You are here

Home

Cybersecurity

Microsoft Ending Support for Windows 7

All software products have a life-cycle. After January 14, 2020, Microsoft will no longer provide security updates or support for PCs running the Windows 7 operating system. After this date, this product will no longer receive free technical support for any issues, software updates, and security updates or fixes. Computers running the Windows 7 operating system will continue to work even after support ends. However, using unsupported software may increase the risks from viruses and other security threats.

Columbia Weather Systems MicroServer (ICSA-19-078-02)

The NCCIC has published an advisory on cross-site scripting, path traversal, improper authentication, improper input validation, and code injection vulnerabilities in Columbia Weather Systems MicroServer. Weather MicroServer firmware Version MS_2.6.9900 and prior are affected. Successful exploitation of these vulnerabilities may allow disclosure of data, cause a denial-of-service condition, and allow remote code execution. Columbia Weather Systems has released a firmware update, Version: MS_2.7.9973, that addresses all of the vulnerabilities.

AVEVA InduSoft Web Studio and InTouch Edge HMI (ICSA-19-078-01) – Product Used in the Water and Wastewater and Energy Sectors

The NCCIC has published an advisory on an uncontrolled search path element in AVEVA InduSoft Web Studio and InTouch Edge HMI. InduSoft Web Studio versions prior to v8.1 SP3 and InTouch Edge HMI versions prior to 2017 Update 3 are affected. Successful exploitation of this vulnerability could allow execution of unauthorized code or commands AVEVA recommends that users upgrade to the latest versions. The NCCIC also recommends a series of mitigating measures for this vulnerability.

Malvertising – It’s Back, Again

Malvertising – malicious online ads often requiring zero user interaction to infect unsuspecting website visitors. Cybersecurity firm Avast discusses how the current scourge of malvertising appears to be more dynamic, stealthy, and persistent than historically observed. Malicious ads are often invisible and embedded into well-known websites through online advertising networks.

Don't Take the Bait – Recognize the Most Common Phishing Subjects

Phishers are not a very creative lot. They do not have to be. Malicious actors have been using the same phishing tactics because the same tactics are still successful, even after all these years. After analyzing 360,000 phishing emails over three months, cybersecurity firm Barracuda Networks identified the most common subject lines used in targeting businesses. These subjects highlight how cyber criminals continue to use social engineering to coerce us through a false sense of urgency and trust to succumb to their requests.

MS-ISAC Releases Security Primer on TrickBot Malware

The Multi-State Information Sharing and Analysis Center (MS-ISAC) has released a security primer on the TrickBot malware. TrickBot is a modular banking Trojan that targets users’ financial information and acts as a dropper for other malware. An attacker can leverage TrickBot’s modules to steal banking information, conduct system and network reconnaissance, harvest credentials, and achieve network propagation.

PEPPERL+FUCHS WirelessHART-Gateways (ICSA-19-073-03)

The NCCIC has published an advisory on a path traversal vulnerability in PEPPERL+FUCHS WirelessHART-Gateways. All WHA-GW-* products are affected. Successful exploitation of this vulnerability could allow access to files and restricted directories stored on the device through the manipulation of file parameters. PEPPERL+FUCHS reports that affected users with WHA-GW-*-ETH devices should upgrade to firmware Version 03.00.08. Affected users with WHA-GW-*-ETH.EIP devices should upgrade to firmware Version 02.00.01.

Gemalto Sentinel UltraPro (ICSA-19-073-02)

The NCCIC has published an advisory on an uncontrolled search path element in Gemalto Sentinel UltraPro. Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 are affected. Successful exploitation of this vulnerability could allow execution of unauthorized code or commands. Users who have Sentinel UltraPro Client Library ux32w.versions v1.3.0, v1.3.1 or v1.3.2 are advised to upgrade to Sentinel UtraPro v1.3.3 in order to enable this security update. The NCCIC also recommends a series of mitigating measures for this vulnerability.

Pages

Subscribe to Cybersecurity