Some of Rockwell Automation’s MicroLogix controllers and ControlLogix communications modules are affected by a potentially serious vulnerability that can be exploited for denial-of-service (DoS) attacks. ICS-CERT published an advisory describing the vulnerability on Thursday, but Rockwell Automation informed customers of the flaw several weeks ago – Rockwell’s advisory is only available to registered users. According ..
Tag : Vulnerabilities
A new class action filed against Marriott following the massive data breach alleges that the hotel giant’s systems are affected by a serious vulnerability that still exposes customer information. Several lawsuits have been filed against Marriott after the company revealed that hackers had access to its systems since at least 2014 and that they may ..
Google this week released a set of security patches for Android, to address over 50 vulnerabilities in the mobile operating system. The most severe of the security bugs is a critical issue in Media framework that could be exploited by remote attackers to execute arbitrary code within the context of a privileged process, with the ..
Apple this week released several security updates to address tens of vulnerabilities impacting the iOS and macOS platforms, the Safari browser, and various Windows applications. 20 of the vulnerabilities were patched with the release of iOS 12.1.1, impacting various components, including Airport, Disk Images, FaceTime, File Provider, Kernel, Profiles, Safari, and WebKit. WebKit was impacted ..
Siemens wants to release security advisories on the second Tuesday of every month, similar to Microsoft, Adobe and SAP. The company carried out a pilot test last month, when it published a total of 16 advisories – including new advisories and updates to previously posted announcements – on November 13. It’s now hoping to get ..
GCHQ Joins the NSA in Publishing its Vulnerabilities Equities Process On November 15, 2017, the U.S. government made public its vulnerability equities process (VEP). This is the process used to decide whether a government agency should disclose a discovered vulnerability or keep it secret for its own purposes. Exactly one year and two weeks later, ..
Some machine-to-machine (M2M) protocols can be abused by malicious actors in attacks aimed at Internet of Things (IoT) and industrial Internet of Things (IIoT) systems, according to research conducted by Trend Micro and the Polytechnic University of Milan. The security firm has analyzed two popular M2M protocols: Message Queuing Telemetry Transport (MQTT), which facilitates communications ..
A critical privilege escalation vulnerability has been found in Kubernetes, the popular open-source container orchestration system that allows users to automate deployment, scaling and management of containerized applications. The vulnerability, discovered by Rancher Labs Co-founder and Chief Architect Darren Shepherd, is tracked as CVE-2018-1002105 and it has been assigned a CVSS score of 9.8. It ..
A Quarter Million Devices Vulnerable to UPnProxy Botnet More than 270,000 Internet-connected devices run vulnerable implementations of UPnP and are susceptible to becoming part of a multi-purpose botnet, Akamai says. Dubbed UPnProxy, the botnet was first detailed in April this year, when it had infected around 65,000 devices. At the moment, there are more than ..
A potentially serious vulnerability discovered by researchers in the Zoom video conferencing application can allow external attackers or malicious insiders to hijack screen controls, spoof chat messages, and remove attendees from a session. Tenable researcher David Wells discovered recently that the Zoom applications for Windows and macOS are affected by a vulnerability that can be ..
