Rockwell Automation is working on patches for two vulnerabilities affecting its Allen-Bradley PowerMonitor 1000 products. Details of the flaws have been public since November 2018. Rockwell Automation and ICS-CERT warned recently that PowerMonitor 1000 power monitors are impacted by authentication bypass and stored cross-site scripting (XSS) vulnerabilities. The affected product is designed to provide load ..
Tag : Vulnerabilities
A privilege escalation vulnerability that allows attackers to elevate permissions to SYSTEM has been found in the LG Device Manager application provided by the tech giant for its laptops. A researcher who uses the online moniker Jackson T. analyzed the tool’s low-level hardware access (LHA) kernel-mode driver, which is associated with the LG Device Manager ..
Proof-of-concept (PoC) code is now publicly available for a recently disclosed container escape vulnerability impacting popular cloud platforms, including AWS, Google Cloud, and numerous Linux distributions. The flaw was discovered last month in runc, a lightweight, portable container runtime used in most containers out there, including cri-o, containerd, Kubernetes, Podman, and others. Tracked as CVE-2019-5736, ..
A researcher says he received a $25,000 bounty from Facebook after he discovered a critical cross-site request forgery (CSRF) vulnerability that could have been exploited to hijack accounts simply by getting the targeted user to click on a link. A white hat hacker who uses the online moniker “Samm0uda” found a vulnerable Facebook endpoint, facebook.com/comet/dialog_DONOTUSE/, ..
Eleven organizations are asking major retailers in the United States to stop selling Internet-connected devices that don’t meet minimum security and privacy requirements. It’s estimated that the number of active Internet of Things (IoT) devices will reach 10 billion by 2020, but several incidents have shown that many such products can pose serious security and ..
Malicious actors have been hacking WordPress websites by exploiting vulnerabilities in a fairly popular plugin called WP Cost Estimation & Payment Forms Builder. Developed by Loopus, the plugin allows WordPress website administrators to create cost calculators and payment forms. The tool is offered on CodeCanyon for $28 and it has been purchased from this marketplace ..
Google revealed recently that it paid out a total of $3.4 million for flaws reported in 2018 by researchers through its Vulnerability Reward Program (VRP). The $3.4 million was awarded for 1,319 reports submitted by 317 researchers from 78 countries. The largest single reward was $41,000 and $181,000 were donated to charity, the company said. ..
Roughly one-third of the ICS-specific vulnerability advisories published in 2018 contained basic factual errors, including when describing and rating the severity of a flaw, according to the 2018 Year in Review report published on Thursday by industrial cybersecurity firm Dragos. Last year, Dragos tracked 204 public advisories describing vulnerabilities impacting industrial control systems (ICS) and ..
An unofficial patch has been made available for a recently disclosed remote code execution vulnerability affecting the Apache OpenOffice open source productivity suite. The flaw, described as a path traversal issue and tracked as CVE-2018-16858, was disclosed in early February by researcher Alex Inführ. The expert found that a hacker could execute code on a ..
SAP this week released its February 2019 set of security fixes, to address over a dozen vulnerabilities across its product portfolio, including a Hot News flaw in SAP HANA Extended Application Services, advanced model. A total of 13 Security Notes were issued as part of this month’s SAP Security Patch Day, along with 3 updates ..
