Blogs – Security

CVE / NIST

CISA News

CISA Blog

Cybersecurity Advisories

ICS Advisories

ICS Medical Advisories

Packet Storm Security

The Hacker News

PFAS Found in Firefighter Gloves, Hoods and Wildland Gear 2024-12-17
The amount of PFAS in each sample varied greatly, so it may be possible to design gear that reduces exposure.
Sarah Henderson
3 NIST Researchers Receive Presidential Rank Awards 2024-12-05
All three were awarded the “Distinguished Rank,” the highest category of Presidential Rank Awards.
Sarah Henderson
NIST Transfers Evidence From Champlain Towers South to Miami-Dade Police Department 2024-11-21
The National Construction Safety Team has reached an important milestone in its investigation into the 2021 partial collapse of Champlain Towers South.
Sarah Henderson
FACT SHEET: U.S. Department of Commerce & U.S. Department of State Launch the International Network of AI Safety Institutes at Inaugural Convening in San Francisco 2024-11-20
San Francisco, California – Today the U.S. Department of Commerce and U.S. Department of State are co-hosting the inaugural convening of the International Network of AI Safety Institutes, a new global effort to advance the science of AI safety and
Victoria Ballagh
Melissa Midzor Named Director of NIST’s Communications Technology Laboratory 2024-11-18
The lab focuses on advancing communications technology through research and development in core network technologies, next-generation wireless systems, public safety communications, smart infrastructure and spectrum sharing.
Sarah Henderson
AI Can ‘Hear’ When a Lithium Battery Is About to Catch Fire 2024-11-14
NIST researchers have trained AI to detect the telltale sound even in noisy environments.
Sarah Henderson
NIST Awards $15 Million to ASTM International to Establish Standardization Center of Excellence 2024-10-15
The new center will support U.S. engagement in international standardization for critical and emerging technologies.
Sarah Henderson
NIST Announces 2024 Baldrige Awards for Performance Excellence 2024-10-10
The Baldrige Award was redesigned earlier this year to focus on organizational resilience.
Sarah Henderson
Smart New Laser Technology Can Monitor Greenhouse Gases Faster, More Sensitively 2024-10-09
New laser technology, known as free-form dual-comb spectroscopy, quickly measures gases of interest by homing in on the most information-rich parts of a sample.
Sarah Henderson
NIST Awards Up to $1.5 Million to Support Development of Regenerative Medicine Standards Curricula 2024-10-08
The awardees will create training programs on the standards, protocols and measurements underpinning the field.
Sarah Henderson
Biden-Harris Administration Announces First CHIPS Commercial Fabrication Facilities Award with Polar Semiconductor, Establishing Independent American Foundry 2024-09-24
Today, as part of the Biden-Harris Administration’s Investing in America agenda, the U.S. Department of Commerce announced its first award under the CHIPS Incentives Program’s Funding Opportunity for Commercial Fabrication Facilities of up to $123
Joy Antwi
NIST Awards $6 Million to Carnegie Mellon University to Establish an AI Cooperative Research Center 2024-09-24
The CMU/NIST AI Measurement Science & Engineering Cooperative Research Center will seek to advance AI risk management practices and evaluation approaches through stakeholder partnerships.
Sarah Henderson
NIST Awards $3 Million for Community-Based Cybersecurity Workforce Development 2024-09-23
The grants of roughly $200,000 each will go to organizations that are working to address the nation’s shortage of skilled cybersecurity employees.
Sarah Henderson
NIST Funds Climate Measurements Center of Excellence at the University of Vermont 2024-09-20
The agreement includes an award of $2.7 million appropriated by Congress for this purpose.
Sarah Henderson
New Smoke Alarms Are Better at Detecting Fires but Still Beep for Bacon 2024-09-18
NIST research in a kitchen fire laboratory shows that updated smoke detectors still produce nuisance alarms during cooking.
Sarah Henderson
NIST Provides Update on Champlain Towers South Investigation 2024-09-12
Work continues to determine cause of the 2021 tragedy and to develop science-based recommendations to improve building safety.
Sarah Henderson
NIST’s Long Phan and Marc Levitan Receive Service to America Medal 2024-09-10
The award recognizes their efforts to develop standards and building codes to make structures resistant to tornadoes.
Sarah Henderson
Now Live: Living Cells Can Be Seen With Infrared Light 2024-09-09
NIST researchers use new method to measure biomolecules in live cells.
Sarah Henderson
New Report Highlights Economic Value of Neutron Science to U.S. Industry 2024-09-05
Research using neutron beams provides an economic return far larger than the cost of building and operating neutron facilities, according to an economic impact analysis.
Sarah Henderson
Major Leap for Nuclear Clock Paves Way for Ultraprecise Timekeeping 2024-09-04
These clocks could lead to improved timekeeping and navigation, faster internet speeds, and advances in fundamental physics research.
Sarah Henderson

