⚠ Medtronic cardiac implants can be hacked, FDA issues alert ⚠
📖 Read
via "Naked Security".
Two serious flaws in the telemetry protocol could allow a hacker to control vulnerable Implantable Cardioverter Defibrillators (ICDs).📖 Read
via "Naked Security".
Naked Security
Medtronic cardiac implants can be hacked, FDA issues alert
Two serious flaws in the telemetry protocol could allow a hacker to control vulnerable Implantable Cardioverter Defibrillators (ICDs).
❌ Malware Payloads Hide in Images: Steganography Gets a Reboot ❌
📖 Read
via "Threatpost".
Low-key but effective, steganography is an old-school trick of hiding code within a normal-looking image, where many cybersecurity pros may not think to look.📖 Read
via "Threatpost".
Threat Post
Malware Payloads Hide in Images: Steganography Gets a Reboot
Low-key but effective, steganography is an old-school trick of hiding code within a normal-looking image, where many cybersecurity pros may not think to look.
ATENTION‼ New - CVE-2017-9376
📖 Read
via "National Vulnerability Database".
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-9362
📖 Read
via "National Vulnerability Database".
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-3954
📖 Read
via "National Vulnerability Database".
Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior give unauthenticated users root privileges on Port 23/TELNET by default. An unauthorized user could issue commands to the pump. Hospira recommends that customers close Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-3953
📖 Read
via "National Vulnerability Database".
Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-3952
📖 Read
via "National Vulnerability Database".
Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-7510
📖 Read
via "National Vulnerability Database".
In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-3956
📖 Read
via "National Vulnerability Database".
Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-1014
📖 Read
via "National Vulnerability Database".
A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-1012
📖 Read
via "National Vulnerability Database".
Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless capacity in a clinical setting. Hospira has developed a new version of the PCS Infusion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-1007
📖 Read
via "National Vulnerability Database".
A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible.📖 Read
via "National Vulnerability Database".
🕴 Attackers Compromise ASUS Software Update Servers to Distribute Malware 🕴
📖 Read
via "Dark Reading: ".
ShadowHammer campaign latest to highlight dangers of supply chain attacks.📖 Read
via "Dark Reading: ".
Darkreading
Attackers Compromise ASUS Software Update Servers to Distribute Malware
ShadowHammer campaign latest to highlight dangers of supply chain attacks.
❌ ThreatList: Remote Workers Threaten 1 in 3 Organizations ❌
📖 Read
via "Threatpost".
More than one-third of surveyed organizations (36 percent) said have experienced a security incident because of a remote worker's actions.📖 Read
via "Threatpost".
Threat Post
ThreatList: Remote Workers Threaten 1 in 3 Organizations
More than one-third of surveyed organizations (36 percent) said they have experienced a security incident because of a remote worker's actions.
ATENTION‼ New - CVE-2017-7340
📖 Read
via "National Vulnerability Database".
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the applicationSearch parameter in the FortiView functionality.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2014-9189
📖 Read
via "National Vulnerability Database".
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2014-9187
📖 Read
via "National Vulnerability Database".
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.📖 Read
via "National Vulnerability Database".
🔐 One reason why you shouldn't allow your web browser to save your passwords 🔐
📖 Read
via "Security on TechRepublic".
Jack Wallen explains why you should never allow your web browser to save passwords--and what you should do instead.📖 Read
via "Security on TechRepublic".
ATENTION‼ New - CVE-2017-7342
📖 Read
via "National Vulnerability Database".
A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via a hidden Close button📖 Read
via "National Vulnerability Database".
🕴 Pwn2Own: Tesla Hack, Broken VMs, and Skewed Economics 🕴
📖 Read
via "Dark Reading: ".
In the latest Pwn2Own vulnerability throwdown at the CanSecWest conference, two researchers walk away with the lion's share of rewards-just like the real marketplace.📖 Read
via "Dark Reading: ".
Dark Reading
Pwn2Own: Tesla Hack, Broken VMs, and Skewed Economics
In the latest Pwn2Own vulnerability throwdown at the CanSecWest conference, two researchers walk away with the lion's share of rewards—just like the real market
⚠ Family tracking app spilled pics, names and real-time location data ⚠
📖 Read
via "Naked Security".
A journalist/researcher team got a sensitive database taken down after the vendor responsible failed to acknowledge a problem.📖 Read
via "Naked Security".
Naked Security
Family tracking app spilled pics, names and real-time location data
A journalist/researcher team got a sensitive database taken down after the vendor responsible failed to acknowledge a problem.