Download our in-depth report: The Ultimate Guide to IT Security Vendors

function popitup(url)
newwindow = window.open(url, 'name', 'height=500,width=980,resizable,scrollbars');
if (window.focus)
newwindow.focus()

return false;

SHARE

Every month, several new vulnerabilities are disclosed – and August was no exception. What follows is a look at 10 high-profile vulnerabilities and fixes that were revealed within the past 30 days.

1. Several Vulnerabilities in Schneider Electric Products

CVE identifiers: CVE-2018-7790, CVE-2018-7791, CVE-2018-7792, CVE-2018-7795

The vulnerability: A cross-site scripting flaw in the PowerLogic PM5560 could allow user input to be manipulated, allowing for remote code execution. Three separate vulnerabilities in the Modicon M221 logic controller could allow unauthorized users to replay authentication sequences, overwrite passwords, or decode passwords.

The fix: Schneider Electric has released an update to address the PM5560 vulnerability, and a separate update to address the Modicon M221 vulnerabilities. Modicon M221 users are also advised to set up a firewall blocking all remote/external access to Port 502.

More info:ICS-CERT provides details here and here.

2. Privilege Escalation Vulnerability in Adobe Creative Cloud Desktop Application

CVE identifier: CVE-2018-12829

The vulnerability: An improper certificate validation vulnerability in versions of the Adobe Creative Cloud desktop application prior to 4.6.1 could lead to privilege escalation.

The fix: Users should update to version 4.6.1.

Credit: The flaw was discovered by Chi Chou of AntFinancial LightYear Labs.

More info:Adobe provides details here.

3. Path Traversal Vulnerability in Cisco Data Center Network Manager

CVE identifier:CVE-2018-0464

The vulnerability: Improper validation of user requests in the management interface for Cisco Data Center Network Manager (DCNM) could allow an authenticated remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system.

The fix: The vulnerability was resolved in Cisco DCNM version 11.0(1).

Credit: The flaw was discovered by Tenable researchers.

More info: Cisco provides details here. 

4. Privilege Escalation Vulnerabilities in Philips Cardiovascular Software

CVE identifiers:CVE-2018-14787, CVE-2018-14789

The vulnerabilities: A pair of privilege escalation vulnerabilities in Philips' IntelliSpace Cardiovascular (ISCV) software could allow an attacker with local access and user privileges to escalate privileges and execute arbitrary code.

The fix: Philips recommends that users contact their local Philips service support team. The company will be providing remediation in the form of a patch in Q3 2018.

More info: Philips provides details here.

5. Critical Remote Code Execution Vulnerability in Apache Struts

CVE identifier: CVE-2018-11776

The vulnerability: Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 are potentially vulnerable to remote code execution due to insufficient validation of untrusted user data in the core of the Struts framework.

The fix: Users of Struts 2.3 should upgrade to version 2.3.35, and users of Struts 2.5 should upgrade to version 2.5.17.

Credit: The flaw was discovered by Semmle security researcher Man Yue Mo.

More info: Semmle provides details here.

6. Critical Code Execution Vulnerabilities in Adobe Photoshop

CVE identifiers: CVE-2018-12810,CVE-2018-12811

The vulnerabilities: Adobe Photoshop CC 19.1.5 and earlier 19.x versions, as well as 18.1.5 and earlier 18.x versions, are vulnerable to arbitrary code execution in the context of the current user.

The fix: Users of Photoshop CC 2018 should update to version 19.1.6; users of Photoshop CC 2017 should update to version 18.1.6.

Credit: The flaws were discovered by Kushal Arvind Shah of Fortinet's FortiGuard Labs.

More info: Adobe provides details here.

7. Remote Code Execution Vulnerability in Microsoft Internet Explorer

CVE identifier: CVE-2018-8373

The vulnerability: A vulnerability in the way the scripting engine handles objects in memory in Internet explorer could allow remote attackers to gain administrative rights over the target system.

The fix: Users of Internet Explorer should update to the latest version.

Credit: The flaws were discovered by Elliot Cao of Trend Micro Security Research.

More info:Microsoft provides details here.

8. Remote Code Execution Vulnerabilities in HP Inkjet Printers

CVE identifiers: CVE-2018-5924, CVE-2018-5925

The vulnerabilities: A maliciously crafted file sent to an affected device could cause a stack or static buffer overflow, which could allow remote code execution.

The fix: HP has provided firmware updates for impacted printers.

Credit: The flaws were discovered by Check Point researchers Eyal Itkin and Yaniv Balmas.

More info:HP provides details here.

9. Out-of-Bounds Read Vulnerability in VMWare Horizon

CVE identifier: CVE-2018-6970

The vulnerabilities: An out-of-bounds read vulnerability in the Message Framework library for VMware Horizon could allow a less-privileged user to leak information from a privileged process running on a system with Horizon Connection Server, Horizon Agent or Horizon Client installed.

The fix: Updates are available from VMware for all affected products.

Credit: The flaws were discovered by Steven Seeley of Source Incite, working with Trend Micro's Zero Day Initiative.

More info:VMware provides details here.

10. Critical Security Vulnerabilities in Mozilla Thunderbird

CVE identifiers: CVE-2018-12359, CVE-2018-102360, CVE-2018-12361

The vulnerabilities: Three separate vulnerabilities (buffer overflow, use-after-free and integer overflow) in the Thunderbird 60 email client could result in a potentially exploitable crash.

The fix: Users are advised to update to the latest version of Thunderbird.

More info:Mozilla provides details here.