Security Bulletin: A vulnerability in the GSKit component of IBM Rational RequisitePro (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of Rational RequisitePro. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to...

Security Bulletin: Vulnerabilities in unzip affect IBM Security Network Protection (CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, and CVE-2014-9636 )

Summary The unzip utility is used to list, test, or extract files from a zip archive. Security vulnerabilities have been discovered in unzip used with IBM Security Network Protection. Vulnerability Details CVE ID: CVE-2014-8139 DESCRIPTION: Info-ZIP UnZip is vulnerable to a heap-based buffer...

Security Bulletin: Multiple IBM InfoSphere Information Server components are affected by a vulnerability in the XML4C parser (CVE-2014-8901)

Summary Multiple components of IBM InfoSphere Information Server may be affected by a denial of service attack triggered by a specially crafted XML document being parsed by the XML4C parser. Vulnerability Details CVEID: CVE-2014-8901 DESCRIPTION: IBM XML4J and XML4C contains a denial of service...

Security Bulletin: Microsoft Windows MHTML Cross Site Scripting Alteration vulnerability in GDS component of IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-0968)

Summary IBM® InfoSphere® Master Data Management - Collaborative Edition is vulnerable to cross-site scripting that is caused by improper validation of user-supplied input. A remote attacker can use a specially crafted URL to run scripts in a victim's web browser within the security context of the...

Security Bulletin: Link Injection vulnerability in GDS component of IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-0970)

Summary Link Injection vulnerabilities can allow an attacker to embed links URLs to an external site or to different pages forms within IBM® InfoSphere® Master Data Management - Collaborative Edition. The links can appear to be valid application links. Clicking a link might cause the user to...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Cognos Controller (CVE-2015-3195)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by IBM Cognos Controller. IBM Cognos Controller has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3195 DESCRIPTION: OpenSSL could allow a remote attacker to obtain...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Controller (CVE-2015-0488, CVE-2015-0478, CVE-2015-2808, CVE-2015-1916)

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 6 and IBM Runtime Environment Java Technology Edition, Version 7 that is used by IBM Cognos Controller. These issues were disclosed as part of the IBM Java SDK updates in April 2015. Vulnerabili...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Cognos Controller (CVE-2015-0209, CVE-2015-0286, CVE-2015-0289)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM Cognos Controller. IBM Cognos Controller has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0209 DESCRIPTION: OpenSSL could allow a remote attacker to execute...

Threat Outbreak Alert RuleID32553: Email Messages Distributing Malicious Software on April 24, 2018

Medium Alert ID: 57570 First Published: 2018 April 24 18:27 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32553 may contain the following files: Name | Si...

Dropbox: User Impersonation - Create Support Ticket With Any Registered Account Email

This report described a method to make support tickets look as if they came from another email address. Normally this would present a problem, however our customer support representatives will first verify the user's email address before taking any action or disclosing any information about a...

IMPORTANT: Web blocking / RAM usage announcement

On January 27, we published a protection update that caused connection issues for many of our customers. As a side effect of the web protection blocks, the product also spiked memory usage and possibly caused a crash. We have triaged this issue and pushed a protection update that resolves it. For...

How to enable storage-specific API logging

Need to collect storage-specific API logging by Veeam Customer Support request...

Dell Lost Control of Key Customer Support Domain for a Month in 2017

A Web site set up by PC maker Dell Inc. to help customers recover from malicious software and other computer maladies may have been hijacked for a few weeks this summer by people who specialize in deploying said malware, KrebsOnSecurity has learned. There is a program installed on virtually all...

CVE-2017-15265

A use-after-free vulnerability was found when issuing an ioctl to a sound device. This could allow a user to exploit a race condition and create memory corruption or possibly privilege escalation. Mitigation It is possible to prevent the affected code from being loaded by blacklisting the kernel...

Faulty Firmware Auto-Update Breaks Hundreds of 'Smart Locks'

More features, more problems! Today, we are living in a digital age that is creating a digital headache for people by connecting every other unnecessary home appliance to the Internet. Last week, nearly hundreds of Internet-connected locks became inoperable after a faulty software update hit some...

Siemens Viewport for Web Office Portal

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: Viewport for Web Office Portal Vulnerability: Improper Authentication AFFECTED PRODUCTS Siemens reports that the vulnerability affects the following ViewPort for Web Office Portal products: ViewPort...

“Customer Support formula Scam” fresh out of the oven, Microsoft recommends that users timely update-vulnerability warning-the black bar safety net

On the Internet, a variety of fishing and malware advertising scams is increasing, which is a well-known type of Scam is the“Customer Support formula Scam（Tech Support Scam”, and the main way to convince the user to believe their computer problems, and requests you to jump the page to“fix”the...

Cisco Patches Authentication Bypass in Cisco Prime Home

Cisco has patched a critical vulnerability in its Cisco Prime Home remote management software used by service providers to oversee and provision subscribers’ home devices. The flaw, found by Cisco engineers, is in the product’s web-based GUI and allows remote attackers to bypass authentication an...

Starbucks: Stored XSS in Adress Book (starbucks.com/account/profile)

Hello, I just found a stored XSS in the "Adress book menu" of a user's profile : https://www.starbucks.com/account/profile Description : XSS is happening due to the lack of filtering on the Address.FirstName parameter when you POST a new address on the URL :...

Threat Outbreak Alert RuleID24739: Email Messages Distributing Malicious Software on August 31, 2016

Medium Alert ID: 48697 First Published: 2016 September 1 13:23 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24739 may contain the following files: Name |...