19th Annual NICE Conference and Expo 2028-06-05
The NICE Conference and Expo will take place June 5-7, 2028. Location to be announced. This event is supported by the National Initiative for Cybersecurity Education (NICE), a program of the National Institute of Standards and Technology in the U.S
Susana Barraza
18th Annual NICE Conference and Expo 2027-06-07
The NICE Conference and Expo will take place June 7-9, 2027. Location to be announced. This event is supported by the National Initiative for Cybersecurity Education (NICE), a program of the National Institute of Standards and Technology in the U.S
Susana Barraza
17th Annual NICE Conference and Expo 2026-06-01
The NICE Conference and Expo will take place June 1-3, 2026. Location to be announced. This event is supported by the National Initiative for Cybersecurity Education (NICE), a program of the National Institute of Standards and Technology in the U.S
Susana Barraza
11th Annual NICE K12 Cybersecurity Education Conference 2025-12-08
The next NICE K12 Cybersecurity Education Conference will take place December 8-9, 2025 in Nashville, Tennessee. This event is supported by NICE, a program of the National Institute of Standards and Technology in the U.S. Department of Commerce
Susana Barraza
72 Volume Metrology Seminar 2025-09-22
The 5-day OWM Volume Metrology Seminar is designed to enable metrologists to apply fundamental measurement concepts to volume calibrations. A large percentage of time is spent on hands-on measurements, applying procedures and equations discussed in
Yvonne A. Branden
73 Fundamentals of Metrology 2025-09-15
Course Description The 5-day Fundamentals of Metrology seminar is an intensive course that introduces participants to the concepts of measurement systems, units, good laboratory practices, data integrity, measurement uncertainty, measurement
Yvonne A. Branden
75 Contract Review 2025-08-14
This two-hour webinar will consider internal auditing techniques and best practices used by a metrology laboratory to comply with ISO/IEC 17025:2017 criteria. Learning Objectives At the end of this session, using your notes and ISO/IEC 17025:2017 or
Yvonne A. Branden
2053 Advanced Mass Seminar 2025-07-28
The 9-day, hands-on Advanced Mass calibration seminar focuses on the comprehension and application of the advanced mass dissemination procedures, the equations, and associated calculations. It includes the operation of the laboratory equipment
Yvonne A. Branden
76 State Laboratory Annual Submission Process 2025-07-10
The State Laboratory Annual Submission Process webinar provides guidance on how to successfully submit all required materials to develop a complete and timely Recognition Application according to NIST Handbook (HB) 143, State Weights and Measures
Yvonne A. Branden
77 Software Verification and Validation Part I & II 2025-06-26
Session I (June 26, 2025) and Session II (July 17, 2025) These two 2-hour sessions on Software Verification and Validation will focus on the use of Microsoft Excel in calibration laboratories and examine the ISO/IEC 17025:2017 requirements related to
Yvonne A. Branden
5x5: The Public Safety Innovation Summit 2025-06-03
REGISTER NOW 5x5 ― the confirmation of a strong and clear signal ― and the place to make your voice heard and drive public safety communications forward. In 2025, the FirstNet Authority and the National Institute of Standards and Technology’s Public
Crissy Robinson
78 Combined Regional Measurement Assurance Program (C-RMAP) 2025-06-01
NIST Handbook 143, Section 5.2, Table 2 notes that annual attendance at the RMAP training session is required for ongoing laboratory Recognition of State weights and measures metrology staff. Handbook 143, Program Handbook details the criteria used
Yvonne A. Branden
16th Annual NICE Conference and Expo 2025-06-01
The NICE Conference and Expo will take place June 1-3, 2025. Location to be announced. This event is supported by the National Initiative for Cybersecurity Education (NICE), a program of the National Institute of Standards and Technology in the U.S
Susana Barraza
79 Internal Auditing Best Practices 2025-05-15
This 2-hour webinar will consider internal auditing techniques and best practices that are used by a metrology laboratory to comply with ISO/IEC 17025:2017 criteria. Learning Objectives During this webinar, using your notes and ISO/IEC 17025:2017 or
Yvonne A. Branden
80 Fundamentals of Metrology - SIM Participants Only 2025-04-14
Course Description The 5-day Fundamentals of Metrology seminar is an intensive course that introduces participants to the concepts of measurement systems, units, good laboratory practices, data integrity, measurement uncertainty, measurement
Yvonne A. Branden
81 Fundamentals of Metrology 2025-04-07
Course Description The 5-day Fundamentals of Metrology seminar is an intensive course that introduces participants to the concepts of measurement systems, units, good laboratory practices, data integrity, measurement uncertainty, measurement
Yvonne A. Branden
82 Calibration Certificate Evaluation 2025-04-03
This 2-hour webinar will introduce concepts necessary to successfully implement ISO/IEC 17025:2017 compliant calibration certificates within the laboratory and evaluate service provider certificates for compliance. Learning Objectives At the end of
Yvonne A. Branden
International Face and Fingerprint Performance Conference (IFPC) 2025 2025-04-01
NIST is pleased to announce the IFPC 2025, which is focused on all technical factors affecting the deployment and use of high performance face recognition applications, including applications, standards, risk management, quality assessment
Mei Lee Ngan
AI and Flow Cytometry Workshop 2025-03-26
The joint NIST–FDA–NIAID workshop aims to advance AI/ML applications in flow cytometry and related data. The workshop will focus on overcoming challenges and identifying solutions including essential measurements, reference controls, AI-ready
William Brad O'Dell
Cell Characterization Standardization Workshop 2025-03-25
This workshop aims to address challenges and opportunities for the fit-for-purpose design and standardization of assays used in the characterization of cells (e.g. viability assays, cell count measurements, and functional assays). The discussion will
William Brad O'Dell

