PT-2020-06: Local file reading in iDRAC

A vulnerability in iDRAC versions prior to 4.20.20.20 allows low-privileged users to gain unauthorized read access to arbitrary files on the system and potentially obtain administrative privileges. Advisory status: March 12, 2020 - Vendor notification date July 7, 2020 - Security advisory...

PT-2020-07: Arbitrary file reading in Oracle WebLogic Server

A vulnerability in Oracle WebLogic Server allows remote attackers to read local files in the context of the web server using a service URL and a specially crafted request. To exploit the vulnerability an adversary should have an administrative account. Access to the administrative panel is not...

Genasys Technologies: Missing redaction on a disclosed report

Hi team, I wasn't sure if this worth a report, but I thought that you should be aware and HackerOne's support referred me to submit a report. I ran into a diclosed report where the reporter asked to redact his email but we can still extract his email and more info about his google account from th...

WECON Technologies PLC Editor Buffer Overflow Vulnerability

WECON Technologies PLC Editor is a programming software for Programmable Logic Controllers PLC from WECON Technologies, China. A buffer overflow vulnerability exists in WECON Technologies PLC Editor. The vulnerability can be exploited to execute code with the privileges of the application via a...

Policy Compliance Library Updates, December 2019

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

HCL Technologies AppScan Source Cross-Site Scripting Vulnerability

HCL Technologies AppScan Source is a static application security testing solution from HCL Technologies India. A cross-site scripting vulnerability exists in HCL Technologies AppScan Source. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An...

ReconCobra - Complete Automated Pentest Framework For Information Gathering

ReconCobra Reconcobra is Foot printing software for Ultimate Information Gathering Kali, Parrot OS, Black Arch, Termux, Android Led TV Interface Software have 82 Options with full automation with powerful information gathering capability In-Action !https://blogger.googleuser...

Oracle Application / HTTP Server Detection (HTTP)

HTTP based detection of the Oracle Application Server AS or Oracle HTTP Server. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Critical Remote Code-Execution Bugs Threaten Global Power Plants

Siemens industrial equipment commonly found in fossil-fuel and large-scale renewable power plants are riddled with multiple security vulnerabilities, the most severe of which are critical bugs allowing remote code-execution. The affected product is SPPA-T3000, a distributed control system used fo...

Multiple Siemens EN100 Ethernet Modules SSA-418979 Multiple Security Vulnerabilities

Description Multiple Siemens EN100 Ethernet Modules are prone to multiple security vulnerabilities. An attacker may leverage these issues to execute arbitrary code, using directory-traversal sequences '../' to retrieve sensitive information and execute arbitrary script code in the browser of an...

Denial of Service Vulnerability in Eastland Technologies KGW3101 Serial Server

Beijing Eastland Technology Co., Ltd. is a company specializing in industrial Internet technology and industry. A denial of service vulnerability exists in the KGW3101 serial port server of Dongtu Technology, which can be exploited by an attacker to cause the web process of the device to restart...

PT-2020-01: Arbitrary code execution in Citrix ADC

This vulnerability allows an unauthorized, remote attacker to execute malicious code on the system, obtain unauthorized access to published applications, and attack intranet resources of the target organization via Citrix servers. Advisory status: 05.12.2019 - Vendor gets vulnerability details...

Google Android System Component Multiple Security Vulnerabilities

Description Google Android is prone to multiple security vulnerabilities. An attacker can leverage these issues to gain sensitive information, elevate privileges or execute arbitrary code in the context of a privileged process. Failed attacks may cause a denial-of-service condition. These issues...

Policy Compliance Library Updates, November 2019

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

NSSLGlobal Technologies SatLink VSAT Modem Unit Cross-Site Scripting Vulnerability

The NSSLGlobal Technologies SatLink VSAT Modem Unit VMU is a VSAT Very Small Aperture Terminal modem from NSSLGlobal Technologies. A cross-site scripting vulnerability exists in the web interface in NSSLGlobal Technologies SatLink VMU versions prior to 18.1.0. The vulnerability stems from a lack ...

CVE-2015-3140

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567...

CVE-2015-3140

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567...

CVE-2015-3140

CVE-2015-3140 affects Synametrics products: SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567, vulnerable to cross-site request forgery (CSRF). Root cause: CSRF in multiple web app components allowing attacker to trigger actions in an authenticated use...

CVE-2019-19045

A flaw was found in the Linux kernel. The Mellanox Technologies Innova driver mishandles resource cleanup on error. An attacker, able to trigger error could use this flaw to crash the system. The highest threat from this vulnerability is to system availability. Mitigation In order to mitigate thi...