How do cyber insurer's assess cyber risk?

Last week I presented on risk transfer as a viable risk management option to compliance and security professionals at the Financial Crime Compliance Professionals Conference in London. As mentioned in one of Ricks earlier blog entries analyzing the Target kill chain, the communication between...

SAP NetWeaver AS Java - XXE

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java Vendor URL: http://www.sap.com Bugs: XXE Reported: 16.06.2014 Vendor response: 17.06.2014 Date of Public Advisory: 17.10.2014 Reference: SAP Security Note 2045176 Authors: Vahagn Vardanyan ERPScan Description SAP XML pars...

SAP NetWeaver AS Java CIM UPLOAD - XXE

Application: SAP NetWeaver AS Java Vendor URL: http://www.sap.com Bugs: XML External Entity Reported: 16.06.2014 Vendor response: 17.06.2014 Date of Public Advisory: 18.05.2015 Reference: SAP Security Note 2090851 Authors: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XML External...

SAP Mobile Platform - XXE

Application: Mobile Platform Vendor URL: http://www.sap.com Bugs: XML External Entity Reported: 06.11.2014 Vendor response: 07.11.2014 Date of Public Advisory: 15.02.2015 Reference: SAP Security Note 2125358 Authors: Dmitry Chastukhin ERPScan VULNERABILITY INFORMATION Class: XML External Entity...

SAP Management Console ReadProfile Parameters - Information disclosure

Application: SAP NetWeaver 7.40 Vendor URL: http://www.sap.com Bugs: Information disclosure Reported: 06.11.2014 Vendor response: 07.11.2014 Date of Public Advisory: 15.03.2015 Reference: SAP Security Note 2091768 Authors: Dmitry Chastukhin ERPScan VULNERABILITY INFORMATION Class: Information...

Assessing risk for the June 2014 security updates

Today we released seven security bulletins addressing 66 unique CVE’s. Two bulletins have a maximum severity rating of Critical while the other five have a maximum severity rating of Important. This table is designed to help you prioritize the deployment of updates appropriately for your...

CVE-2014-0936

IBM Security AppScan Source 8.0 through 9.0, when the publish-assessment permission is not properly restricted for the configured database server, transmits cleartext assessment data, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-0936

CVE-2014-0936 affects IBM Security AppScan Source 8.0–9.0. The issue is a misconfigured publish-assessment permission on the configured database server, which allows the transmission of cleartext assessment data and may enable remote attackers to obtain sensitive information by sniffing the netwo...

CVE-2014-0936

IBM Security AppScan Source 8.0 through 9.0, when the publish-assessment permission is not properly restricted for the configured database server, transmits cleartext assessment data, which allows remote attackers to obtain sensitive information by sniffing the network...

HP Operations Manager i (OMi) 9.1 / 9.2 RCE

The HP Operations Manager i OMi installed on the remote host is version 9.1 or 9.2. It is, therefore, affected by an unspecified code execution vulnerability that allows an authenticated, remote attacker to execute arbitrary code by leveraging the OMi operator role. C Tenable Network Security, In...

Executive Agencies Pass on New Cybersecurity Regulations

Three Executive Branch federal agencies crucial to critical infrastructure protection will be allowed to continue to voluntarily assess cyber risk, rather than force the development and implementation of additional regulations. The White House yesterday released its conclusions as they relate to...

CVE-2013-1668

The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file. Recent assessments: wchen-r7 at September 12, 2019 6:08pm UTC reported: In fact, doesn’t seem like the user shoul...

CVE-2014-2989

Cross-site request forgery CSRF vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add...

Assessing risk for the May 2014 security updates

Today we released eight security bulletins addressing 13 unique CVE’s. Two bulletins have a maximum severity rating of Critical while the other six have a maximum severity rating of Important. The table is designed to help you prioritize the deployment of updates appropriately for your environmen...

Regulators Planning Cybersecurity Assessments for Banks

A government agency in charge of developing standards for the nation’s banks announced last week that it will work harder to try to identify vulnerabilities in smaller community banks and that it’s planning to better raise awareness when it comes to cyber threats. The Federal Financial Institutio...

Сross-Site Request Forgery (CSRF) in TAO

Advisory ID: HTB23211 Product: TAO Vendor: Open Assessment Technologies S.A. Vulnerable Versions: 2.5.6 and probably prior Tested Version: 2.5.6 Advisory Publication: April 16, 2014 without technical details Vendor Notification: April 16, 2014 Public Disclosure: May 7, 2014 Vulnerability Type:...

RAWR - Rapid Assessment of Web Resources

Introducing RAWR Rapid Assessment of Web Resources. There’s a lot packed in this tool that will help you get a better grasp of the threat landscape that is your client’s web resources. It has been tested from extremely large network environments, down to 5 node networks. It has been fine-tuned to...

CVE-2014-2601

The server in HP Integrated Lights-Out 2 aka iLO 2 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool...

CVE-2014-2601

The server in HP Integrated Lights-Out 2 aka iLO 2 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool...