Proposed U.S. Wassenaar Rules on Intrusion Software

Two things worth noting from yesterday’s unveiling of the Bureau of Industry and Security’s proposed Wassenaar rules for the U.S. that weren’t so overt: a The U.S. generally leads the way in implementing Wassenaar changes, and this time it’s been beaten by the EU by almost 18 months; and b reques...

Understanding the Shared Security Model in Amazon Web Services

Security in the Amazon EC2 environment is a responsibility shared by both the end user and Amazon. This is because within this environment there are specific parts that Amazon has control of and specific parts that are controlled by the end user. For the end user, they are responsible for securin...

IBM Optim Workload Replay Security Bypass Vulnerability

IBM InfoSphere Optim Workload Replay is an IBM solution for replaying real database production activities and providing reports on the impact of changes and identifying problems quickly. A security vulnerability exists in IBM Optim Workload Replay. The vulnerability allows an attacker to bypass...

Researchers Wary of Wassenaar Arrangement Proposed Rules

Professional security researchers concerned about proposed changes to the Computer Fraud and Abuse Act CFAA that include stiff penalties for what today is considered legitimate offensive research, are worried about another impending punch to the gut. The Commerce Department’s Bureau of Industry a...

Microsoft Visual Basic VBE6.DLL Stack Memory Corruption (MS10-031) - Ver2 (CVE-2010-0815)

Microsoft Visual Basic VBA is a technology for developing client desktop packaged applications and integrating them with existing data and systems. Microsoft Office products include VBA and make use of VBA to perform certain functions. A remote code execution vulnerability has been reported in th...

ICBC Internet banking assistant and other security controls was traced to the presence of the“disaster-level”vulnerability-vulnerability warning-the black bar safety net

Recently, ICBC Internet banking assistant and other security controls was traced to the presence of the“disaster-level”vulnerability, the vulnerability can cause remote arbitrary code execution on the user computer, security caused great harm. Baidu security prompts the user as soon as possible o...

Green Alliance: the online banking security controls remote code execution vulnerability analysis V1. 2-vulnerability warning-the black bar safety net

5 on 1 1 December, nsfocus Threat Response Center reported the storm clouds announcement, ICBC security controls can lead to remote arbitrary code execution vulnerability, Tick-2 0 1 5-9 6 3 3 9, and considering the Internet financial current there are more security issues, and taking into accoun...

Disaster has a vulnerability Warning: Do not accidentally turn on the God mode-bug warning-the black bar safety net

Generally speaking the Bank's security controls is to protect the computer, but this time it is for everyone to disastrous security issuesTick-2 0 1 5-0 9 6 3 3 9. the What it does In IE, there is a"safe mode", by default it must be turned on, but you installed certain banks the control they will...

WordPress CartPress Plugin Zero Day Disclosure

Another round of WordPress vulnerability disclosures has taken place with details made public on a handful of unpatched bugs in the CartPress ecommerce plugin. These disclosures come on the heels of a separate disclosure of a zero-day in the WordPress core engine. Those vulnerabilities have since...

Privacy Goal: More Controls in Users' Hands

SAN FRANCISCO – The same companies that brought, among other things, facial recognition into your living rooms and the ability to record video to your eyewear, swear the next big thing in privacy is putting more controls in your hand. The privacy officers of Microsoft, Google and Facebook said...

[SECURITY] Fedora 22 Update: jenkins-script-security-plugin-1.13-2.fc22

This plugin allows Jenkins administrators to control what in-process scripts can be run by less-privileged users...

Profile Builder < 2.1.4 - Missing Access Controls

The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Missing Access Controls security vulnerability...

Johnson Controls Metasys Information Disclosure Vulnerability

Johnson Controls Metasys is a building automation system from Johnson Controls. The system can be networked with weak electronic systems such as fire and security through a variety of open protocols or standard interfaces to provide system integrity for secure access. An information disclosure...

Johnson Controls Metasys Unlimited File Upload Vulnerability

Johnson Controls Metasys is a building automation system from Johnson Controls. The system can be networked with weak electronic systems such as fire and security through a variety of open protocols or standard interfaces to provide system integrity for secure access. An unrestricted file upload...

HP Integrated Lights-Out Security Bypass Vulnerability

HP Integrated Lights-Out 2, 3, and 4 iLO 2, iLO 3, and iLO 4 is an embedded server management technology from Hewlett-Packard HP in the United States that monitors and maintains server operations, remote control of servers, and more through an integrated remote management port. A security...

CVE-2014-5428

Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration...

CVE-2014-5427

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration Engine NIE 5xxx-x, and NxE8500, allows remote attackers to read passwor...

Cross site request forgery (csrf)

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration Engine NIE 5xxx-x, and NxE8500, allows remote attackers to read passwor...

Unrestricted file upload

Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration...

CVE-2014-5427

CVE-2014-5427 affects Johnson Controls Metasys 4.1–6.5 (ADS, ADX, LCS8520, NAE 55xx-x, NIE 5xxx-x, NxE8500). A remote, unauthenticated attacker can read password hashes via a POST request, exposing credentials and affecting confidentiality. Connected sources indicate multiple advisories and a pat...