Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters the id parameter to ADMIN/mailqueue.spl.
Monthly Archives: July 2015
CVE-2015-5454
Cross-site scripting (XSS) vulnerability in Nucleus CMS 3.65 allows remote attackers to inject arbitrary web script or HTML via the title parameter when adding a new item.
CVE-2015-5455
Cross-site scripting (XSS) vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/.
CVE-2015-5456
Cross-site scripting (XSS) vulnerability in the form method in modules/formclass.php in PivotX before 2.3.11 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO, related to the “PHP_SELF” variable and form actions.
CVE-2015-5457
PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, which allows remote attackers to execute arbitrary code by uploading a crafted file, as demonstrated by a file named foo.php.php.
CVE-2015-5458
Session fixation vulnerability in fileupload.php in PivotX before 2.3.11 allows remote attackers to hijack web sessions via the sess parameter.
CVE-2015-5459
SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc.
Cradlepoint MBR 1200 / 1400 Local File Inclusion
Cradlepoint MBR versions 1200 and 1400 suffer from a local file inclusion vulnerability.
Hacking Team Flash Zero Day Weaponized in Exploit Kits
Three exploit kits–Angler, Nuclear Pack and Neutrino–have already weaponized the Adobe Flash Player zero day found among the data stolen from Hacking Team.
Fire Department drone warning: if you fly, we can’t.
In the United States, California as well as parts of the Midwest and Southwest are experiencing some of the worst drought conditions on record and facing severe wildfire risks. An as of early this week, ABC World News reported that more than 50 major wildfires were estimated to be burning in the US.
At the same time, ABC’s local San Francisco affiliate also was reporting on the promise of drones using regular and infrared cameras to assist in fighting wildfires.
A Wired article earlier in June reported on the promise of “Fighting Forest Fires before they get Big –with Drones’. “The idea,” Wired wrote, “is to enable early location and identification of fires using drones, planes, and satellites mounted with special infrared cameras. The system, called Fire Urgency Estimator in Geosynchronous Orbit (Fuego), could help spot new wildfires anywhere in the Western US barely three minutes after they start. The promise of Fuego is the ability to pinpoint fires more quickly and for firefighters to get to the fire more quickly and put it out faster.
Increasingly, drones and unmanned flying vehicles are becoming a popular tool in fire departments for assisting in assessing fires of all types, and using the technology in this manner totally make sense…
But there is other news about drones and forest fires that is equally concerning, even chilling: In late June, a drone flying in illegal airspace forced fire crews near Los Angeles to divert their air drops, allowing a fire in the Big Bear Lake area.
As reported in the LA Times, a ground commander saw a drone at approximately 11,000 feet up (way above the FAA’s 400 feet regulation) and this forced an air tanker and two smaller planes to turn away from their strategic drops. The tanker diverted and dropped its retardant on a fire near the Nevada border, and the two smaller planes had to jettison their drops so that they could land with a safe weight. As the planes returned to their base, they saw another drone, this one flying nearly three times above the 400-foot limit.
“These folks who are handling these drones, I have to assume they have no idea what they’re doing,” said Chon Bribiescas, a spokesman for the U.S. Forest Service. “They not only endangered the folks on the ground, but they endanger the pilots.”
All in all, the forced pullback the LA firefighters had to do last week was a missed opportunity to control the fire. Subsequent missions had to be scrubbed as well and officials said that the private drones definitely allowed the fire to grow.
This isn’t the first time that fire fighters have had problems with drones – there were incidents in Oregon, Washington state, Northern California and Idaho last year.
Compounding the “What were they thinking?” factor, these drone operators had to be operating from the ground near an unpredictable fire, not to mention that a fire zone is restricted airspace to begin with.
The Bureau of Land Management (BLM) has released multiple statements warning operators that “Temporary Flight Restrictions (TFRs) are typically put in place during wildfires that require most aircraft, manned or unmanned, other than those engaged in wildfire suppression operations to obtain permission from fire managers to enter specified airspace.”
The Forest Service has put up red signs that state succinctly: “If you fly, we can’t.” Enough said.
Meanwhile, the FAA is expected to issue new rules governing drone aircraft operation in the near future, though drone-flying incidents like these are already illegal. Certainly the drone operators involved in these forest fire incidents aren’t doing the growing drone industry and their fellow operators any favors.
Title image courtesy of CBS News
![]()
![]()