Cybersecurity

MITRE has released the 2019 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Errors list. It is a compilation of the most frequent and critical errors that can lead to serious vulnerabilities in software. MITRE notes these weaknesses are often easy to find and exploit and are dangerous because they frequently allow adversaries to completely take over execution of software, steal data, or prevent the software from working. Access the list at MITRE.

CISA has published an advisory on a NULL pointer reference vulnerability in 3S-Smart Software Solutions GmbH CODESYS Control V3 OPC UA Server. Numerous products and versions of these products are affected. Successful exploitation of this vulnerability could cause a denial-of-service condition. 3S-Smart Software Solutions GmbH has released Version 3.5.15.0 to resolve this vulnerability for all affected CODESYS products. CISA also recommends a series of measures for mitigating the vulnerability.

CISA has published an advisory on path traversal and stack-based buffer overflow vulnerabilities in 3S-Smart Software Solutions GmbH CODESYS V3 web server. Numerous products and versions of these products are affected. Successful exploitation of these vulnerabilities may allow an attacker to create a denial-of-service condition, to perform remote code execution, or to access restricted files. 3S-Smart Software Solutions GmbH has released Versions 3.5.12.80, 3.5.14.10, and 3.5.15.0 to resolve the vulnerabilities for the affected CODESYS products.

Microsoft has released its monthly update to address vulnerabilities in its software. For this month, Microsoft has released security updates for Microsoft Windows, Internet Explorer, Microsoft Edge (EdgeHTML-based), ChakraCore, Microsoft Office and Microsoft Office Services and Web Apps, Adobe Flash Player, Microsoft Lync, Visual Studio, Microsoft Exchange Server, .NET Framework, Microsoft Yammer, .NET Core, ASP.NET, Team Foundation Server, and Project Rome.