Hitachi Energy SDM600 2024-12-19
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable from adjacent network Vendor: Hitachi Energy Equipment: SDM600 Vulnerabilities: Origin Validation Error, Incorrect Authorization 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges and access sensitive information. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Hitachi Energy reports that the following […]
CISA
Hitachi Energy RTU500 series CMU 2024-12-19
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Hitachi Energy Equipment: RTU500 series CMU Vulnerability: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Hitachi […]
CISA
Delta Electronics DTM Soft 2024-12-19
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DTM Soft Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Delta Electronics products are affected: DTM Soft: Versions […]
CISA
Siemens User Management Component 2024-12-19
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity […]
CISA
Tibbo AggreGate Network Manager 2024-12-19
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Tibbo Equipment: AggreGate Network Manager Vulnerability: Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve code execution on the affected device. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following […]
CISA
Schneider Electric Accutech Manager 2024-12-19
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Accutech Manager Vulnerability: Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation could allow an attacker to cause a crash of the Accutech Manager when receiving a specially crafted request over port 2536/TCP. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS […]
CISA
Schneider Electric Modicon Controllers 2024-12-19
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Modicon Controllers Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a victim's browser to run arbitrary JavaScript when visiting a page containing injected payload. 3. TECHNICAL DETAILS 3.1 AFFECTED […]
CISA
Hitachi Energy TropOS Devices Series 1400/2400/6400 2024-12-17
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: TropOS Devices Series 1400/2400/6400 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following products of Hitachi Energy are […]
CISA
Rockwell Automation PowerMonitor 1000 Remote 2024-12-17
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: PowerMonitor 1000 Remote Vulnerabilities: Unprotected Alternate Channel, Heap-based Buffer Overflow, Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to perform edit operations, create admin users, perform factory reset, execute arbitrary code, […]
CISA
Schneider Electric Modicon 2024-12-17
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Modicon M241 / M251 / M258 / LMC058 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to a denial-of-service and a loss of confidentiality and integrity in the controller. 3. TECHNICAL DETAILS […]
CISA
ThreatQuotient ThreatQ Platform 2024-12-17
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: ThreatQuotient Inc. Equipment: ThreatQ Platform Vulnerability: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ThreatQuotient ThreatQ Platform, are affected: ThreatQ […]
CISA
Siemens RUGGEDCOM ROX II 2024-12-12
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Exploitable remotely/low attack complexity […]
CISA
Siemens Engineering Platforms 2024-12-12
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.0 ATTENTION: Low attack complexity Vendor: […]
CISA
Siemens Engineering Platforms 2024-12-12
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low Attack Complexity Vendor: […]
CISA
Siemens Parasolid 2024-12-12
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.3 ATTENTION: Low attack complexity Vendor: […]
CISA
Siemens CPCI85 Central Processing/Communication 2024-12-12
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.1 ATTENTION: Low attack complexity Vendor: […]
CISA
Siemens Solid Edge SE2024 2024-12-12
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.3 ATTENTION: Low attack complexity Vendor: […]
CISA
Siemens COMOS 2024-12-12
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.9 ATTENTION: Low Attack Complexity Vendor: […]
CISA
Siemens Teamcenter Visualization 2024-12-12
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.3 ATTENTION: Low Attack Complexity Vendor: […]
CISA
Siemens SENTRON Powercenter 1000 2024-12-12
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.9 ATTENTION: Exploitable from adjacent […]
CISA

