PT-2024-39025 · Planet Technology · Planet Technology Devices

Name of the Vulnerable Software and Affected Versions: PLANET Technology devices affected versions not specified Description: The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with thi...

PT-2024-39024 · Planet Technology · Planet Technology Devices

Name of the Vulnerable Software and Affected Versions: PLANET Technology devices affected versions not specified Description: The swctrl service, used for detecting and remotely managing PLANET Technology devices, contains a Denial-of-Service issue. This allows unauthenticated remote attackers to...

PT-2024-39020 · Planet Technology · Planet Technology Switch

Name of the Vulnerable Software and Affected Versions: PLANET Technology switch models affected versions not specified Description: The issue concerns a hard-coded community string in the SNMPv1 service of certain switch models from PLANET Technology. This allows unauthorized remote attackers to...

The vulnerability of the Veeam Reporter Service, a monitoring tool for IT infrastructure, allows a hacker to disclose protected information.

The vulnerability of the Veeam Reporter Service, a monitoring tool for IT infrastructure, is related to insufficient protection of service data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

PT-2024-6553 · Planet Technology · Planet Technology Switch

Name of the Vulnerable Software and Affected Versions: PLANET Technology switches affected versions not specified Description: The issue is related to inadequate access control in the firmware upload and download functionality of certain switch models from PLANET Technology. This allows...

PT-2024-39026 · Planet Technology · Planet Technology Switch

Name of the Vulnerable Software and Affected Versions: PLANET Technology switches affected versions not specified Description: The web application in certain switch models from PLANET Technology does not properly validate specific parameters, allowing remote authenticated users with administrator...

PT-2024-39027 · Planet Technology · Planet Technology Switch

Name of the Vulnerable Software and Affected Versions: PLANET Technology switch models affected versions not specified Description: The web application of certain switch models from PLANET Technology is vulnerable to Cross-Site Request Forgery CSRF. An unauthenticated remote attacker can trick a...

PT-2024-39021 · Planet Technology · Planet Technology Switch

Name of the Vulnerable Software and Affected Versions: PLANET Technology switches affected versions not specified Description: The issue concerns the SSH service in certain switch models from PLANET Technology, which improperly handles insufficiently authenticated connection requests. This allows...

PT-2024-39028 · Planet Technology · Planet Technology Switch

Name of the Vulnerable Software and Affected Versions: PLANET Technology switch models affected versions not specified Description: The issue concerns certain switch models from PLANET Technology that store SNMPv3 users' passwords in plaintext within the configuration files. This allows remote...

PT-2024-39023 · Planet Technology · Planet Technology Switch

Name of the Vulnerable Software and Affected Versions: PLANET Technology switch models affected versions not specified Description: The issue concerns the use of an insecure hashing function to hash user passwords without salting. Remote attackers with administrator privileges can read...

PT-2024-39019 · Planet Technology · Planet Technology Switch

Name of the Vulnerable Software and Affected Versions: PLANET Technology switches affected versions not specified Description: The issue concerns a hard-coded credential in the password recovering functionality of certain switch models from PLANET Technology. This allows an unauthenticated attack...

PT-2024-39018 · Planet Technology · Planet Technology Switch

Name of the Vulnerable Software and Affected Versions: PLANET Technology switch models affected versions not specified Description: The issue concerns a hard-coded credential in the command-line interface of certain switch models from PLANET Technology. This allows remote attackers with regular...

Threat Actors Continue to Exploit OT/ICS through Unsophisticated Means

CISA continues to respond to active exploitation of internet-accessible operational technology OT and industrial control systems ICS devices, including those in the Water and Wastewater Systems WWS Sector. Exposed and vulnerable OT/ICS systems may allow cyber threat actors to use default...

UBUNTU-CVE-2024-31145

Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region Reporting, "RMRR" for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions ...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM SDK, Java Technology Edition Quarterly CPU - Apr 2024 - Includes Oracle April 2024 CPU plus CVE-2023-38264

Summary IBM SDK, Java Technology Edition is vulnerable to CVE-2023-38264. Following IBM® Engineering Lifecycle Engineering product is vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Workflow Management Vulnerability Details Refer to the security bulletins listed...

CGA-FF78-M243-C476

Bulletin has no description...

U.S. Proposes Ban on Connected Vehicles Using Chinese and Russian Tech

The U.S. Department of Commerce DoC said it's proposing a ban on the import or sale of connected vehicles that integrate software and hardware made by foreign adversaries, particularly that of the People's Republic of China PRC and Russia. "The proposed rule focuses on hardware and software...

Multiple Binary Vulnerabilities in GBase 8c at Tianjin Nanda General Data Technology Co.

GBase 8c is a multimodal and polymorphic distributed database built on openGauss 3.0. Multiple binary vulnerabilities exist in GBase 8c at Tianjin Nanda General Data Technology Co. that can be exploited by attackers to cause a denial of service...

Planet Fitness Workouts mobile apps do not properly validate TLS certificates

RISK EVALUATION The Planet Fitness Workouts iOS and Android mobile apps are vulnerable to network attacks due to improper TLS certificate validation, allowing an attacker to obtain session tokens and sensitive information. This issue was fixed in version 9.8.12. 2. RECOMMENDED PRACTICES Upgrade...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities in IBM Java SDK, Java Technology Edition

Summary There are multiple vulnerabilities in IBM Java SDK, Java Technology Edition used by IBM App Connect Enterprise and IBM Integration Bus for z/OS. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-21147 DESCRIPTION: An unspecifie...