CVE-2017-3622

A local privilege escalation vulnerability exists in the Common Desktop Environment (CDE) component of Oracle Sun Solaris 10 (specifically versions prior to 10u11 ). The root cause is a directory traversal vulnerability in the dtappgather binary caused by improper handling of user-supplied argume...

CVE-2017-3590

CVE-2017-3590 affects Oracle MySQL Connector/Python (Connector/Python subcomponent). The vulnerability exists in MySQL Connectors until version 2.1.5 and earlier. It is a local, low-privilege issue (attack vector: local) with no UI interaction required, allowing a low-privileged attacker with log...

ShadowBrokers Expose NSA Access to SWIFT Service Bureaus

The NSA used exploits to target two SWIFT Service Bureaus in order to access banking data from a number of financial institutions in the Middle East. The access was likely used to monitor funding for terrorist operations, experts said today as analysis continues of the latest ShadowBrokers dump o...

CVE-2017-3242

CVE-2017-3242 affects Oracle VM Server for Sparc (LDOM Manager subcomponent). Affected: 3.2 and 3.4. Vulnerability allows a low-privileged user with logon to the infrastructure to compromise the server; successful attacks require user interaction and may cause a hang or frequent crashes (partial/...

CVE-2017-3291

CVE-2017-3291 affects the MySQL Server packaging component in Oracle MySQL. Affected are: 5.5.53 and earlier, 5.6.34 and earlier, and 5.7.16 and earlier. The entry describes a difficult-to-exploit vulnerability that requires logon to the infrastructure where MySQL Server executes and user interac...

LocalTapiola: SQL Injection on /webApp/lapsuudenturva (viestinta.lahitapiola.fi)

Issue The reporter found a blind SQL Injection attack in an application in viestinta.lahitapiola.fi. Fix The issue was investigated and found to be valid. The fix was to remove the application as it was not needed. Reasoning The reported case was valid and within the scope of the bug bounty...

CVE-2016-4046

Open-Xchange OX App Suite (before 7.8.1-rev11) is affected by CVE-2016-4046. The API used to configure external mail accounts can be abused to map and access network components within the operator’s trust boundary; attackers can inject arbitrary hosts and ports into API calls, enabling informatio...

Oracle JD Edwards EnterpriseOne Tools Enterprise Infrastructure SEC Component Denial of Service Vulnerability (CNVD-2016-00687)

Oracle JD Edwards EnterpriseOne is a fully integrated enterprise resource planning software suite that combines business value, standards-based technology and deep industry experience into a low TCO business solution. An unspecified security vulnerability in the Oracle JD Edwards EnterpriseOne...

Oracle JD Edwards EnterpriseOne Tools Enterprise Infrastructure SEC Component Denial of Service Vulnerability (CNVD-2016-00688)

Oracle JD Edwards EnterpriseOne is a fully integrated enterprise resource planning software suite that combines business value, standards-based technology and deep industry experience into a low TCO business solution. An unspecified security vulnerability in the Oracle JD Edwards EnterpriseOne...

Mobile Application Security - Main Issues & Vulnerabilities

Document Title: =============== Mobile Application Security - Main Issues & Vulnerabilities References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1647 Download: https://www.vulnerability-lab.com/resources/documents/1647.pdf Vulnerability Magazine:...

Facebook Opens ThreatExchange Information Sharing Platform

Facebook, with its giant infrastructure and its equally wide view into Internet attacks, has built an information-sharing platform that it hopes will entice other big technology companies to join and contribute threat data and indicators of compromise. The platform, called ThreatExchange, already...

Cloud application security: preventing security vulnerabilities-vulnerability warning-the black bar safety net

Currently, cloud-based applications are widely used, and with amazing speed growing. Since cloud-based applications can be accessed through the Internet, and anyone, anywhere can access – therefore, application security becomes particularly important. This is why the creation and management of...

Experts Worry About Future of Critical Infrastructure Security

SAN FRANCISCO–The problem of critical infrastructure security has become a key issue in the last few years, as high-profile attacks such as Stuxnet and others have grabbed headlines and alerted politicians and others to the weaknesses facing these vital systems. It’s an issue that Eugene Kaspersk...

Data Sharing, Cooperation Key to Critical Infrastructure Security

WASHINGTON–The topic of critical infrastructure security may be the prettiest girl at the dance right now for both politicians and technology companies, but the problem of attackers going after these targets is one that security people have been dealing with for some time. But that doesn’t mean...

Brad Arkin Named Adobe CSO

Adobe has named Brad Arkin to the newly created position of CSO, a major expansion of responsibilities for Arkin, who has been leading the company’s product security and privacy initiatives. Adobe has been in the security spotlight for several years now, as attackers have focused their attention ...

CALL FOR PAPERS - The Hackers Conference 2013

The call for papers for The Hackers Conference 2013 is now open. THC2013 is a hacker conference taking place in New Delhi, India on August 25th, 2013. The Hackers Conference is an unique event, where the best of minds in the hacking world, leaders in the information security industry and the cybe...

Shodan Search Engine Project Enumerates Internet-Facing Critical Infrastructure Devices

Never underestimate what you can do with a healthy list of advanced operator search terms and a beer budget. That’s mostly what comprises the arsenal of two critical infrastructure protection specialists who have spent close to nine months trying to paint a picture of the number of Internet-facin...

New FERC Cybersecurity Office Has Lofty Oversight and Outreach Goals

When it comes to cybersecurity and critical infrastructure, there are generally more questions than answers. And for the last 10 months or so, the volume of concern and uncertainty has ramped up, largely because there’s little in the way of productive information sharing on threats, a serious lac...

Free Configuration Check Tool by eEye Digital Security

Free Configuration Check Tool by eEye Digital Security eEye Digital Security, the industry's leading innovator of threat management solutions, just released new research, "Working Toward Configuration Best Practices" . Findings verify that proper configuration and mitigations remain the most...

Radware's Attack Mitigation System Delivers the First Fully Integrated Solution to Fight Cyber Attacks in Real Time

Radware's Attack Mitigation System Delivers the First Fully Integrated Solution to Fight Cyber Attacks in Real Time The solution blocks the new breed of sophisticated attacks that target Multiple layers of the IT infrastructure . Today's point security tools for IT infrastructures are not enough ...