CVE-2014-2601

The server in HP Integrated Lights-Out 2 aka iLO 2 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool...

北京安宁创新网络科技有限公司DNS区域传送漏洞

简要描述： 标题是不是侧漏了。。。 详细说明： root@kali: dnsenum anymacro.com dnsenum.pl VERSION:1.2.2 ----- anymacro.com ----- Host's addresses: anymacro.com 86400 IN A 221.192.133.59 Name Servers: ns3.sp6.com 7812 IN A 61.55.135.158 ns7.sp6.com 7812 IN A 116.213.201.189 Mail MX Servers: mail.anymacro.com 85591 IN A...

New NIST AppVet Aims to Streamline Application Security

Apple and Google put developers’ apps through a relatively vigorous screening process before they make their way into their respective app stores. Now developers who produce apps intended for use on internal networks at government agencies can get a vetting process of their own. The National...

Web Application Security Begins with Programming Language

When building an enterprise Web application, the most foundational decision your developers make will be the language in which the app is written. But is there a barometer that measures the security of the programming languages developers have at their disposal, or are comfortable with, versus...

Kvasir - Penetration Testing Data Management Tool

Penetration Testing Data Management can be a nightmware, because well you generate a LOT of data and some information when conducing a penetration test, especially using tools – they return lots of actual and potential vulnerabilitites to review. Port scanners can return thousands of ports for ju...

The OpenSSL high-risk vulnerabilities Heartbleed emotion, analysis and recommendations-vulnerability warning-the black bar safety net

4 May 7, The exposure of the Heartbleed vulnerability number CVE-2 0 1 4-0 1 6 0 has been in the IT field especially in the field of information security caused by the great storm. In security circles mixed more than ten years, don't write something some say however go to. So today on this topic,...

Softer Skills Important to Maturity of Cyber Security Pros

BOSTON – The cynical security wonk wouldn’t necessarily lower himself to use the word “cyber” in an elevator pitch about his profession or day-to-day responsibilities. After all, how would that go over in the Twittersphere, or at an industry conference? At the risk of peer derision, security peop...

PT-2014-19: Multiple Cross-Site Scripting (XSS) vulnerabilities in Wonderware Information Server

The specialists of the Positive Research center have detected multiple Cross-Site Scripting vulnerabilities in Wonderware Information Server. WIS fails to validate, filter, or encode user input before returning it to a user’s web client, which allows remote attackers to inject arbitrary web scrip...

[Skipfish] Web Application Security Scanner

Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active but hopefully non-disruptive...

Honeywell ScanServer ActiveX Control (Update A)

Overview --------- Begin Update A Part 1 of 3 ---------- This ICS-CERT Advisory is an update to ICSA-11-103-01 – Honeywell ScanServer ActiveX Control, which was originally released on April 13, 2011. A security research company, Secunia, has released a report of a use-after-free...

RFP - External Network Vulnerability Assessment & PenTest

Document Title: =============== RFP - External Network Vulnerability Assessment & PenTest References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1225 Download: https://www.vulnerability-lab.com/resources/documents/RFP-BoMPLC-2014.pdf Release Date: ============= 2014-03-13...

RFP - External Network Vulnerability Assessment & PenTest

Document Title: =============== RFP - External Network Vulnerability Assessment & PenTest References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1225 Download: http://www.vulnerability-lab.com/resources/documents/RFP-BoMPLC-2014.pdf Release Date: ============= 2014-03-13...

Assessing risk for the March 2014 security updates

Today we released five security bulletins addressing 23 unique CVE’s. Two bulletins have a maximum severity rating of Critical while the other three have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

PT-2014-55: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in ripsd.exe module in function secGetContext which could lead to possible remote code execution or denial of service. How to fix...

Get vulnerability fuss-vulnerability warning-the black bar safety net

Enterprise network there is often many of the vulnerabilities will reduce IT's security. A survey showed that 9 9% of hacker attacks is the use of unpatched vulnerabilities with the wrong set. There are indications that, since the virus writers increased the attack target targeted, it is...

British Sky Broadcasting Group Cross Site Scripting

. / \ | |/ / / /\ | |\ \ / | \ |/ \ | // / / / Corporation c 2014 Published Report: 25/02/2014 Credits: Advanced Information Security Corporation, USA Severity: Critical Type: Web Application / Reflected Cross-site scripting attack. CVSS: 7.0 , OWASP TOP 10 Author: Nicholas Lemonias. Background...

Cisco Systems Cross Site Scripting

. / \ | |/ / / /\ | |\ \ / | \ |/ \ | // / / / Corporation c 2014 CISCO Systems Inc. Security Report ============================================================ Published Report: 19/02/2014 Credits: Advanced Information Security Corporation, USA Severity: High/Critical OWASP TOP 10 CVSS: 7.0...

[SecLists] Collection of multiple types of lists used during security assessments

SecLists is a collection of multiple types of lists used during security assessments. List types include usernames, passwords, URLs, sensitive data grep strings, fuzzing payloads, and many more. The goal is to enable a security tester to pull this repo onto a new testing box and have access to...

Assessing risk for the February 2014 security updates

Today we released seven security bulletins addressing 31 unique CVE’s. Four bulletins have a maximum severity rating of Critical while the other three have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for you...

Realistic Risk Assessment Key to Security Management

PUNTA CANA – Although it may not be the most thrilling part of a security team’s job, the idea of operational risk assessment and management is perhaps the most important aspect of organizational security. Steve Adegbite, senior vice president in charge of enterprise information security program...