Ossur Mobile Logic Application 2024-12-19
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.6 ATTENTION: Low attack complexity Vendor: Ossur Equipment: Mobile Logic Application Vulnerabilities: Exposure of Sensitive System Information to an Unauthorized Control Sphere, Command Injection, Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker unauthorized access to sensitive information. 3. TECHNICAL DETAILS […]
CISA
BD Diagnostic Solutions Products 2024-12-17
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Low attack complexity Vendor: Becton, Dickinson and Company (BD) Equipment: Diagnostic Solutions Products Vulnerability: Use of Default Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to use default credentials to access, modify, or delete sensitive data, which could impact the availability […]
CISA
Baxter Life2000 Ventilation System 2024-11-14
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Baxter Equipment: Life2000 Ventilation System Vulnerabilities: Cleartext Transmission of Sensitive Information, Improper Restriction of Excessive Authentication Attempts, Use of Hard-Coded Credentials, Improper Physical Access Control, Download of Code Without Integrity Check, On-Chip Debug and Test Interface With Improper Access Control, Missing […]
CISA
BPL Medical Technologies PWS-01-BT and BPL Be Well Android Application 2024-09-10
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.1 ATTENTION: Low attack complexity/public exploits are available Vendor: BPL Medical Technologies Equipment: PWS-01-BT, Be Well Android App Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to intercept and modify information as it being processed 3. TECHNICAL DETAILS […]
CISA
Baxter Connex Health Portal 2024-09-05
View CSAF 1. EXECUTIVE SUMMARY CVSS v3.1 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Baxter Equipment: Connex Health Portal Vulnerabilities: SQL Injection, Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead to malicious code injection, shutdown of database service, or the ability to access, modify, or delete sensitive data from the […]
CISA
Philips Vue PACS (Update A) 2024-07-18
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.0 ATTENTION: Low attack complexity Vendor: Philips Equipment: Vue PACS Vulnerabilities: Allocation of Resources Without Limits or Throttling, Use of Default Credentials 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to gain access to the database, which could impact system availability and data integrity […]
CISA
MicroDicom DICOM Viewer 2024-06-11
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: MicroDicom Equipment: DICOM Viewer Vulnerabilities: Improper Authorization in Handler for Custom URL Scheme, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to both retrieve and plant medical image files on a victim's system and […]
CISA
Baxter Welch Allyn Connex Spot Monitor 2024-05-30
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.1 ATTENTION: Exploitable remotely Vendor: Baxter Equipment: Welch Allyn Connex Spot Monitor (CSM) Vulnerability: Use of Default Cryptographic Key 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to modify device configuration and firmware data. Tampering with this data could lead to device compromise, resulting […]
CISA
Baxter Welch Allyn Configuration Tool 2024-05-30
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.4 ATTENTION: Exploitable remotely Vendor: Baxter Equipment: Welch Allyn Configuration Tool Vulnerability: Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to the unintended exposure of credentials to unauthorized users. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Baxter (formerly Hillrom and Welch Allyn) […]
CISA
Santesoft Sante FFT Imaging 2024-03-05
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Santesoft Equipment: Sante FFT Imaging Vulnerability: Out-of-Bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local attacker to execute arbitrary code once a user opens a malicious DCM file on affected FFT Imaging installations. 3. TECHNICAL DETAILS 3.1 […]
