VARIoT IoT vulnerabilities database

A vulnerability in the web interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of Secure Sockets Layer (SSL) renegotiation requests. An attacker could exploit this vulnerability by sending renegotiation requests at a high rate. An successful exploit could increase the resource usage on the system, eventually leading to a DoS condition. This vulnerability affects version 2.1. An attacker can exploit this issue to cause a denial-of-service condition; denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCvo10487. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies. There is a resource management error vulnerability in the web interface of Cisco ISE version 2.1, which originates from the improper management of system resources (such as memory, disk space, files, etc.) by network systems or products

A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this vulnerability by repeatedly sending unauthenticated gRPC requests to the affected device. A successful exploit could cause the emsd process to crash, resulting in a DoS condition. Resolved in Cisco IOS XR 6.5.1 and later. Cisco IOS XR The software contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. This issue is being tracked by Cisco Bug ID CSCve12615. The vulnerability stems from the network system or product not correctly validating the input data. Do the correct validation

The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes, a heap buffer overflow is triggered in wlc_wpa_sup_eapol. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions. Broadcom Made Wi-Fi For chipset Broadcom wl Drivers and open source brcmfmac There are multiple vulnerabilities in the driver. Broadcom wl Driver vulnerabilities : Client is an access point (AP) To do with 4-way During handshake EAPOL message 3 In the analysis process of 2 There are two heap buffer overflows. FullMAC When used in a chipset, these buffer overflows occur in the chipset firmware. Open source brcmfmac Vulnerability present in the driver : brcmfmac Driver is Broadcom FullMAC This driver works only with the chipset. Vulnerability to avoid frame verification - CVE-2019-9503 brcmfmac If the driver receives a firmware event frame from a remote source, is_wlc_event_frame This function is designed to discard this frame and call the appropriate handler when a firmware event frame is received from the host. However, the bus connecting the chipset USB in the case of ( For example Wi-Fi Dongle etc. ) , The frame verification process according to the above source may be bypassed and firmware event frames from remote sources may be processed. Heap buffer overflow - CVE-2019-9500 Wake-up on Wireless LAN If the feature is enabled, by processing a specially crafted event frame, brcmf_wowl_nd_results A heap buffer overflow may occur in the function. Also, the vulnerability of frame verification avoidance (CVE-2019-9503) By combining with, it can be exploited for remote attacks.Crafted Wi-Fi Denial of service by processing frames (DoS) It can cause a condition. In some situations, arbitrary code may be executed. Attackers may exploit these issues to execute arbitrary code within the context of the affected application. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations

The Siemens SIMATIC S7-300 is a modular universal controller for the manufacturing industry from Siemens. The Siemens SIMATIC S7-300 has an information disclosure vulnerability that allows an attacker to exploit device-related data

A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system could allow an authenticated, local attacker to access the development shell without proper authentication, which allows for root access to the underlying Linux OS. The attacker would need valid device credentials. The vulnerability exists because the software improperly validates user-supplied input at the CLI authentication prompt for development shell access. An attacker could exploit this vulnerability by authenticating to the device and entering crafted input at the CLI. A successful exploit could allow the attacker to access the AP development shell without proper authentication, which allows for root access to the underlying Linux OS. Software versions prior to 8.3.150.0, 8.5.135.0, and 8.8.100.0 are affected. Cisco AP-COS There are vulnerabilities related to access control in the operating system.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Cisco Aironet Access Points is prone to an access-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in launching further attacks. This issue is tracked by Cisco Bug ID CSCvk42764

There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8). An attacker could view the photos after a series of operations without unlocking the screen lock. Successful exploit could cause an information disclosure condition. An attacker can use this vulnerability to entice a user who has gained root privileges to install a malicious application to read process information, causing sensitive information to leak

A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition. Manual intervention may be required to recover the device. This vulnerability is fixed in Cisco Expressway Series and Cisco TelePresence Video Communication Server Releases X12.5.1 and later. This issue is being tracked by Cisco Bug ID CSCvn99037

