Saturday, November 17, 2018
DHS

Siemens IEC 61850 System Configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC

This advisory includes mitigations for an improper access control vulnerability in the Siemens IEC 61850 system configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC products.
DHS

Siemens S7-400 CPUs

This advisory includes mitigations for improper input validation vulnerabilities in the Siemens S7-400 CPUs.
DHS

Siemens SIMATIC Panels and SIMATIC WinCC (TIA Portal)

This advisory includes mitigations for a code injection vulnerability in the Siemens SIMATIC Panels software and SIMATIC WinCC (TIA Portal).
DHS

Siemens SCALANCE S

This advisory includes mitigations for a cross-site scripting vulnerability in Siemens' SCALANCE S security appliance.
DHS

Siemens SIMATIC S7

This advisory includes mitigations for a resource exhaustion vulnerability in Siemens' Simatic S7 controllers.
DHS

Siemens SIMATIC STEP 7 (TIA Portal)

This advisory includes mitigations for an unprotected storage of credentials vulnerability in Siemens' SIMATIC STEP 7 engineering software.
DHS

Siemens SIMATIC IT Production Suite

This advisory includes mitigations for an improper authentication vulnerability in Siemens' SIMATIC IT Production Suite software.
DHS

Siemens SIMATIC Panels

This advisory includes mitigations for path traversal and open redirect vulnerabilities in Siemens' SIMATIC panels.
DHS

Philips iSite and IntelliSpace PACS

This medical device advisory includes mitigations for a weak password Requirements vulnerability in the Philips iSite and IntelliSpace PACS.
DHS

Roche Point of Care Handheld Medical Devices

This medical device advisory includes mitigations for improper authentication, OS command injection, unrestricted upload of file with dangerous type, and improper access control vulnerabilities in Roche's Point of Care handheld medical devices.
DHS

AVEVA InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition)

This advisory includes mitigations for stack-based buffer overflow and empty password in configuration file vulnerabilities in AVEVA’s InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition) products.
DHS

Schneider Electric Software Update (SESU)

This advisory includes mitigations for a DLL hijacking vulnerability in the Schneider Electric Software Update (SESU).
DHS

Circontrol CirCarLife

This advisory includes mitigations for authentication bypass using an alternate path or channel and insufficiently protected credentials vulnerabilities in Circontrol’s CirCarLife, an electric vehicle charging station.
DHS

Fr. Sauter AG CASE Suite

This advisory includes mitigations for an improper restriction of XML External Entity Reference vulnerability in Fr. Sauter AG's CASE Suite software.
DHS

PEPPERL+FUCHS CT50-Ex

This advisory includes mitigations for an improper privilege management vulnerability in the PEPPERL+FUCHS CT50-Ex ecom mobile computer.
DHS

GEOVAP Reliance 4 SCADA/HMI

This advisory includes mitigations for a cross-site scripting vulnerability in GEOVAP's Reliance 4 SCADA/HMI system.
DHS

Advantech WebAccess

This advisory includes mitigations for stack-based buffer overflow, and improper access control vulnerabilities in Advantech's WebAccess.
DHS

Advantech WebAccess

This advisory includes mitigations for stack-based buffer overflow, external control of file name or path, improper privilege management, and path traversal vulnerabilities in Advantech's WebAccess.
DHS

GAIN Electronic Co. Ltd SAGA1-L Series

This advisory includes mitigations for authentication bypass by capture-relay, improper access control, and improper authentication vulnerabilities in GAIN Electronic's SAGA1-L series transmitters.
DHS

Telecrane F25 Series

This advisory includes mitigations for an authentication bypass by capture-replay vulnerability in the Telecrane F25 Series software.
SC Magazine

Instagram flaw exposes user passwords

A security flaw in Instagram’s recently released “Download Your Data” tool could have exposed some user passwords, the company reportedly told users. The tool, revealed by Instagram right before the GDPR regulation went into effect, is designed to let users...

Julian Assange Charges, Japan’s Top Cybersecurity Official, and More Security News This Week

Safer browsing, more bitcoin scams, and the rest of the week's top security news.
The Register

SMS 2FA database leak drama, MageCart mishaps, Black Friday badware, and more

Plus, why is Kaspersky Lab getting into chess? Roundup  What a week it has been: we had the creation of a new government agency, a meltdown flashback, and of course, Patch Tuesday.…
TechRepublic

Is retaining a cybersecurity attorney a good idea for your business?

Cybersecurity is so complicated that businesses, large and small, are retaining legal counsel specializing in security. Learn two more steps businesses should take before a cyberattack hits.

Machine Learning Can Create Fake ‘Master Key’ Fingerprints

Researchers have refined a technique to create so-called DeepMasterPrints, fake fingerprints designed to get past security.