CVE-2018-9280

CVE-2018-9280 affects Eaton UPS 9PX 8000 SP devices. The vulnerability stems from the appliance’s web interface disclosing the SNMP v3 user’s password in cleartext on the served page, enabling retrieval by inspecting the page source. Affected component is the web interface that exposes credential...

CVE-2018-9279

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the password in cleartext. Passwords could be retrieved by browsing the source code of the webpage...

CVE-2018-9280

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP version 3 user's password. The web page displayed by the appliance contains the password in cleartext. Passwords of the read and write users could be retrieved by browsing the source code of the webpage...

CVE-2018-9281

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable t...

CVE-2018-9279

CVE-2018-9279 affects Eaton UPS 9PX 8000 SP devices. The web UI exposes the user password in cleartext and the password can be retrieved by inspecting the page source. Multiple sources (NVD/NES plugins, CNVD) describe this disclosure vulnerability. The connected documents do not provide a remedia...

Synaptics Keyboard & Touchpad Driver Running Arbitrary Code - US

Lenovo Security Advisory: LEN-19151 Potential Impact: Execution diversion – launching arbitrary code within the user’s context Severity: Low Scope of Impact: Industry-wide CVE Identifier: TBD, Summary Description: An attacker who has already obtained access to a user’s account could attach an...

Emerson Liebert IntelliSlot Web Card family delivers enhanced communications and control to Liebert UPS,AC Power and Thermal Management systems Unauthorized access

Emerson Liebert IntelliSlot Web Card family delivers enhanced communications and control to Liebert UPS,AC Power and Thermal Management systems Unauthorized access。Lots of them No authentication required and The Management configuration uses the default password. Liebert:Liebert devices in ZoomEy...

Celebrating the life of Tamir Segal

Trend Micro may be a global organization of more than 5,000 employees, but we’re also a tight-knit family. So it was with great sadness and shock that we heard of the passing of Tamir Segal, who has served as our Israel Country Manager for the past eight years. Our thoughts and prayers are with h...

Maliciously Changing Someone's Address

Someone changed the address of UPS corporate headquarters to his own apartment in Chicago. The company discovered it three months later. The problem, of course, is that in the US there isn't any authentication of change-of-address submissions: According to the Postal Service, nearly 37 million...

Schneider Electric MGE UPS and MGE STS 66074 MGE Network Management Card Transverse Improper Authorization Vulnerability

The Schneider Electric MGE UPS and MGE STS are both products of the French company Schneider Electric.The Schneider Electric MGE UPS is an uninterruptible power supply unit.The MGE STS is a static toggle switch.66074 MGE Network Management Card Transverse is one of the network management cards...

Schneider Electric MGE UPS and MGE STS 66074 MGE Network Management Card Transverse Sensitive Information Vulnerability (CNVD-2018-11132)

The Schneider Electric MGE UPS and MGE STS are both products of the French company Schneider Electric.The Schneider Electric MGE UPS is an uninterruptible power supply unit.The MGE STS is a static toggle switch.66074 MGE Network Management Card Transverse is one of the network management cards...

ups-maintenance.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-607218 Description| Value ---|--- Affected Website:| ups-maintenance.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-7244

An information disclosure vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server Port 80/443/TCP of the affected devices could allow a remote attacker to obtain sensitive device information if network...

CVE-2018-7246

CVE-2018-7246 affects Schneider Electric’s 66074 MGE Network Management Card Transverse (SNMP/Web Card) used in MGE UPS and MGE STS. The vulnerability arises from the integrated web server (port 80/443) transmitting sensitive data in cleartext, enabling remote attackers to discover an administrat...

CVE-2018-7246

A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. he integrated web server Port 80/443/TCP of the affected devices could allow remote attackers to discover an administrative...

Ongoing Threat of Ransomware

NCCIC has observed an increase in ransomware attacks across the world. Ransomware is a type of malicious software, or malware, designed to deny access to a computer system or data until a ransom is paid. Ransomware typically spreads through phishing emails or by unknowingly visiting an infected...

Synaptics Keyboard Driver Unprotected Debug Mode - us

Synaptics Keyboard Driver Unprotected Debug Mode Lenovo Security Advisory: LEN-18507 Potential Impact: Loss of confidentiality local to system Severity: Medium Scope of Impact: Industry-wide CVE Identifier: CVE-2017-17556 Summary Description: A researcher discovered a vulnerability in Synaptics...

Synaptics Keyboard Driver Unprotected Debug Mode - Lenovo Support US

No description provided...

Cross-Site Scripting Vulnerability in CloudLock WAF

CloudLock is a free server security management software based on OS kernel hardening technology. A cross-site scripting vulnerability exists in CloudLock WAF. The vulnerability is due to CloudLock failing to adequately filter cross-site scripting. An attacker can exploit this vulnerability to...

Tech support scammers make browser lockers more resilient

Tech support scammers have been relying on fraudulent pop-ups for many years in order to scare potential victims into calling for remote assistance. These so-called browser lockers or browlocks typically originate from malicious ads malvertising that can appear on any website, including trusted...