A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to access internal applications running on the sysadmin VM. The vulnerability is due to incorrect isolation of the secondary management interface from internal sysadmin applications. An attacker could exploit this vulnerability by connecting to one of the listening internal applications. A successful exploit could result in unstable conditions, including both a denial of service and remote unauthenticated access to the device. This vulnerability has been fixed in Cisco IOS XR 64-bit Software Release 6.5.3 and 7.0.1, which will edit the calvados_boostrap.cfg file and reload the device. Cisco IOS XR The software contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. An attacker can exploit this issue to gain unauthorized access, perform unintended actions and cause denial-of-service conditions. This may lead to further attacks. This issue is being tracked by Cisco Bug ID CSCvn56004

A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the PIM process to restart, resulting in a denial of service condition on an affected device. The vulnerability is due to the incorrect processing of crafted AutoRP packets. An attacker could exploit this vulnerability by sending crafted packets to port UDP 496 on a reachable IP address on the device. A successful exploit could allow the attacker to cause the PIM process to restart. Software versions prior to 6.2.3, 6.3.2, 6.4.0, and 6.5.1 are affected. Cisco IOS XR The software contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco IOS XR Software is prone to a denial-of-service vulnerability. This issue is being tracked by Cisco Bug ID CSCvg43676. The vulnerability stems from the failure of the network system or product to properly validate the input data

The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer overflow is triggered in wlc_wpa_plumb_gtk. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions. Broadcom Made Wi-Fi For chipset Broadcom wl Drivers and open source brcmfmac There are multiple vulnerabilities in the driver. Broadcom wl Driver vulnerabilities : Client is an access point (AP) To do with 4-way During handshake EAPOL message 3 In the analysis process of 2 There are two heap buffer overflows. FullMAC When used in a chipset, these buffer overflows occur in the chipset firmware. Open source brcmfmac Vulnerability present in the driver : brcmfmac Driver is Broadcom FullMAC This driver works only with the chipset. Vulnerability to avoid frame verification - CVE-2019-9503 brcmfmac If the driver receives a firmware event frame from a remote source, is_wlc_event_frame This function is designed to discard this frame and call the appropriate handler when a firmware event frame is received from the host. However, the bus connecting the chipset USB in the case of ( For example Wi-Fi Dongle etc. ) , The frame verification process according to the above source may be bypassed and firmware event frames from remote sources may be processed. Heap buffer overflow - CVE-2019-9500 Wake-up on Wireless LAN If the feature is enabled, by processing a specially crafted event frame, brcmf_wowl_nd_results A heap buffer overflow may occur in the function. Also, the vulnerability of frame verification avoidance (CVE-2019-9503) By combining with, it can be exploited for remote attacks.Crafted Wi-Fi Denial of service by processing frames (DoS) It can cause a condition. In some situations, arbitrary code may be executed. Attackers may exploit these issues to execute arbitrary code within the context of the affected application. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations

A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to internal services without additional authentication. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending arbitrary HTTP requests to internal services. An exploit could allow the attacker to bypass any firewall or other protections to access unauthorized internal services. DNAC versions prior to 1.2.5 are affected. Cisco DNA Center Contains an input validation vulnerability.Information may be obtained and information may be altered. Cisco DNA Center Software is prone to a access-bypass vulnerability. This issue is being tracked by Cisco Bug CSCvj93985. The solution scales and protects devices, applications, and more within the network

Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites. Dell SupportAssist Client Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Dell SupportAssist Client is prone to the following security vulnerabilities: 1. A cross-site request forgery vulnerability 2. A remote code-injection vulnerability An attacker may leverage these issues to perform certain unauthorized actions and gain access to the affected application or execute arbitrary code. This may aid in further attacks. The program provides automated, proactive and predictive techniques for troubleshooting and more. The vulnerability stems from the failure of the network system or product to properly validate the input data

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems. Dell SupportAssist Client Contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Dell SupportAssist Client is prone to the following security vulnerabilities: 1. A cross-site request forgery vulnerability 2. A remote code-injection vulnerability An attacker may leverage these issues to perform certain unauthorized actions and gain access to the affected application or execute arbitrary code. This may aid in further attacks

A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file. Check Point ZoneAlarm is prone to the following security vulnerabilities: 1. A denial-of-service vulnerability 2. An insecure-file-permissions vulnerability Attackers can exploit these issues to cause denial-of-service conditions and gain elevated privileges on an affected system that may lead to further attacks. Check Point ZoneAlarm version 15.4.062 and prior are vulnerable

Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can allow a local attacker to replace a DLL file with a malicious one and cause Denial of Service to the client. Check Point ZoneAlarm Contains an unreliable search path vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Check Point ZoneAlarm is prone to the following security vulnerabilities: 1. A denial-of-service vulnerability 2. An insecure-file-permissions vulnerability Attackers can exploit these issues to cause denial-of-service conditions and gain elevated privileges on an affected system that may lead to further attacks. Check Point ZoneAlarm version 15.4.062 and prior are vulnerable

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Oracle MySQL is an open source relational database management system from Oracle Corporation of the United States. An attacker could use this vulnerability to cause a denial of service (hang or frequent crashes), affecting the availability of data. These vulnerabilities can be exploited over 'MySQL Protocol' protocol. 8) - aarch64, ppc64le, s390x, x86_64 3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: rh-mysql80-mysql security update Advisory ID: RHSA-2019:2484-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2019:2484 Issue date: 2019-08-14 CVE Names: CVE-2019-2420 CVE-2019-2434 CVE-2019-2436 CVE-2019-2455 CVE-2019-2481 CVE-2019-2482 CVE-2019-2486 CVE-2019-2494 CVE-2019-2495 CVE-2019-2502 CVE-2019-2503 CVE-2019-2507 CVE-2019-2510 CVE-2019-2528 CVE-2019-2529 CVE-2019-2530 CVE-2019-2531 CVE-2019-2532 CVE-2019-2533 CVE-2019-2534 CVE-2019-2535 CVE-2019-2536 CVE-2019-2537 CVE-2019-2539 CVE-2019-2580 CVE-2019-2581 CVE-2019-2584 CVE-2019-2585 CVE-2019-2587 CVE-2019-2589 CVE-2019-2592 CVE-2019-2593 CVE-2019-2596 CVE-2019-2606 CVE-2019-2607 CVE-2019-2614 CVE-2019-2617 CVE-2019-2620 CVE-2019-2623 CVE-2019-2624 CVE-2019-2625 CVE-2019-2626 CVE-2019-2627 CVE-2019-2628 CVE-2019-2630 CVE-2019-2631 CVE-2019-2634 CVE-2019-2635 CVE-2019-2636 CVE-2019-2644 CVE-2019-2681 CVE-2019-2683 CVE-2019-2685 CVE-2019-2686 CVE-2019-2687 CVE-2019-2688 CVE-2019-2689 CVE-2019-2691 CVE-2019-2693 CVE-2019-2694 CVE-2019-2695 CVE-2019-2737 CVE-2019-2738 CVE-2019-2739 CVE-2019-2740 CVE-2019-2752 CVE-2019-2755 CVE-2019-2757 CVE-2019-2758 CVE-2019-2774 CVE-2019-2778 CVE-2019-2780 CVE-2019-2784 CVE-2019-2785 CVE-2019-2789 CVE-2019-2795 CVE-2019-2796 CVE-2019-2797 CVE-2019-2798 CVE-2019-2800 CVE-2019-2801 CVE-2019-2802 CVE-2019-2803 CVE-2019-2805 CVE-2019-2808 CVE-2019-2810 CVE-2019-2811 CVE-2019-2812 CVE-2019-2814 CVE-2019-2815 CVE-2019-2819 CVE-2019-2826 CVE-2019-2830 CVE-2019-2834 CVE-2019-2879 ===================================================================== 1. Summary: An update for rh-mysql80-mysql is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. The following packages have been upgraded to a later upstream version: rh-mysql80-mysql (8.0.17). 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the MySQL server daemon (mysqld) will be restarted automatically. 5. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-mysql80-mysql-8.0.17-1.el7.src.rpm aarch64: rh-mysql80-mysql-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-common-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-config-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-server-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-test-8.0.17-1.el7.aarch64.rpm ppc64le: rh-mysql80-mysql-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-common-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-test-8.0.17-1.el7.ppc64le.rpm s390x: rh-mysql80-mysql-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-common-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-test-8.0.17-1.el7.s390x.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-mysql80-mysql-8.0.17-1.el7.src.rpm aarch64: rh-mysql80-mysql-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-common-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-config-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-server-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.aarch64.rpm rh-mysql80-mysql-test-8.0.17-1.el7.aarch64.rpm ppc64le: rh-mysql80-mysql-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-common-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-test-8.0.17-1.el7.ppc64le.rpm s390x: rh-mysql80-mysql-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-common-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-test-8.0.17-1.el7.s390x.rpm x86_64: rh-mysql80-mysql-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-common-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-test-8.0.17-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4): Source: rh-mysql80-mysql-8.0.17-1.el7.src.rpm ppc64le: rh-mysql80-mysql-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-common-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-test-8.0.17-1.el7.ppc64le.rpm s390x: rh-mysql80-mysql-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-common-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-test-8.0.17-1.el7.s390x.rpm x86_64: rh-mysql80-mysql-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-common-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-test-8.0.17-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5): Source: rh-mysql80-mysql-8.0.17-1.el7.src.rpm ppc64le: rh-mysql80-mysql-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-common-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-test-8.0.17-1.el7.ppc64le.rpm s390x: rh-mysql80-mysql-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-common-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-test-8.0.17-1.el7.s390x.rpm x86_64: rh-mysql80-mysql-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-common-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-test-8.0.17-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6): Source: rh-mysql80-mysql-8.0.17-1.el7.src.rpm ppc64le: rh-mysql80-mysql-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-common-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-test-8.0.17-1.el7.ppc64le.rpm s390x: rh-mysql80-mysql-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-common-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-test-8.0.17-1.el7.s390x.rpm x86_64: rh-mysql80-mysql-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-common-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-test-8.0.17-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7): Source: rh-mysql80-mysql-8.0.17-1.el7.src.rpm ppc64le: rh-mysql80-mysql-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-common-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.ppc64le.rpm rh-mysql80-mysql-test-8.0.17-1.el7.ppc64le.rpm s390x: rh-mysql80-mysql-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-common-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.s390x.rpm rh-mysql80-mysql-test-8.0.17-1.el7.s390x.rpm x86_64: rh-mysql80-mysql-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-common-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-test-8.0.17-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-mysql80-mysql-8.0.17-1.el7.src.rpm x86_64: rh-mysql80-mysql-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-common-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-config-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-debuginfo-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-devel-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-errmsg-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-server-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-syspaths-8.0.17-1.el7.x86_64.rpm rh-mysql80-mysql-test-8.0.17-1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-2420 https://access.redhat.com/security/cve/CVE-2019-2434 https://access.redhat.com/security/cve/CVE-2019-2436 https://access.redhat.com/security/cve/CVE-2019-2455 https://access.redhat.com/security/cve/CVE-2019-2481 https://access.redhat.com/security/cve/CVE-2019-2482 https://access.redhat.com/security/cve/CVE-2019-2486 https://access.redhat.com/security/cve/CVE-2019-2494 https://access.redhat.com/security/cve/CVE-2019-2495 https://access.redhat.com/security/cve/CVE-2019-2502 https://access.redhat.com/security/cve/CVE-2019-2503 https://access.redhat.com/security/cve/CVE-2019-2507 https://access.redhat.com/security/cve/CVE-2019-2510 https://access.redhat.com/security/cve/CVE-2019-2528 https://access.redhat.com/security/cve/CVE-2019-2529 https://access.redhat.com/security/cve/CVE-2019-2530 https://access.redhat.com/security/cve/CVE-2019-2531 https://access.redhat.com/security/cve/CVE-2019-2532 https://access.redhat.com/security/cve/CVE-2019-2533 https://access.redhat.com/security/cve/CVE-2019-2534 https://access.redhat.com/security/cve/CVE-2019-2535 https://access.redhat.com/security/cve/CVE-2019-2536 https://access.redhat.com/security/cve/CVE-2019-2537 https://access.redhat.com/security/cve/CVE-2019-2539 https://access.redhat.com/security/cve/CVE-2019-2580 https://access.redhat.com/security/cve/CVE-2019-2581 https://access.redhat.com/security/cve/CVE-2019-2584 https://access.redhat.com/security/cve/CVE-2019-2585 https://access.redhat.com/security/cve/CVE-2019-2587 https://access.redhat.com/security/cve/CVE-2019-2589 https://access.redhat.com/security/cve/CVE-2019-2592 https://access.redhat.com/security/cve/CVE-2019-2593 