The Federal Trade Commission (FTC) has released an announcement promoting Privacy Awareness Week (PAW). PAW is an annual event fostering awareness of privacy issues and the importance of protecting personal information. This year’s theme, “Protecting Privacy is Everyone’s Responsibility,” focuses on promoting privacy awareness for consumers and businesses.
The NCCIC has published an advisory on an uncontrolled resource consumption vulnerability in Mitsubishi Electric MELSEC-Q Series Ethernet Module. MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior are affected. Successful exploitation of this vulnerability may render the device unresponsive, requiring a physical reset of the PLC. Mitsubishi Electric has released new firmware Version 20122 for the QJ71E71-100 Ethernet module to mitigate the reported vulnerability. The NCCIC has also provided a series of measures to address this vulnerability.
The NCCIC has published an advisory on cross-site request forgery, information exposure through discrepancy, cross-site scripting, command injection, information exposure through source code, use of hard-coded cryptographic key, SQL injection, authentication bypass using an alternate path or channel, and inadequate encryption strength vulnerabilities in Computrols CBAS Web. Numerous versions of this product are affected.
President Trump has signed the executive order “Securing the Information and Comunications Technology and Services Supply Chain,” which gives the federal government the authority to block telecommunications or information technology that are deemed an “unacceptable risk” to national security. The executive order doesn’t specifically mention Huawei, but concerns about the potential security implications of U.S. companies using components from the Chinese tech giant, as well as from other Chinese manufacturers, in their infrastructure undoubtedly contributed to its release.
Microsoft has released security updates to address a remote code execution vulnerability (CVE-2019-0708) in Remote Desktop Services. A remote attacker could exploit this vulnerability to take control of an affected system.
The NCCIC has published an advisory on an out-of-bounds read vulnerability in Fuji Electric Alpha7 PC Loader. Versions 1.1 and prior are affected. Successful exploitation of this vulnerability could crash the device. Fuji Electric has released Version 1.2 of the software to address the vulnerability. The NCCIC has also provided a series of measures to address this vulnerability. Read the advisory at NCCIC/ICS-CERT.
The NCCIC has published an advisory on a use of insufficiently random values vulnerability in Schneider Electric Modicon Controllers. Numerous products and versions of the products are affected. Successful exploitation of this vulnerability could allow an attacker to hijack TCP connections or cause information leakage. Schneider Electric recommends a series of mitigations to address this vulnerability. The NCCIC has also provided a series of measures to address this vulnerability.
Facebook has released a security advisory to address a vulnerability in WhatsApp. A remote attacker could exploit this vulnerability to take control of an affected device. The NCCIC encourages users to review the Facebook Security Advisory for CVE-2019-3568 and upgrade to the appropriate version. Read the advisory at NCCIC/US-CERT.
May 14, 2019
The NCCIC has updated this advisory with additional information on the technical details of the vulnerability and mitigation measures. Read the advisory at NCCIC/ICS-CERT.
April 9, 2019
May 14, 2019
The NCCIC has updated this advisory with additional information on the technical details of the vulnerability and mitigation measures. Read the advisory at NCCIC/ICS-CERT.
November 13, 2018
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
