Policy Compliance Library Updates, November 2019

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

NSSLGlobal Technologies SatLink VSAT Modem Unit Cross-Site Scripting Vulnerability

The NSSLGlobal Technologies SatLink VSAT Modem Unit VMU is a VSAT Very Small Aperture Terminal modem from NSSLGlobal Technologies. A cross-site scripting vulnerability exists in the web interface in NSSLGlobal Technologies SatLink VMU versions prior to 18.1.0. The vulnerability stems from a lack ...

CVE-2015-3140

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567...

CVE-2015-3140

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567...

CVE-2015-3140

CVE-2015-3140 affects Synametrics products: SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567, vulnerable to cross-site request forgery (CSRF). Root cause: CSRF in multiple web app components allowing attacker to trigger actions in an authenticated use...

CVE-2019-19045

A flaw was found in the Linux kernel. The Mellanox Technologies Innova driver mishandles resource cleanup on error. An attacker, able to trigger error could use this flaw to crash the system. The highest threat from this vulnerability is to system availability. Mitigation In order to mitigate thi...

CVE-2015-3140: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567...

Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path

Exploit Title: Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path Discovery by: Luis Martinez Discovery Date: 2019-11-18 Vendor Homepage: https://www.rockwellautomation.com/enNA/overview.page Software Link :...

Orcus RAT Author Charged in Malware Scheme

In July 2016, KrebsOnSecurity published a story identifying a Toronto man as the author of the Orcus RAT, a software product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. This week, Canadian authorities criminally charged him with...

Debian DLA-1985-1 : djvulibre security update

It was discovered that there was a NULL pointer dereference issue in the IW44 encoder/decoder within DjVu, a set of compression technologies for high-resolution ssues. For Debian 8 'Jessie', this issue has been fixed in djvulibre version 3.5.25.4-4+deb8u2. We recommend that you upgrade your...

Debian: Security Advisory (DLA-1985-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

What Keeps NSA Cybersecurity Boss Anne Neuberger Up at Night

At WIRED25, the NSA's Anne Neuberger talked election security, low-orbit satellites, and weaponized autonomous drones...

LEAD Technologies LEADTOOLS Numeric Error Vulnerability

LEAD Technologies LEADTOOLS is an image processing development kit from LEAD Technologies. A numeric error vulnerability exists in the CMP parsing function in LEAD Technologies LEADTOOLS. The vulnerability can be exploited to execute code via specially crafted CMP image files...

Genasys Technologies: Login Bypass to OTP Enumeration

Summary: If an attacker gets access to the victim's username or know the email used for logging in to the application.He can bypass the login by enumeration og One Time Password. Steps To Reproduce: 1.Go to https://staging.genasystech.co.uk/d2c/ 2.Create an account ,Enter the relevant pin for...

Dell Technologies + VMware Carbon Black: Better Together

It’s been an exciting few months for the VMware Carbon Black team and we’re excited to share some big news with you. Today, from VMworld Europe 2019 in Barcelona, VMware announced an enhanced partnership with Dell Technologies that will make Carbon Black Cloud, along with Dell Trusted Devices and...

Google Chrome OS Imagination Technologies driver input validation error vulnerability

Chrome OS is a web-based, lightweight, open source operating system from Google, USA. Imagination Technologies driver is a graphics driver used in it. An input validation error vulnerability exists in versions of the Imagination Technologies driver prior to R74-11895.B, R75 prior to R75-12105.B,...

Policy Compliance Library Updates, October 2019

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

Official Code Analysis Partner for TYPO3

RIPS Technologies and TYPO3 are proud to announce their new technical partnership. TYPO3 will be using RIPS industry-leading code analysis solution to continuously scan the TYPO3 code base for security vulnerabilities and weaknesses. CEO Johannes Dahse explains: “This partnership represents anoth...

HomePwn - Swiss Army Knife for Pentesting of IoT Devices

HomePwn is a framework that provides features to audit and pentesting devices that company employees can use in their day-to-day work and inside the same working environment. It is designed to find devices in the home or office, take advantage of certain vulnerabilities to read or send data to...