CISA
MicroDicom DICOM Viewer 2024-02-29
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: MicroDicom Equipment: DICOM Viewer Vulnerabilities: Heap-based Buffer Overflow, Out-of-Bounds Write 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause memory corruption issues leading to execution of arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions […]
CISA
Santesoft Sante DICOM Viewer Pro 2024-02-27
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Santesoft Equipment: Sante DICOM Viewer Pro Vulnerability: Out-of-Bounds Read 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to disclose information and execute arbitrary code on affected installations of the product. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following […]
CISA
Orthanc Osimis DICOM Web Viewer 2024-01-23
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Orthanc Equipment: Osimis Web Viewer Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code inside the victim's browser. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Osimis Web […]
CISA
BD FACSChorus 2023-11-28
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.4 ATTENTION: Low attack complexity Vendor: Becton, Dickinson and Company (BD) Equipment: FACSChorus Vulnerabilities: Missing Protection Mechanism for Alternate Hardware Interface, Missing Authentication for Critical Function, Improper Authentication, Use of Hard-coded Credentials, Insecure Inherited Permissions, 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker with […]
CISA
Santesoft Sante FFT Imaging 2023-10-11
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Santesoft Equipment: Sante FFT Imaging Vulnerability: Out-of-Bounds Read 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to disclose information and execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Santesof products are affected: Sante FFT Imaging: […]
CISA
Santesoft Sante DICOM Viewer Pro 2023-10-11
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Santesoft Equipment: Sante DICOM Viewer Pro Vulnerabilities: Out-of-bounds Write, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose information and execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Santesoft products are […]
CISA
Softneta MedDream PACS 2023-09-05
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Softneta Equipment: MedDream PACS Vulnerabilities: Exposed Dangerous Method or Function, Plaintext Storage of a Password 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to obtain and leak plaintext credentials or remotely execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED […]
CISA
BD Alaris System with Guardrails Suite MX (Update A) 2023-07-13
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Low attack complexity Vendor: Becton, Dickinson and Company (BD) Equipment: Alaris PCU, Guardrails Editor, Systems Manager, Calculation Services, CQI Reporter Vulnerabilities: Insufficient Verification of Data Authenticity, Missing Authentication for Critical Function, Improper Verification of Cryptographic Signature, Missing Support for Integrity Check, Cross-site Scripting, Cleartext Transmission of […]
CISA
Medtronic Paceart Optima System 2023-06-29
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Medtronic Equipment: Paceart Optima System Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could result in remote code execution or a denial-of-service condition impacting a healthcare delivery organization’s Paceart Optima system. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The […]
CISA
Illumina Universal Copy Service 2023-04-27
1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Illumina Equipment: Universal Copy Service (UCS) Vulnerabilities: Binding to an Unrestricted IP Address, Execution with Unnecessary Privileges 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to take any action at the operating system level. A threat actor could impact settings, configurations, software, or […]
CISA

