CVE-2018-3287

CVE-2018-3287 affects Oracle VM VirtualBox

Zabbix Threat Control - Zabbix Vulnerability Assessment Plugin

This plugin transforms your Zabbix monitoring system into vulnerability, risk and security managment system for your infrastructure. What the plugin does It provides Zabbix with information about vulnerabilities existing in your entire infrastructure and suggests easily applicable remediation...

UBUNTU-CVE-2018-1080

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules authz.evaluateOrder=allow,deny, then allow rules will...

CVE-2018-2773

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where...

CVE-2018-2831

CVE-2018-2831 is a vulnerability in the Oracle VM VirtualBox Core component affecting VirtualBox releases prior to 5.1.36 and prior to 5.2.10 . The issue allows a low-privilege attacker with logon to the host to read a subset of VirtualBox data, per the vulnerability description. Public sources i...

Intel Halts Spectre Fixes On Older Chips, Citing Limited Ecosystem Support

Intel has halted patches for an array of older chips that would protect them against the Spectre vulnerability, according to a recent microcode update. The microcode update shows that its older products – including Wolfdale, Bloomfield, Clarksfield, Gulftown, Harpertown, Jasper Forest, SoFIA 3GR,...

RDaaS Security: How to Apply Database Audit and Monitoring Controls

As you move databases to cloud database platforms, data security and compliance requirements move along with it. This article explains how you can apply database audit and monitoring controls when migrating your database to cloud services, including the following: Introduction to RDaaS Benefits o...

Wallarm Podcast: Security Challenges of 2017 and Predictions for 2018

Right before Christmas, we have invited several security professionals to a roundtable event where we discussed how AI is affecting cybersecurity landscape. While we had them on as panelists, we have asked Richard Seiersen, Bill Chen and Sean Todd to share their views on the biggest security...

CVE-2018-2693

CVE-2018-2693 affects the Oracle VM VirtualBox component (Guest Additions). Vulnerable on versions prior to 5.1.32 and prior to 5.2.6. An attacker with local logon and minimal user interaction can exploit this vulnerability to compromise VirtualBox, with potential takeover of the VirtualBox envir...

AWS infrastructure Security Auditing: Cloud Security Suite

CS Suite is a one stop tool for auditing the security posture of the AWS infrastructure and does system audits as well. CS Suite leverages current open source tools capabilities and has other missing checks added into one tool to rule them all. The major features include: Simple installation with...

CVE-2017-10407

CVE-2017-10407 affects Oracle VM VirtualBox Core (subcomponent) prior to 5.1.30. A local attacker with logon can exploit this flaw to partially access and modify data, or cause a complete denial of service via hangs/crashes, with potential unauthorized read access to some data. Several connected ...

CVE-2017-3588

CVE-2017-3588 affects the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: HA for MySQL). Affected versions are 3.3 and 4.3. The vulnerability allows an unauthenticated attacker with logon to the infrastructure where Solaris Cluster executes to compromise Solaris Clus...

CEOs Resign from Trump's Cybersecurity Commission

Eight members of the National Infrastructure Advisory Council resigned last week, citing inadequate attention by the Trump Administration to address growing cybersecurity threats facing the United States. President Donald Trump’s Administration has “given insufficient attention to the the growing...

CVE-2017-10003

Affected software: Oracle Solaris (Solaris 10 on x86 and SPARC). Component: Network Services Library of the Sun Systems Products Suite. Root cause / vulnerability detail: Local vulnerability that allows a low-privileged user with logon to the Solaris host to access or modify Solaris data (unautho...

CVE-2017-10129

CVE-2017-10129 affects Oracle VM VirtualBox 5.1.x prior to 5.1.24. The issue is in kernel-mode image loading, where Windows caches a mapped image (ImageSectionObject) and desynchronization between on-disk file verification and what is actually mapped can occur (TOCTOU race). A bypass was possible...

Katyusha Scanner — Telegram-based Fully Automated SQL Injection Tool

A new powerful hacking tool recently introduced in an underground forum is making rounds these days, allowing anyone to rapidly conduct website scans for SQL injection flaws on a massive scale — all controlled from a smartphone using the Telegram messaging application. Dubbed Katyusha Scanner, th...

June 30, 2017 – Morning Cyber Coffee Headlines – “Victor Hugo” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! June 30, 2017 - Headlines Carbon Black in the News: Carbon Black Seizes The...

Enterprise Security: EAA Exceeds Compliance Standards

I sat down again with John Payne, Akamai's Chief Architect of Infrastructure and Security, as well as Keith Hillis, Director IT Risk & Security. We spoke about enterprise security compliance, and how Enterprise Application Access EAA exceeds Akamai's requirements and simplifies the process for...

Challenges with Critical Infrastructure: IoT, Smart Cities Under Attack

Internet of Things technology is now more widespread than many people realize. Systems that fall under the IoT umbrella are popping up in an array of settings, even outside consumer circles. Today, every group from enterprise businesses to city governments is utilizing intelligent, internet- and...

Vulnerability subscriptions in terms of business

The question is: do we really need an employee in organization that deals with vulnerabilities in infrastructure on a full-time basis? Since this is similar to what I do for living, I would naturally say that yes, it is necessary. But as person, who makes security automation, I can say that there...