building your environment...". Synchronization State of WEM Agents Has a Red "X"

After upgrading WEM from 4.2 to 4.4, WEM agents are failing to connect to the WEM server with the following error: "An error occurred while building your environment. Agent processing will now stop. Please contact your Administrator." Issue only occurs when connections are going through Load...

CVE-2018-11827

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper validation of array index in WMA roam synchronization handler can lead to OOB write...

Citrix Policy - Does applying same policies on different priorities append the policy settings?

Question : Citrix Policy - Does applying same policies on different priorities append the policy settings? Answer : No, applying same policy however different settings in them will not append it, however, it will replace the policy altogether. An example: We have defined the following policy twic...

zzcms 8.3 arbitrary file deletion vulnerability deep thinking-vulnerability warning-the black bar safety net

In the analysis of the already existing cve in the process, discovered zzcms 8.3 comparison of the previous version of the function improved, so by the follow-up look, there is no problem, and sure enough found the problem. CMS for file storage implementation Because I myself have done similar cm...

Veeam Availability Orchestrator stops collecting vCenter asset information

Challenge There is an issue with the embedded Veeam ONE component of Veeam Availability Orchestrator 1.0 release. The issue results in Veeam ONE not recognizing new VMware vCenter assets approximately 90 days after installation. Cause There is a synchronization issue between Veeam ONE Monitor and...