DUHK Attack Lets Hackers Recover Encryption Key Used in VPNs & Web Sessions

DUHK — Don't Use Hard-coded Keys — is a new 'non-trivial' cryptographic implementation vulnerability that could allow attackers to recover encryption keys that secure VPN connections and web browsing sessions. DUHK is the third crypto-related vulnerability reported this month after KRACK Wi-Fi...

CVE-2017-10415

Vulnerability in the Oracle iSupport component of Oracle E-Business Suite subcomponent: Others. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP...

CVE-2017-10351

Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products subcomponent: Application Server. Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where...

CVE-2017-10280

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Test Framework. Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

Buffer overflow

Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications subcomponent: BaseMasterPage. The supported version that is affected is 9.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2017-10344

Summary: CVE-2017-10344 affects the Oracle Hospitality Simphony component (Oracle Hospitality Applications), specifically the Import/Export subcomponent. Affected versions are 2.8 and 2.9. The vulnerability could allow an unauthenticated attacker, with network access via HTTP, to compromise Simph...

CVE-2017-10263

CVE-2017-10263 affects Oracle Siebel CRM’s Siebel UI Framework (subcomponent: UIF Open UI) with affected versions 16.0 and 17.0. The connected documents confirm an unauthenticated, network-accessible vulnerability over HTTP that requires user interaction and can lead to unauthorized data access a...

CVE-2017-10427

Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications subcomponent: Point of Sale. Supported versions that are affected are 6.0.11, 6.5.11, 7.0.6, 7.1.6 and 15.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access...

CVE-2017-10268

CVE-2017-10268 affects Oracle MySQL Server (Server: Replication) with affected versions 5.5.57 and earlier, 5.6.37 and earlier, and 5.7.19 and earlier. The vulnerability allows a high-privilege attacker with logon to the infrastructure where MySQL Server executes to compromise the server, potenti...

CVE-2017-10331

CVE-2017-10331 affects Oracle E-Business Suite’s Oracle Application Object Library (Diagnostics). Affects 12.1.3 and 12.2.x releases up to 12.2.7. The vulnerability allows an unauthenticated attacker with network access via HTTP to read a subset of Oracle AOL data. Root cause and specific exploit...

CVE-2017-10316

CVE-2017-10316 affects Oracle Hospitality Suite8 (WebConnect) within Oracle Hospitality Applications. Affected versions are 8.10.1 and 8.10.2. The issue enables a low-privilege attacker with network access over HTTP to compromise Suite8 and may lead to unauthorized access to critical data or full...

CVE-2017-10351

The vulnerability CVE-2017-10351 affects Oracle PeopleSoft Enterprise PT PeopleTools, specifically the Application Server subcomponent, with affected versions 8.54, 8.55 and 8.56. Underlying issue allows an unauthenticated attacker who has login access to the infrastructure hosting PeopleSoft PT ...

CVE-2017-10055

Vulnerability in the Oracle iPlanet Web Server component of Oracle Fusion Middleware subcomponent: Admin Graphical User Interface. The supported version that is affected is 7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

October 19, 2017 – Morning Cyber Coffee Headlines – “NCAA Football” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 19, 2017 - Headlines Carbon Black in the News: Did you hear about the...

Recent Wi-Fi KRACK Vulnerability Affects Almost Everyone With an Endpoint

A vulnerability might allow cyber criminals to intercept data being transmitted between Wi-Fi access points and endpoints, recent research has uncovered. The vulnerability, known as KRACK, short for Key Reinstallation Attacks, affects WPA2, which is widely used by many Wi-Fi enabled devices and c...

Oracle Patches 250 Bugs in Quarterly Critical Patch Update

Oracle patched 250 vulnerabilities across hundreds of different products as part of its quarterly Critical Patch Update released today. Rounding out the list of products with the most patches is Oracle Fusion Middleware with 38, Oracle Hospitality Applications with 37 and Oracle MySQL with 25. Of...

IC3 Issues Alert on IoT Devices

In conjunction with National Cyber Security Awareness Month, the Internet Crime Complaint Center IC3 has issued an alert to individuals and businesses about the security risks involved with the Internet of Things IoT. IoT refers to the emerging network of devices e.g., smart TVs, home automation...

KRACK Demo: Critical Key Reinstallation Attack Against Widely-Used WPA2 Wi-Fi Protocol

Do you think your wireless network is secure because you're using WPA2 encryption? If yes, think again! Security researchers have discovered several key management vulnerabilities in the core of Wi-Fi Protected Access II WPA2 protocol that could allow an attacker to hack into your Wi-Fi network a...

Equifax Credit Assistance Site Served Spyware

Big-three consumer credit bureau Equifax says it has removed third-party code from its credit report assistance Web site that prompted visitors to download spyware disguised as an update for Adobe's Flash Player software. Image: Randy-abrams.blogspot.com On Wednesday, security expert and blogger...

Hyatt Hotels Suffers 2nd Card Breach in 2 Years

Hyatt Corp. is alerting customers about another credit card breach at some hotels, the second major incident with the hospitality chain in as many years. Hyatt said its cyber security team discovered signs of unauthorized access to payment card information from cards manually entered or swiped at...