PHOENIX CONTACT FL SWITCH

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: PHOENIX CONTACT Equipment: FL SWITCH Vulnerabilities: Cross-site Request Forgery, Improper Restriction of Excessive Authentication Attempts, Cleartext Transmission of Sensitive Information, Resourc...

Protecting Critical Infrastructure and Roadways: How Smart Cities Create New Risks

Advanced technology has changed countless facets of everyday life, from internal enterprise processes to consumer pursuits and beyond. Even the design, management and support for large and small cities has shifted thanks to innovative smart city systems. While advanced components to support...

Qualys Policy Compliance Notification: Policy Library Update

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

Hacking Construction Cranes

Construction cranes are vulnerable to hacking: In our research and vulnerability discoveries, we found that weaknesses in the controllers can be easily taken advantage of to move full-sized machines such as cranes used in construction sites and factories. In the different attack classes that we'v...

VIA Technologies EPIA-E900 System Motherboard ETK_E900.sys SmartETK Driver Denial of Service Vulnerability

VIA Technologies EPIA-E900 system board is an embedded Pico-ITX motherboard from VIA Technologies.ETKE900.sys SmartETK driver is one of the drivers. A denial of service vulnerability exists in the ETKE900.sys SmartETK driver for the VIA Technologies EPIA-E900 system motherboard, which can be...

CVE-2018-20404

ETKE900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to denial of service attack via IOCTL 0x9C402048, which calls memmove and constantly fails on an arbitrary uncontrollable address, resulting in an eternal hang or a BSoD...

Code injection

ETKE900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to denial of service attack via IOCTL 0x9C402048, which calls memmove and constantly fails on an arbitrary uncontrollable address, resulting in an eternal hang or a BSoD...

CVE-2018-20404

CVE-2018-20404 affects the ETK_E900.sys SmartETK driver for VIA Technologies EPIA-E900 system boards. The vulnerability is triggered by IOCTL 0x9C402048, which calls memmove and may fail on an arbitrary, uncontrollable address, leading to an eternal hang or a blue screen (DoS). Exploitation detai...

CVE-2018-20404

ETKE900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to denial of service attack via IOCTL 0x9C402048, which calls memmove and constantly fails on an arbitrary uncontrollable address, resulting in an eternal hang or a BSoD...

Critical Bug Patched in Schneider Electric Vehicle Charging Station

Schneider Electric is warning about a critical vulnerability in its EVLink Parking devices – a line of electric vehicle charging stations. The energy management and automation giant said the vulnerability is tied to a hard-coded credential bug that exists within the device that could enable...

CVE-2018-18388

eScan Agent Application MWAGENT.EXE 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary commands by sending a carefully crafted payload to TCP port 2222...

Code injection

eScan Agent Application MWAGENT.EXE 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary commands by sending a carefully crafted payload to TCP port 2222...

CVE-2018-18388

eScan Agent Application MWAGENT.EXE 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary commands by sending a carefully crafted payload to TCP port 2222...

#OTTuesday: Five Technologies Shaping the Future of OTT

The world of OTT is changing radically with new innovations, from player technologies to standards convergence, propelling the industry forward. As 2018 comes to a close, AkamaiTV sat down with DASH legend and Akamai's very own Will Law to get his pulse on the major trends and technologies that a...

Chinese hackers reportedly stole secret US Navy data

By Waqas Hackers of Chinese origin have stolen data from US Navy contractors whose content includes highly confidential information on advanced military technologies. In June this year, it was reported that Chinese hackers stole 614 gigabytes of US Navy’s anti-ship missile data. Now, authorities ...

New Frontiers In Cryptojacking

Tejas Girme & Rishikesh Bhide of Qualys Malware Research Labs present “New Frontiers in Cryptojacking” at the 21st Anti-Virus Asia Researchers International Conference AVAR 2018 in Goa, India. Cryptojacking attacks are evolving over time to better evade detection by both end users and protection...

Microsoft AI competition explores the next evolution of predictive technologies in security

Predictive technologies are already effective at detecting and blocking malware at first sight. A new malware prediction competition on Kaggle will challenge the data science community to push these technologies even furtherto stop malware before it is even seen. The Microsoft-sponsored competiti...

Remotely controlled EV home chargers – the threats and vulnerabilities

We are now seeing signs of a possible shift in the field of personal transport. Recent events such as the 'dieselgate' scandal undermine customer and government confidence in combustion engines and their environmental safety. At the same time there has been a big step forward in the development o...

WordPress <= 5.0 - Authenticated Post Type Bypass vulnerability

Authenticated Post Type Bypass vulnerability found by RIPS Technologies in WordPress versions = 5.0. Solution Update WordPress to the latest available version at least 5.0.1...

WordPress <= 5.0 - Authenticated Post Type Bypass

Description According to WordPress: "Simon Scannell of RIPS Technologies discovered that authors could create posts of unauthorized post types with specially crafted input."...