Design/Logic Flaw

An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the...

CVE-2018-18561

An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the...

PT-2018-14515

Name of the Vulnerable Software and Affected Versions Roche Accu-Chek Inform II Base Unit / Base Unit Hub versions prior to 03.01.04 Roche CoaguChek / cobas h232 Handheld Base Unit versions prior to 03.01.04 Description The issue is related to insecure permissions in a service interface, which ma...

PT-2018-14516

Name of the Vulnerable Software and Affected Versions Roche Accu-Chek Inform II Base Unit / Base Unit Hub versions prior to 03.01.04 CoaguChek / cobas h232 Handheld Base Unit versions prior to 03.01.04 Description An issue was discovered that allows attackers in the adjacent network to gain...

CVE-2018-18561: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the...

USN-3816-2 systemd vulnerability

USN-3816-1 fixed several vulnerabilities in systemd. However, the fix for CVE-2018-6954 was not sufficient. This update provides the remaining fixes. We apologize for the inconvenience. Original advisory details: Jann Horn discovered that unitdeserialize incorrectly handled status messages above ...

USN-3816-1 systemd vulnerabilities

Jann Horn discovered that unitdeserialize incorrectly handled status messages above a certain length. A local attacker could potentially exploit this via NotifyAccess to inject arbitrary state across re-execution and obtain root privileges. CVE-2018-15686 Jann Horn discovered a race condition in...

openSUSE Security Update : systemd (openSUSE-2018-1382)

This update for systemd fixes the following issues : Security issues fixed : - CVE-2018-15688: A buffer overflow vulnerability in the dhcp6 client of systemd allowed a malicious dhcp6 server to overwrite heap memory in systemd-networkd. bsc1113632 - CVE-2018-15686: A vulnerability in...

SUSE-SU-2018:3644-1 Security update for systemd

This update for systemd fixes the following issues: Security issues fixed: - CVE-2018-15688: A buffer overflow vulnerability in the dhcp6 client of systemd allowed a malicious dhcp6 server to overwrite heap memory in systemd-networkd. bsc1113632 - CVE-2018-15686: A vulnerability in unitdeserializ...

Roche Accu-Chek Inform II Base Unit/Base Unit Hub and CoaguChek/cobas h232 Handheld Base Unit License Issue Vulnerability

The Roche Accu-Chek Inform II Base Unit/Base Unit Hub and the CoaguChek/cobas h232 Handheld Base Unit are handheld blood testing medical devices from Roche, Switzerland. An authorization issue vulnerability exists in the Roche Accu-Chek Inform II Base Unit/Base Unit Hub versions prior to 03.01.04...

Roche Accu-Chek Inform II Base Unit/Base Unit Hub and CoaguChek/cobas h232 Handheld Base Unit Command Execution Vulnerabilities

The Roche Accu-Chek Inform II Base Unit/Base Unit Hub and the CoaguChek/cobas h232 Handheld Base Unit are handheld blood testing medical devices from Roche, Switzerland. A security vulnerability exists in the Roche Accu-Chek Inform II Base Unit/Base Unit Hub prior to version 03.01.04 and the...

Small Business Benefits of Moving to the Cloud: Effective Security

When you’re selecting an endpoint security platform for your small business, you want it to work — and work well. However, less than one third of organizations believe that traditional AV has the power to stop the attacks that they are seeing.1 With fileless malware attacks and ransomware on the...

BSA-2018-740

Security Advisory ID : BSA-2018-740 Component : CPU featuring SMT Revision : 1.0: Initial A group a researchers has discover a new vulnerability being called PortSmash, impacting all CPUs that use a Simultaneous Multithreading SMT architecture. SMT is a technology that allows multiple computing...

systemd - reexec State Injection

systemd - reexec State Injection / I am sending this bug report to Ubuntu, even though it's an upstream bug, as requested at https://github.com/systemd/systemd/blob/master/docs/CONTRIBUTING.mdsecurity-vulnerability-reports . When systemd re-executes e.g. during a package upgrade, state is...

Webiness Inventory 2.9 Shell Upload

Exploit Title: Webiness Inventory 2.9 Arbitrary File Upload Date: 10/27/2018 Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Software Link: https://github.com/webiness/webinessinventory Version: 2.9 46 foreach $FILES as $file 47 $fileName = $file'name'; 48 $fileTmp =...

DEBIAN-CVE-2018-15686

A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and...

PT-2018-2799

Name of the Vulnerable Software and Affected Versions systemd versions up to and including 239 Description A vulnerability in unit deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd...

phptpoint Pharmacy Management System 1.0 - 'username' SQL injection

Exploit Title: phptpoint Pharmacy Management System 1.0 - 'username' SQL injection Date: 2018-10-24 Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Vendor Homepage: https://www.phptpoint.com/ Software Link: https://www.phptpoint.com/pharmacy-management-system/ Version: 1 Tested...

phptpoint Hospital Management System 1.0 - 'user' SQL injection

Exploit Title: phptpoint Hospital Management System 1.0 - 'user' SQL injection Date: 2018-10-24 Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Vendor Homepage: https://www.phptpoint.com/ Software Link: Version: 1 Tested on: WAMP windows 10 x64 CVE: unknown Description: Phptpoin...

chromium-browser: Memory corruption in GPU Internals

A heap buffer overflow in GPU in Google Chrome prior to 70.0.3538.67 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...