LockBit Developer Rostislav Panev Charged for Billions in Global Ransomware Damages 2024-12-21
A dual Russian and Israeli national has been charged in the United States for allegedly being the developer of the now-defunct LockBit ransomware-as-a-service (RaaS) operation since its inception in or around 2019 through at least February 2024. Rostislav Panev, 51, was arrested in Israel earlier this August and is currently awaiting extradition, the U.S. Department […]
Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware 2024-12-20
The Lazarus Group, an infamous threat actor linked to the Democratic People's Republic of Korea (DPRK), has been observed leveraging a "complex infection chain" targeting at least two employees belonging to an unnamed nuclear-related organization within the span of one month in January 2024. The attacks, which culminated in the deployment of a new modular […]
Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack 2024-12-20
The developers of Rspack have revealed that two of their npm packages, @rspack/core and @rspack/cli, were compromised in a software supply chain attack that allowed a malicious actor to publish malicious versions to the official package registry with cryptocurrency mining malware. Following the discovery, versions 1.1.7 of both libraries have been unpublished from the npm […]
Sophos Issues Hotfixes for Critical Firewall Flaws: Update to Prevent Exploitation 2024-12-20
Sophos has released hotfixes to address three security flaws in Sophos Firewall products that could be exploited to achieve remote code execution and allow privileged system access under certain conditions. Of the three, two are rated Critical in severity. There is currently no evidence that the shortcomings have been exploited in the wild. The list […]
Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools 2024-12-20
A now-patched critical security flaw impacting Fortinet FortiClient EMS is being exploited by malicious actors as part of a cyber campaign that installed remote desktop software such as AnyDesk and ScreenConnect. The vulnerability in question is CVE-2023-48788 (CVSS score: 9.3), an SQL injection bug that allows attackers to execute unauthorized code or commands by sending […]
CISA Adds Critical Flaw in BeyondTrust Software to Exploited Vulnerabilities List 2024-12-20
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2024-12356 (CVSS score: 9.8), is a command injection flaw that
Thousands Download Malicious npm Libraries Impersonating Legitimate Tools 2024-12-19
Threat actors have been observed uploading malicious typosquats of legitimate npm packages such as typescript-eslint and @types/node that have racked up thousands of downloads on the package registry. The counterfeit versions, named @typescript_eslinter/eslint and types-node, are engineered to download a trojan and retrieve second-stage payloads, respectively. "While typosquatting attacks are
Juniper Warns of Mirai Botnet Targeting SSR Devices with Default Passwords 2024-12-19
Juniper Networks is warning that Session Smart Router (SSR) products with default passwords are being targeted as part of a malicious campaign that deploys the Mirai botnet malware. The company said it's issuing the advisory after "several customers" reported anomalous behavior on their Session Smart Network (SSN) platforms on December 11, 2024. "These systems have […]
Fortinet Warns of Critical FortiWLM Flaw That Could Lead to Admin Access Exploits 2024-12-19
Fortinet has issued an advisory for a now-patched critical security flaw impacting Wireless LAN Manager (FortiWLM) that could lead to disclosure of sensitive information. The vulnerability, tracked as CVE-2023-34990, carries a CVSS score of 9.6 out of a maximum of 10.0. It was originally fixed by Fortinet back in September 2023, but without a CVE […]
CISA Mandates Cloud Security for Federal Agencies by 2025 Under Binding Directive 25-01 2024-12-19
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 25-01, ordering federal civilian agencies to secure their cloud environments and abide by Secure Cloud Business Applications (SCuBA) secure configuration baselines. "Recent cybersecurity incidents highlight the significant risks posed by misconfigurations and weak security controls,
Dutch DPA Fines Netflix €4.75 Million for GDPR Violations Over Data Transparency 2024-12-19
