Security Bulletin: Security exposure in IBM Cognos Incentive Compensation Management (CVE-2014-0107)

Summary There is a security vulnerability whereby a remote attacker could bypass security restrictions in Apache Xalan-Java within IBM Cognos Incentive Compensation Management 8.x and 7.x. Vulnerability Details CVE IDs: CVE-2014-0107 DESCRIPTION: Apache Xalan-Java could allow a remote attacker to...

CVE-2017-13186

A vulnerability in the Android media framework libavc related to incorrect use of mmco parameters. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65735716...

The Pirate Bay Founders Ordered to Pay Music Labels $477,800 in Compensation

Two of the three co-founders of The Pirate Bay—Fredrik Neij and Gottfrid Svartholm Warg—have been ordered by a Finnish court to pay record labels $477,800 in compensation for copyright infringement on the site. Last year in a similar case, Helsinki District Court in Finland ordered Peter Sunde, t...

Anthem Agrees to Settle 2015 Data Breach for $115 Million

Like many companies hit by data breaches, Anthem, the United States’ largest for-profit health care company, has been forced to watch from the sidelines while the incident plays out in court. An end finally appears to be in sight however. Late Friday the company agreed to settle a series of...

Bug Hunters Prefer Communication Over Compensation

Unlike their criminal counterparts, it turns out that white hats aren’t necessarily as financially motivated when it comes to bug hunting. Bug bounties are everywhere, and many researchers are making a decent amount of money privately disclosing vulnerabilities through coordinated bounty programs...

X.Org libXvMC Memory Corruption Vulnerability

X.Org libXvMC is an Xlib-based client library proprietary to the X-Video Motion Compensation API operated by the X.Org Foundation. A memory corruption vulnerability exists in X.Org libXvMC 1.0.9 and earlier versions, which can be exploited by an attacker to execute arbitrary code and cause a deni...

New Bill Would Grant Lifetime Credit Monitoring to OPM Victims

A group of lawmakers are proposing victims of last month’s expansive Office of Personnel Management hack receive lifetime fraud protection and credit monitoring. Democratic lawmakers on Monday presented the Reducing the Effects of the Cyberattack on OPM Victims Emergency Response, or RECOVER Act...

Adobe Starts Vulnerability Disclosure Program on HackerOne

Update: Adobe is the latest tech vendor to begin a vulnerability disclosure program, but it seems they’re limping in at the outset. The program launched this week on the HackerOne platform, but there are no cash incentives being offered and certain Adobe products are not in scope for researchers...

Court Rules Banks May Proceed with Target Lawsuits

A Minnesota District Court ruling this week related to the 2013 Target data breach has opened the door for banks to pursue damages from retailers victimized by a data breach. Judge Paul A. Magnuson ruled that Target was negligent in ignoring and, in some cases, turning off security features that...

OpenSSH <= 4.3 p1 (Duplicated Block) Remote Denial of Service Exploit

No description provided by source. !/bin/bash OpenSSH CRC compensation attack detection DoS PoC. Tavis Ormandy [email protected] Yes, I really did implement crc-32 in bash. usage: script hostname victim hostname hostname=$1:-localhost port=$2:-22 where the fifo is created to communicate with netc...

SSH 1.2.x CRC-32 Compensation Attack Detector Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2347/info Secure Shell, or SSH, is an encrypted remote access protocol. SSH or code based on SSH is used by many systems all over the world and in a wide variety of commercial applications. An integer-overflow bug in the...

Thousands of DHS Personnel Notified of Data Breach

The Department of Homeland Security this week began notifying up to tens of thousands of employees, contractors and others with a DHS security clearance that their personal data may be at risk. The notifications began on Monday, according to an online statement, after officials learned of a...

Yahoo Sued By User Following Breach of 450,000 Passwords

Internet search conglomerate Yahoo is being sued by one of its users for negligence after the usernames and passwords of approximately 450,000 of its users were leaked by a hacker online last month. According to a complaint .PDF filed earlier this week in a federal court in San Jose, Calif., the...

Another Government contractor - PCS Consultants (USA) got Hacked by #Antisec

Another Government contractor - PCS Consultants USA got Hacked Another Government contractor - PCS Consultants USA got hacked by Anonymous Hackers & Antisec operation Hackers. Database of website has been extracted and leaked on internet via tweeter on Pastebin.The leaked Data extracted Includes...

Banking Fraud Now Almost Exclusively Occurring Online

A new study of small to mid-sized businesses shows that 75% of banking fraud is now taking place online according to a report from InformationWeek. The 2011 Business Banking Trust Study, commissioned by Guardian Analytics and conducted by the Ponemon Institute, found that 56% of the companies in...

Nebraska's Worker Comp Database Hacked

A hacker has broken into the Nebraska Worker’s Compensation database, prompting an FBI investigation and an effort to contact those who may be affected. Several thousand people could be affected by the breach, which was discovered last week when the state’s chief information officer noticed an...

Vulnerability showboating is for amateurs

It’s like one of those magic candles people place on birthday cakes that sparkle and relight themselves each time you think they’ve been blown out. That’s how I’d define the most recent ignition of the “bugs for cash” debate. By now you’ll have probably heard that Dino Dai Zovi, Charlie Miller an...

FreeBSD Security Advisory (FreeBSD-SA-06:22.openssh.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-06:22.openssh.asc SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

FreeBSD Security Advisory (FreeBSD-SA-06:22.openssh.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-06:22.openssh.asc ADV FreeBSD-SA-06:22.openssh.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008...

Debian Security Advisory DSA 086-1 (ssh-nonfree, ssh-socks)

The remote host is missing an update to ssh-nonfree, ssh-socks announced via advisory DSA 086-1. OpenVAS Vulnerability Test $Id: deb0861.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 086-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...