https://access.redhat.com/security/cve/CVE-2019-2596 https://access.redhat.com/security/cve/CVE-2019-2606 https://access.redhat.com/security/cve/CVE-2019-2607 https://access.redhat.com/security/cve/CVE-2019-2614 https://access.redhat.com/security/cve/CVE-2019-2617 https://access.redhat.com/security/cve/CVE-2019-2620 https://access.redhat.com/security/cve/CVE-2019-2623 https://access.redhat.com/security/cve/CVE-2019-2624 https://access.redhat.com/security/cve/CVE-2019-2625 https://access.redhat.com/security/cve/CVE-2019-2626 https://access.redhat.com/security/cve/CVE-2019-2627 https://access.redhat.com/security/cve/CVE-2019-2628 https://access.redhat.com/security/cve/CVE-2019-2630 https://access.redhat.com/security/cve/CVE-2019-2631 https://access.redhat.com/security/cve/CVE-2019-2634 https://access.redhat.com/security/cve/CVE-2019-2635 https://access.redhat.com/security/cve/CVE-2019-2636 https://access.redhat.com/security/cve/CVE-2019-2644 https://access.redhat.com/security/cve/CVE-2019-2681 https://access.redhat.com/security/cve/CVE-2019-2683 https://access.redhat.com/security/cve/CVE-2019-2685 https://access.redhat.com/security/cve/CVE-2019-2686 https://access.redhat.com/security/cve/CVE-2019-2687 https://access.redhat.com/security/cve/CVE-2019-2688 https://access.redhat.com/security/cve/CVE-2019-2689 https://access.redhat.com/security/cve/CVE-2019-2691 https://access.redhat.com/security/cve/CVE-2019-2693 https://access.redhat.com/security/cve/CVE-2019-2694 https://access.redhat.com/security/cve/CVE-2019-2695 https://access.redhat.com/security/cve/CVE-2019-2737 https://access.redhat.com/security/cve/CVE-2019-2738 https://access.redhat.com/security/cve/CVE-2019-2739 https://access.redhat.com/security/cve/CVE-2019-2740 https://access.redhat.com/security/cve/CVE-2019-2752 https://access.redhat.com/security/cve/CVE-2019-2755 https://access.redhat.com/security/cve/CVE-2019-2757 https://access.redhat.com/security/cve/CVE-2019-2758 https://access.redhat.com/security/cve/CVE-2019-2774 https://access.redhat.com/security/cve/CVE-2019-2778 https://access.redhat.com/security/cve/CVE-2019-2780 https://access.redhat.com/security/cve/CVE-2019-2784 https://access.redhat.com/security/cve/CVE-2019-2785 https://access.redhat.com/security/cve/CVE-2019-2789 https://access.redhat.com/security/cve/CVE-2019-2795 https://access.redhat.com/security/cve/CVE-2019-2796 https://access.redhat.com/security/cve/CVE-2019-2797 https://access.redhat.com/security/cve/CVE-2019-2798 https://access.redhat.com/security/cve/CVE-2019-2800 https://access.redhat.com/security/cve/CVE-2019-2801 https://access.redhat.com/security/cve/CVE-2019-2802 https://access.redhat.com/security/cve/CVE-2019-2803 https://access.redhat.com/security/cve/CVE-2019-2805 https://access.redhat.com/security/cve/CVE-2019-2808 https://access.redhat.com/security/cve/CVE-2019-2810 https://access.redhat.com/security/cve/CVE-2019-2811 https://access.redhat.com/security/cve/CVE-2019-2812 https://access.redhat.com/security/cve/CVE-2019-2814 https://access.redhat.com/security/cve/CVE-2019-2815 https://access.redhat.com/security/cve/CVE-2019-2819 https://access.redhat.com/security/cve/CVE-2019-2826 https://access.redhat.com/security/cve/CVE-2019-2830 https://access.redhat.com/security/cve/CVE-2019-2834 https://access.redhat.com/security/cve/CVE-2019-2879 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXVOxPNzjgjWX9erEAQjMXA/9Eihmyr36juKBY8YJ6hqFuMlWDEtXH/uI /6z1r6cjHcLr4FU+qbt/q8lqQ/mKFBrfYgPrZe6RugoC52B4U4Zkt78Vy0WH4uFJ dh2C6eR2IwFp/avJD3m8vaDTL6aHHXOYSiGJCegg5kjmZyXMWHgI6/bVhprwy1k8 +IXNSF9L87Ww/4teTv7L1eKchstpzZd+7V+ZS6JeaD1Cxu6vYV+Nrbo/J3362h1K 3Zf/aromzPBEl9XXzmqJawN/t1twTp2XAhV8is4FzkQ0XAy/0IoFc/GP34MHYZ2R vwyeVehCmwtHBH8JrViQGE5HgeaE8fs7g3DqIefJmswB+NsYvw1rybPtgOhpew+W MIZaKrzFuiYIl3VQMR5VT2ZVerwglle1uP2x/gYvm4LZsqfdJcwBCFiJhDITQ2cw ZKdlBAs3MJtkJJpWn1kAIKcblmUXU4LRZkJtIH+VBpr0NLQVGwJ2UG93jD7Y74tI 3AH1YAaKHXuAjlpDw4qcWQsPnbegPaWesffkNty6+aLdt4y8nJ8IQWm5aMqSU5xW +6MQ9sf2qIRLYj+RFtNQJP+K0sK32DJjtrZuLDWD2Fhg9w9XG6SZxuSTxfVstBqi M42OspadVMdFto1IQuv9/9I7cS9l5srfVnjq7kO6yuENIm7/tJX+tjU4jagbfZ3L zLIpZwaofO8= =dahN -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. This may occur because CNCSoft lacks user input validation before copying data from project files onto the stack. Delta CNCSoft ScreenEditor Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation CNCSoft ScreenEditor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of DPB files. When parsing the wTextLen element, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the Administrator. Multiple stack-based buffer-overflow vulnerabilities 2. Multiple heap-based buffer-overflow vulnerabilities 3

Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. There is a lack of user input validation before copying data from project files onto the heap. Delta CNCSoft ScreenEditor Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation CNCSoft ScreenEditor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DPB files. An attacker can leverage this vulnerability to execute code in the context of the Administrator. Multiple stack-based buffer-overflow vulnerabilities 2. Multiple heap-based buffer-overflow vulnerabilities 3

On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter. plural ZyXEL The product contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. ZyXELZyWall310 and other products are all products of ZyXEL Corporation of Taiwan, China. ZyXELZyWall310 is a 310 series VPN firewall device. ZyXELZyWall110 is a 110 series VPN firewall device. The ZyXELUSG1900 is a next-generation unified security gateway device. A cross-site scripting vulnerability exists in several Zyxel products that stems from the lack of proper validation of client data by web applications. An attacker could exploit the vulnerability to execute client code. ZyXEL ZyWall 310, etc. The following products are affected: Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, Zy0WALL

The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and Series 750-87x (750-830, 750-849, 750-871, 750-872, 750-873) devices has undocumented service access. Wago series 750-88x and 750-87x The device contains a vulnerability related to the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. WAGO Series 750-88x and 750-87x have a vulnerability in trust management issues. The vulnerability stems from the lack of effective trust management mechanisms in network systems or products. Attackers can use default passwords or hard-coded passwords, hard-coded certificates and other attacks. Components. Successfully exploiting this issue allows a remote attacker to change the settings or alter the programming of the device. The following versions of Series 750-88x and 750-87x are affected: 750-330 firmware versions prior to FW14 750-352 firmware versions prior to FW14 750-829 firmware versions prior to FW14 750-831 firmware versions prior to FW14 750-852 firmware versions prior to FW14 750-880 firmware versions prior to FW14 750-881 firmware versions prior to FW14 750-882 firmware versions prior to FW14 750-884 firmware versions prior to FW14 750-885 firmware versions prior to FW14 750-889 firmware versions prior to FW14 750-830 firmware versions prior to FW06 750-849 firmware versions prior to FW08 750-871 firmware versions prior to FW11 750-872 firmware versions prior to FW07 750-873 firmware versions prior to FW07