CVE-2019-1659

A vulnerability in the Identity Services Engine ISE integration feature of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer SSL tunnel established between ISE and PI. The vulnerability is due to...

CVE-2019-1659

A vulnerability in the Identity Services Engine ISE integration feature of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer SSL tunnel established between ISE and PI. The vulnerability is due to...

CVE-2019-1659

CVE-2019-1659 describes a certificate-validation flaw in the Cisco Prime Infrastructure (PI) SSL tunnel when the PI server is integrated with Identity Services Engine (ISE). The issue arises from improper validation of the server SSL certificate, enabling an unauthenticated, remote attacker to pe...

CVE-2019-1659 Cisco Prime Infrastructure Certificate Validation Vulnerability

A vulnerability in the Identity Services Engine ISE integration feature of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer SSL tunnel established between ISE and PI. The vulnerability is due to...

CVE-2019-1659 Cisco Prime Infrastructure Certificate Validation Vulnerability

A vulnerability in the Identity Services Engine ISE integration feature of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer SSL tunnel established between ISE and PI. The vulnerability is due to...

Cisco Prime Infrastructure SSL Certificate Validation Security Bypass Vulnerability

Cisco Prime Infrastructure is a network management tool that supports full lifecycle management of the entire network infrastructure from a single graphical interface. An SSL certificate validation security bypass vulnerability exists in the Identity Services Engine ISE integration feature of Cis...

Cisco Prime Infrastructure Certificate Validation Vulnerability

A vulnerability in the Identity Services Engine ISE integration feature of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer SSL tunnel established between ISE and PI. The vulnerability is due to...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (cisco-sa-20190123-cpi-xss)

The Cisco Prime Infrastructure application running on the remote host is affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a...

Kernel update: Virtuozzo ReadyKernel patch 73.1 for all supported Virtuozzo kernels and that of Virtuozzo Infrastructure Platform 2.5

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to all supported Virtuozzo kernels and that of Virtuozzo Infrastructure Platform 2.5. NOTE: No more patches are planned for kernel 3.10.0-514.26.1.vz7.33.22, support for which ends with this update...

Ryuk, Exploring the Human Connection

ARCHIVED STORY Ryuk, Exploring the Human Connection By John Fokker · Febraury 19, 2019 In collaboration with Bill Siegel and Alex Holdtman from Coveware At the beginning of 2019, McAfee ATR published an article describing how the hasty attribution of Ryuk ransomware to North Korea was missing the...

Delta Industrial Automation CNCSoft

1. EXECUTIVE SUMMARY CVSS v3 4.4 ATTENTION: Low skill level to exploit Vendor: Delta Electronics Delta Equipment: Delta Industrial Automation CNCSoft Vulnerability: Out-of-bounds Read 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a buffer overflow condition that may...

When Cyberattacks Pack a Physical Punch

More than one in 10 data breaches now involve “physical actions,” according to a recent report. These include leveraging physical devices to aid an attack, but also hacks that involve breaking into hardware and remote attacks on physical infrastructure. The stat underscores the realities of a...

Who should protect you from Cyber Threats?

The world is becoming increasingly dependent on information technologies. 1. Government. More and more states provide digital services for their citizens and rely complex information systems. 2. Business. There are no more companies that do not have IT infrastructure on-premises or cloud. IT...

Attackers Completely Destroy VFEmail's Secure Mail Infrastructure

A catastrophic, smash-and-destroy cyberattack has eliminated the U.S. infrastructure for secure email service VFEmail. It’s a rare example of a purely destructive offensive, apparently unmotivated by financial gain or espionage goals. An attacker wiped out the company’s U.S. servers on Monday...

Attacking Containers and runC

This week a new vulnerability was published CVE-2019-5736 that highlights everything bad and good about containers. Simply put, this vulnerability can be exploited using an infected container to attack the host. It’s a real world example of a breakout attack that has long been a major concern in...

Cisco Prime Infrastructure swimtemp TFTP Arbitrary File Upload (CVE-2018-15379)

An arbitrary file upload vulnerability exists in Cisco Prime Infrastructure. The vulnerability is due to the presence of a symbolic link permitting the upload of files into a location where they can be later executed. Successful exploitation could result in the execution of arbitrary code in the...

Why the US Needs a Strategy for AI

Opinion: With its American AI Initiative, the White House is devoting funding, research, and data infrastructure to boosting our prowess in artificial intelligence...

Compromising vital infrastructure: communication

Have you ever been witness to a Wi-Fi failure in a household with school-aged children? If so, I don’t have to convince you that communication qualifies as vital infrastructure. For the doubters: when you see people risking their lives in traffic just to check their phone, you'll understand why...

The vulnerability in the web interface of the Cisco Prime Infrastructure software management tool allows a hacker to inject arbitrary code into the uploaded web page.

The vulnerability in the web interface of the Cisco Prime Infrastructure network lifecycle management software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the loaded web pag...

Assess Vulnerabilities, Misconfigurations in AWS Golden AMI Pipelines

Today we’re starting a blog series focused on how to integrate Qualys solutions into DevSecOps for securing cloud infrastructures. In this initial post, we’ll discuss the importance of assessing vulnerabilities and misconfigurations on AWS pipelines. When developing golden Amazon Machine Images...