The Dutch Data Protection Authority (DPA) on Wednesday fined video on-demand streaming service Netflix €4.75 million ($4.93 million) for not giving consumers enough information about how it used their data between 2018 and 2020. An investigation launched by the DPA in 2019 found that the tech giant did not inform customers clearly enough in its […]
UAC-0125 Abuses Cloudflare Workers to Distribute Malware Disguised as Army+ App 2024-12-19
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed that a threat actor it tracks as UAC-0125 is leveraging Cloudflare Workers service to trick military personnel in the country into downloading malware disguised as Army+, a mobile app that was introduced by the Ministry of Defence back in August 2024 in an effort to […]
HubPhish Abuses HubSpot Tools to Target 20,000 European Users for Credential Theft 2024-12-18
Cybersecurity researchers have disclosed a new phishing campaign that has targeted European companies with an aim to harvest account credentials and take control of the victims' Microsoft Azure cloud infrastructure. The campaign has been codenamed HubPhish by Palo Alto Networks Unit 42 owing to the abuse of HubSpot tools in the attack chain. Targets include […]
Patch Alert: Critical Apache Struts Flaw Found, Exploitation Attempts Detected 2024-12-18
Threat actors are attempting to exploit a recently disclosed security flaw impacting Apache Struts that could pave the way for remote code execution. The issue, tracked as CVE-2024-53677, carries a CVSS score of 9.5 out of 10.0, indicating critical severity. The vulnerability shares similarities with another critical bug the project maintainers addressed in December 2023 […]
Not Your Old ActiveState: Introducing our End-to-End OS Platform 2024-12-18
Having been at ActiveState for nearly eight years, I’ve seen many iterations of our product. However, one thing has stayed true over the years: Our commitment to the open source community and companies using open source in their code. ActiveState has been helping enterprises manage open source for over a decade. In the early days, […]
APT29 Hackers Target High-Value Victims Using Rogue RDP Servers and PyRDP 2024-12-18
The Russia-linked APT29 threat actor has been observed repurposing a legitimate red teaming attack methodology as part of cyber attacks leveraging malicious Remote Desktop Protocol (RDP) configuration files. The activity, which has targeted governments and armed forces, think tanks, academic researchers, and Ukrainian entities, entails adopting a "rogue RDP" technique that was previously
ONLY Cynet Delivers 100% Protection and 100% Detection Visibility in the 2024 MITRE ATT&CK Evaluation 2024-12-18
Across small-to-medium enterprises (SMEs) and managed service providers (MSPs), the top priority for cybersecurity leaders is to keep IT environments up and running. To guard against cyber threats and prevent data breaches, it’s vital to understand the current cybersecurity vendor landscape and continually assess the effectiveness of available solutions. Luckily, the 2024 MITRE ATT&CK
BeyondTrust Issues Urgent Patch for Critical Vulnerability in PRA and RS Products 2024-12-18
BeyondTrust has disclosed details of a critical security flaw in Privileged Remote Access (PRA) and Remote Support (RS) products that could potentially lead to the execution of arbitrary commands. Privileged Remote Access controls, manages, and audits privileged accounts and credentials, offering zero trust access to on-premises and cloud resources by internal, external, and third-party users.
INTERPOL Pushes for "Romance Baiting" to Replace "Pig Butchering" in Scam Discourse 2024-12-18
INTERPOL is calling for a linguistic shift that aims to put to an end to the term "pig butchering," instead advocating for the use of "romance baiting" to refer to online scams where victims are duped into investing in bogus cryptocurrency schemes under the pretext of a romantic relationship. "The term 'pig butchering' dehumanizes and […]
Meta Fined €251 Million for 2018 Data Breach Impacting 29 Million Accounts 2024-12-18
Meta Platforms, the parent company of Facebook, Instagram, WhatsApp, and Threads, has been fined €251 million (around $263 million) for a 2018 data breach that impacted millions of users in the bloc, in what's the latest financial hit the company has taken for flouting stringent privacy laws. The Irish Data Protection Commission (DPC) said the […]

Heurist.org

Menu

Search our Website

Blogs – Security

Blogs - Security

NIST News

NIST Events

CISA Blog

CISA Blog

ICS Advisories

ICS Medical Advisories

Unknown Feed

The Hacker News