The vulnerability of the Cisco Application Policy Infrastructure Controller, related to deficiencies in access control, allows a perpetrator to gain unauthorized access to the device.

The vulnerability of the Cisco Application Policy Infrastructure Controller, a component of the information infrastructure management system, is related to deficiencies in access control when connecting via IPv6 protocol. Exploiting this vulnerability could allow an attacker acting locally to gai...

5 Docker Security Best Practices to Avoid Breaches

Like with any technology, Docker too has its security concerns. Learn the Docker security best practices that will help keep your infrastructure and applications secure...

An Argument that Cybersecurity Is Basically Okay

Andrew Odlyzko's new essay is worth reading -- "Cybersecurity is not very important": Abstract: There is a rising tide of security breaches. There is an even faster rising tide of hysteria over the ostensible reason for these breaches, namely the deficient state of our information infrastructure...

Intel Releases Security Advisories on Multiple Products

Intel has released security updates and recommendations to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to...

Moderate: Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 13.0 director Bug Fix Advisory

Updated director installer packages that resolve various issues are now available for Red Hat OpenStack Platform 13.0 Queens for RHEL 7. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service IaaS cloud running on...

LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA ELS Files

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: LCDS—Leão Consultoria e Desenvolvimento de Sistemas LTDA ME Equipment: LAquis SCADA Vulnerability: Out-of-Bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could allow remote code execution...

Product update: Virtuozzo Infrastructure Platform 2.5 Update 4 (2.5.0-1614)

This update provides stability and usability fixes. Vulnerability id: VSTOR-14144, VSTOR-20526 Blink button in the admin panel was not working in some cases. Vulnerability id: VSTOR-20197 Unable to create network bonds. Vulnerability id: VSTOR-20232 Disk replacement occasionally does not allow to...

Thoughts on Cloud Security

Recently I've been reading about cloud security and security with respect to DevOps. I'll say more about the excellent book I'm reading, but I had a moment of déjà vu during one section. The book described how cloud security is a big change from enterprise security because it relies less on...

The vulnerability of the Identity Services Engine, a platform for managing network policies, exposes the Cisco Prime Infrastructure monitoring and management system to attacks from insiders. This allows attackers to carry out “man-in-the-middle” type attacks.

The vulnerability of the Identity Services Engine, a platform for managing network policies, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker operating remotely to carry out a “man-in-the-middle” attack...

The vulnerability of the hxterm service component in the high-convergence infrastructure of Cisco HyperFlex allows attackers to enhance their privileges.

The vulnerability of the hxterm service in Cisco HyperFlex hyperconverged infrastructure is related to insufficient authentication control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Quality of Voice Reporting component of the Cisco Prime Collaboration Assurance software solution allows attackers to enhance their privileges.

The vulnerability of the Quality of Voice Reporting component in the highly converged Cisco HyperFlex infrastructure is related to insufficient authentication control. Exploiting this vulnerability can allow attackers operating remotely to enhance their privileges...

Going ATOMIC: Clustering and Associating Attacker Activity at Scale

At FireEye, we work hard to detect, track, and stop attackers. As part of this work, we learn a great deal of information about how various attackers operate, including details about commonly used malware, infrastructure, delivery mechanisms, and other tools and techniques. This knowledge is buil...

F5 Networks Acquires NGINX For $670 Million

One of the most important software companies NGINX, which is also behind the very popular open-source web server of the same name, is being acquired by its rival, F5 Networks, in a deal valued at about $670 million. While NGINX is not a name that you have ever heard of, the reality is that you us...

SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: September 23, 2019

SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: September 23, 2019 Notice This security update was released March 12, 2019 for Windows 7 SP1 and Windows Server 2008 R2 SP1. This security update was updated May 14, 2019 to add support for Windows...

Microsoft Releases March 2019 Security Updates

Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review...

WIBU SYSTEMS AG WibuKey Digital Rights Management (Update B)

1. EXECUTIVE SUMMARY CVSS v3 10.0 --------- Begin Update B Part 1 of 4 --------- ATTENTION: Exploitable remotely/low skill level to exploit/public exploits available Vendor: WIBU-SYSTEMS AG Equipment: WibuKey Digital Rights Management DRM --------- End Update B Part 1 of 4 ---------...

CVE-2019-1690

A vulnerability in the management interface of Cisco Application Policy Infrastructure Controller APIC software could allow an unauthenticated, adjacent attacker to gain unauthorized access on an affected device. The vulnerability is due to a lack of proper access control mechanisms for IPv6...

Cisco Application Policy Infrastructure Controller Access Control Error Vulnerability

Cisco Application Policy Infrastructure Controller APIC is an automated infrastructure deployment and governance solution from Cisco. An access control error vulnerability exists in the management interface in Cisco APIC, which stems from the program's lack of an access control mechanism for IPv6...

Cisco Nexus 9000 Series Switch Matrix Switch Local Command Injection Vulnerability

The Cisco Nexus 9000 Series switches are modular and fixed-port network switches designed for data centers. A Shell Escape vulnerability exists in the software of the Cisco Nexus 9000 Series ACI mode switches. The vulnerability stems from a failure to validate user-supplied input when issuing...

CVE-2019-1591

A vulnerability in a specific CLI command implementation of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escape a restricted shell on an affected device. The vulnerability is due to insufficient sanitization of user-supplied input when issuing a...