CVE-2020-0549

A microarchitectural timing flaw was found on some Intel processors. A corner case exists where data in-flight during the eviction process can end up in the “fill buffers” and not properly cleared by the MDS mitigations. The fill buffer contents which were expected to be blank can be inferred usi...

The vulnerability of the Enterprise Resource Management System “Galaktika ERP” allows a perpetrator to execute arbitrary codes.

The vulnerability of the “Update Manager” component of the enterprise resource management system Galaktika ERP is related to the lack of protection for transmitted data. Exploiting this vulnerability allows a malicious actor, who operates remotely and has access to the update server, to execute...

More on Law Enforcement Backdoor Demands

The Carnegie Endowment for International Peace and Princeton University's Center for Information Technology Policy convened an Encryption Working Group to attempt progress on the "going dark" debate. They have released their report: "Moving the Encryption Policy Conversation Forward. The main...

CVE-2019-3751

Dell EMC Enterprise Copy Data Management eCDM versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and...

Input validation

Dell EMC Enterprise Copy Data Management eCDM versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and...

CVE-2019-3751

Dell EMC Enterprise Copy Data Management eCDM versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and...

Moderate severity vulnerability that affects com.rabbitmq:amqp-client and org.springframework.amqp:spring-amqp

Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I'm speaking at Data in Smarter Cities in New York City on October 23, 2018. I'm speaking at the Cyber Security Summit in Minneapolis, Minnesota on October 24, 2018. I'm speaking at ISF's 29th Annual World Congress in Las Vegas,...

CVE-2018-11087

Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit...

The vulnerability of the Data-in-Motion process of the Cisco IOx software platform allows a malicious actor to execute arbitrary code with root privileges.

The vulnerability of the Data-in-Motion process of the Cisco IOx software platform arises from operations that occur outside the buffer boundaries on the stack inadequate checking of buffer boundaries during the registration of the DMo process. Exploiting this vulnerability allows a malicious...

Static Versus Dynamic Data Masking

Most participants in the trench warfare of IT security agree that the best way to protect data is to apply a layered approach to security. Data masking is a security and privacy enhancing technology recommended by industry analysts as a must-have data protection layer. While terminology varies...

Cisco Patches Critical IOx Vulnerability

Cisco Systems patched a critical vulnerability Wednesday that could allow an unauthenticated, remote attacker to execute remote code on affected hardware and gain root privileges. The bug is in Cisco’s Data-in-Motion DMo process, part of the company’s IOx application environment that marries its...

Cisco IOx Data in Motion Stack Overflow Vulnerability

A vulnerability in the Data-in-Motion DMo process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device...

CVE-2017-3853

A vulnerability in the Data-in-Motion DMo process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device. The...

Cisco IOx Data in Motion Stack Overflow Vulnerability

A vulnerability in the Data-in-Motion DMo process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device. The...

CVE-2016-6409

The Data in Motion DMo component in Cisco IOS 15.61T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of service out-of-bounds access via crafted traffic, aka Bug ID CSCuy54015...

Cisco IOS and IOS XE Software Data in Motion Denial of Service Vulnerability

Cisco IOS and IOS XE are operating systems developed by Cisco for its network devices. Cisco IOS version 15.61T and IOS XE Software DMo component denial of service vulnerability. An attacker can exploit this vulnerability to cause a denial of service out-of-bounds access by sending a specially...

Cisco IOS Software Data in Motion Component Denial of Service Vulnerability (cisco-sa-20160921-dmo)

A vulnerability in the Cisco Data in Motion DMo component for Cisco IOS Software with the IOx feature set could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition for the DMo process on a targeted system. SPDX-FileCopyrightText: 2016 Greenbone AG Some tex...

Cisco IOS and IOS XE Software Data in Motion Component Denial of Service Vulnerability

A vulnerability in the Cisco Data in Motion DMo component for Cisco IOS and IOS XE Software with the IOx feature set could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition for the DMo process on a targeted system. The vulnerability is due to insufficien...

Cisco IOS and IOS XE Data in Motion Denial of Service Vulnerability

Cisco IOS and IOS XE are both operating systems developed by Cisco for its network equipment.Data in Motion DMo application is one of the dynamic data update tools. A security vulnerability exists in the DMo application in Cisco IOS version 15.61T and IOS XE. When the IOx feature setting is...