IPv6 unmasking via UPnP

Martin Zeiser and Aleksandar Nikolich authored this post. Executive summary With tools such as ZMap and Masscan and general higher bandwidth availability, exhaustive internet-wide scans of full IPv4 address space have become the norm after it was once impractical. Projects like Shodan and Scans.i...

OSINT-SPY - Search using OSINT (Open Source Intelligence)

Performs OSINT scan on email/domain/ipaddress/organization using OSINT-SPY. It can be used by Data Miners, Infosec Researchers, Penetration Testers and cyber crime investigator in order to find deep information about their target. OSINT-SPY Documentation beta File Name : README Author : @sksecuri...

Security Bulletin: IBM Systems Director (ISD) is affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450, and CVE-2013-6449)

Summary : IBM Systems Director contains a version of openssl that contained the 3 vulnerabilities listed above. Vulnerability Details Abstract IBM Systems Director contains a version of openssl that contained the 3 vulnerabilities listed above. Content Vulnerability Details: CVE-ID: CVE-2013-4353...

Security Bulletin: IBM Flex System Manager (FSM) and compatible IBM Systems Director agents are affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450, and CVE-2013-6449)

Summary An interface on the IBM BladeCenter Advanced Management Module AMM may expose user account names and passwords that have been configured on that AMM. Vulnerability Details Abstract The FSM and compatible agents contain a version of openssl that contained the 3 vulnerabilities listed above...

Streamworks Job Scheduler Release 7 Authentication Weakness

Affected Products Streamworks Job Scheduler Release 7 older/newer releases have not been tested References Secuvera-SA-2016-01 https://www.secuvera.de/advisories/secuvera-SA-2016-01.txt used for updates No CVE number could be assigned vendor not listed under...

EU Offers Bug Bounties For 14 Open Source Projects

The European Commission in January is funding 14 bug bounty programs in hopes of sniffing out vulnerabilities in the free open source projects that EU institutions rely on. The bug bounty programs span 14 open source software projects and offers a total of almost $1 million for all bounties...

Which Threats had the Most Impact During the First Half of 2018?

One of the best ways for organizations to shore up their data security efforts and work toward more proactive protection is by examining trends within the threat environment. Taking a look at the strategies for attack, infiltration and infection currently being utilized by hackers can point towar...

ThreatList: Biggest Attack Targets

DO NOT SET LIVE The biggest verticals targeted by hackers in 2018, so far, are Education, Retail, Biotechnology, Construction, and Nonprofit Organizations. According to researchers at eSentire, attackers zeroed in on exploit attempts against the Education vertical, targeting consumer-grade router...

Security Bulletin: IBM Worklight is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL might allow a remote attacker to obtain sensitive information, which is caused by an error in the TLS/DTLS heartbeat functionality. An attacker might exploit this...

Security Bulletin: OpenSSL Heartbleed Vulnerability and Impact to Algo and OpenPages Products

Abstract The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privac...

Security Bulletin: IBM® MessageSight™ & TLS Heartbleed (CVE-2014-0160)

Summary How the TLS Heartbleed security vulnerability applies to IBM® MessageSight™. Vulnerability Details CVE ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploi...

Security Bulletin: Tivoli Netcool Service Quality Manager is affected by the WebSphere Application Server vulnerability (CVE-2014-0964)

Summary There is a potential denial of service with Tivoli Netcool Service Quality Manager when running a Heartbleed scanning tool. Vulnerability Details CVE ID: CVE-2014-0964 DESCRIPTION: IBM WebSphere Application Server is not vulnerable to the Heartbleed vulnerability CVE-2014-0160 where secur...

Security Bulletin: Denial of Service with WebSphere Application Server affecting IBM Tivoli Security Policy Manager. (CVE-2014-0964)

Summary There is a potential denial of service with WebSphere Application Server versions 6.0.2 and 6.1. These affected versions of WebSphere Application Server are supported for use with IBM Tivoli Security Policy Manager. Vulnerability Details CVEID: CVE-2014-0964 DESCRIPTION: There is a...

Security Bulletin: Denial of Service with WebSphere Application Server affecting IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway (CVE-2014-0964)

Summary There is a potential denial of service with WebSphere Application Server versions 6.0.2 and 6.1. These affected versions of WebSphere Application Server are supported for use with IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway. Vulnerabili...

Security Bulletin: Some versions of IBM Security Access Manager for Web are affected by the Heartbleed vulnerability (CVE-2014-0160)

Summary IBM Security Access Manager ISAM for Web v8.0 introduced a layer 7 front end load balancer. The SSL framework used by this component exposes the 'heartbeat' TLS extension implemented through an affected version of OpenSSL and is therefore susceptible to the Heartbleed vulnerability...

Security Bulletin: OpenSSL Heartbleed Vulnerability

Summary OpenSSL Heartbleed Vulnerability OpenSSL 1.0.1 through 1.0.1f inclusive are vulnerable Vulnerability Details What is OpenSSL Heartbleed The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information...

Uber: ubernycmarketplace.com is vulnerable to the Heartbleed Bug

The Heartbleed Bug was a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. This allows attackers to eavesdrop on communications, stea...

Internet Bug Bounty: GarlicRust - heartbleed style vulnerability in major I2P C++ router implementations

Brief ----- I2pd and kovri are both C++ I2P routers that share the same code base, as kovri was forked from i2pd several years ago. The vulnerability lies in a common code piece, making both implementations vulnerable, as was acknowledged by orignal, the main developer of i2pd. The vulnerability ...

Search Engine For Hackers: OSINT SPY

Performs OSINT scan on email/domain/ipaddress/organization using OSINT-SPY. It can be used by Data Miners, Infosec Researchers, Penetration Testers and cyber crime investigator in order to find deep information about their target. It includes gathering data from various public sources and their...

Problems of Vulnerability Prioritization and Detection

It’s the third part of our talk with Daniil Svetlov at his radio show “Safe Environment” recorded 29.03.2017. In this part we talk about Vulnerability Prioritization and Detection: Common Vulnerability Scoring System CVSS Environmental factor Manual and automated vulnerability detection...