CVE-2019-12764: Undefined Security Weakness

An issue was discovered in Joomla! before 3.9.7. The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...

[20190603] - Core - ACL hardening of com_joomlaupdate

The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...

Design/Logic Flaw

Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.12 allows the remote attacker to execute unauthorized code by substituting a forged update...

CVE-2018-13012

Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.12 allows the remote attacker to execute unauthorized code by substituting a forged update...

CVE-2018-13012

The CVE-2018-13012 vulnerability affects SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite prior to version 4.4.12. Description: a flaw where code downloaded during updates is not validated with proper integrity checks, enabling ...

Security Bulletin: A vulnerability in the GSKit component of IBM Security SiteProtector System (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM Security SiteProtector System. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this...

Security Bulletin: A vulnerability in IHS (IBM HTTP Server) affects IBM Security SiteProtector System (CVE-2015-1829)

Summary The IBM Security SiteProtector System uses IBM HTTP Server IHS for which there is a potential denial of service vulnerability that may impact IHS on Windows. Exploitation of the attack requires local access to the server system. Vulnerability Details CVEID: CVE-2015-1829 DESCRIPTION: Apac...

CVE-2017-14090

CVE-2017-14090 affects Trend Micro ScanMail for Exchange 12.0. The vulnerability lies in the update mechanism: communications to update servers are unencrypted (HTTP) and lack certificate validation, enabling eavesdropping/tampering. Core Security’s advisory details that vulnerable update paths a...

The MeDoc Connection

This Post Authored by David Maynor, Aleksandar Nikolic, Matt Olney, and Yves YounanSummaryThe Nyetya attack was a destructive ransomware variant that affected many organizations inside of Ukraine and multinational corporations with operations in Ukraine. In cooperation with Cisco Advanced Service...

CVE-2017-9035: Cleartext Transmission of Sensitive Information

Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers...

Description of the cumulative update for Office Communications Server 2007 R2, Core Components: January 2010

Describes the issues that are fixed in the Office Communications Server 2007 R2, Core Components cumulative update that is dated January 2010.SummaryThis article describes the Microsoft Office Communications Server 2007 R2, Core Components issues that are fixed in the cumulative update for...

McAfee VirusScan Enterprise for Linux authentication token brute force

Added: 12/23/2016 CVE: CVE-2016-8023 BID: 94823 Background McAfee VirusScan Enterprise for Linux is real-time, anti-malware software for Linux. Problem McAfee VirusScan Enterprise for Linux allows remote attackers to execute arbitrary commands by exploiting multiple vulnerabilities, including the...

CVE-2016-1411

A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance ESA, Cisco Web Security Appliance WSA, and Cisco Content Management Security Appliance SMA could allow an unauthenticated, remote attacker to impersonate the update server. More Information:...

CVE-2016-1411

A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance ESA, Cisco Web Security Appliance WSA, and Cisco Content Management Security Appliance SMA could allow an unauthenticated, remote attacker to impersonate the update server. More Information:...

CVE-2016-1411: Undefined Security Weakness

A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance ESA, Cisco Web Security Appliance WSA, and Cisco Content Management Security Appliance SMA could allow an unauthenticated, remote attacker to impersonate the update server. More Information:...

Update Server API Exposure

The Palo Alto Networks update server enables downloading of PAN-OS software releases and dynamic updates through a public API. Some functions of the API were inadvertently exposed to the public...

CVE-2015-7296: Undefined Security Weakness

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote attackers to spoof...

Code injection

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server...

CVE-2015-2908

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server...

Lenovo ThinkPad series computers was traced to multiple security vulnerabilities-vulnerability warning-the black bar safety net

Recently, security firm IOActive at the Lenovo Series of computers found a security vulnerability, the attacker may be on the computers of legitimate applications replaced with malicious app and you can remotely execute malicious instructions. IOActive security researcher in the Bulletin elaborat...