Microsoft's New Security Update Guides Get Mixed Reviews

Microsoft is receiving mixed reviews for its shift to delivering security update information via its newly launched Security Update Guides. The change was official in April, with Microsoft explaining it would allow system administrators to effectively pair specific patches with vulnerabilities, a...

Microsoft Internet Explorer Enhanced Protected Mode Sandbox Escape Vulnerability

This vulnerability allows remote attackers to escape the Enhanced Protected Mode EPM sandbox on vulnerable installations of Microsoft Internet Explorer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specif...

Google Android Framework APIs Information Disclosure Vulnerability (CNVD-2017-08229)

Google Android is a Linux-based operating system for smartphone devices. An information disclosure vulnerability exists in the Google Android Framework APIs, which can be exploited by remote attackers to build malicious applications, bypass security protections, and obtain sensitive information...

Google Android Framework APIs elevation of privilege vulnerability (CNVD-2017-08230)

Google Android is a Linux-based operating system for smartphone devices. An elevation of privilege vulnerability exists in the Google Android Framework APIs, which can be exploited by remote attackers to build malicious applications, execute arbitrary code, and elevate privileges...

The State of Mobile App Performance

In our previous blog, we saw how a new generation of users are increasing the expectations of a mobile app like never before and identified the three key success criteria for mobile apps: 1 increase customer conversions, 2 drive installs and 3 increase customer loyalty. For this blog we profiled...

Qualys Support for Reserve Bank of India (RBI) Cyber Security Guidelines

Reserve Bank of India RBI, India's central banking and monetary authority, points out that the number, frequency, and impact of cyber incidents on Indian banks has increased substantially. Like their peers globally, Indian banks are committed to maintaining customer trust, protecting financial...

PT-2017-16512

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 52.1 Firefox versions prior to 53 Description The issue allows for a sandbox escape and escalation of privilege when combined with another vulnerability that results in remote code execution inside the sandboxed...

Fedora 25 : qt5-qtwebengine (2017-ae1fde5fb8)

This update updates QtWebEngine to the 5.8.0 release. QtWebEngine 5.8.0 is part of the Qt 5.8.0 release, but only the QtWebEngine component is included in this update. The update fixes the following security issues in QtWebEngine 5.7.1: CVE-2016-5182, CVE-2016-5183, CVE-2016-5189, CVE-2016-5199,...

apis-cor.com XSS vulnerability

Vulnerable URL: http://apis-cor.com/ajax-search-result.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 131419 VIP website status:| No Check apis-cor.com SSL connection:| Grade: ...

Personalized User Focused Security: Stethoscope

Stethoscope is a web application that collects information from existing device data sources e.g., JAMF or LANDESK on a given user’s devices and gives them clear and specific recommendations for securing their systems. Stethoscope consists of two primary pieces: a Python-based back-end and a...

CVE-2017-3869

An API Credentials Management vulnerability in the APIs for Cisco Prime Infrastructure could allow an authenticated, remote attacker to access an API that should be restricted to a privileged user. The attacker needs to have valid credentials. More Information: CSCuy36192. Known Affected Releases...

Cody Pierce on the Future of Exploit Development

Mike Mimoso talks to Cody Pierce, director of vulnerability research and prevention with Endgame, at RSA Conference 2017 about how attackers are changing their techniques in the face of mitigations and continuing to base exploits around legitimate APIs and functions to thwart detection. Download:...

[SECURITY] Fedora 25 Update: cxf-3.1.6-5.fc25

Apache CXF is an open-source services framework that aids in the development of services using front-end programming APIs, like JAX-WS and JAX-RS...

SonicDICOM PACS 2.3.2 Stored Cross Site Scripting

SonicDICOM PACS 2.3.2 Multiple Stored Cross-Site Scripting Vulnerabilities Vendor: JIUN Corporation Product web page: https://www.sonicdicom.com Affected version: 2.3.2 and 2.3.1 Summary: SonicDICOM is PACS software that combines the capabilities of DICOM Server with web browser based DICOM Viewe...

Google Android Framework APIs elevation of privilege vulnerability (CNVD-2017-01456)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation of privilege vulnerability exists in the Google Android Framework APIs. An attacker can exploit this vulnerability to execute arbitrary code with elevated privileges...

Google Android Framework APIs elevation of privilege vulnerability (CNVD-2017-01457)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation of privilege vulnerability exists in the Google Android Framework APIs. An attacker can exploit this vulnerability to execute arbitrary code with elevated privileges...

CVE-2017-0421

An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application...

CVE-2017-0421

An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application...

CVE-2017-0411

An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally...

CVE-2017-0410

An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally...