The vulnerability of the Cisco Prime Infrastructure network lifecycle management software allows a hacker to gain access beyond their privileges.

The vulnerability of the Credentials Management software interface in the Cisco Prime Infrastructure network lifecycle management software is related to errors in managing registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access beyond their...

Harley Geiger on Cybersecurity Policy

Harley Geiger, director of public policy at Rapid7, talks to Threatpost editor Mike Mimoso at RSA Conference 2017 about how policy goes hand in hand with technology when it comes to cybersecurity, the government’s focus on IoT and critical infrastructure, and the role independent security researc...

Remote Access no longer needs to be Complex and Cumbersome

From an IT management perspective, remote access management can be complex. Deployment, administration, testing and compliance is often multifaceted and time consuming, and security is an on-going concern. Granted, I have talked with IT professionals who tell me VPNs - being the primary remote...

3S-Smart Software Solutions GmbH CODESYS Web Server

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: 3S-Smart Software Solutions GmbH Equipment: CODESYS Web Server Vulnerabilities: Arbitrary File Upload, Stack Buffer Overflow AFFECTED PRODUCTS The following versions of CODESYS Web Server, part of the CODESYS WebVisu...

Open Source Large Scale Full Packet Capturing: Moloch

Open Source Large Scale Full Packet Capturing Moloch is an open source, large scale, full packet capturing, indexing, and database system. Moloch augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access. An intuitive...

DDoS of Past, Present and Future

The pervasiveness of technology has meant automation of tasks, allowing better productivity, with more time to do more. However, the dark side of technology would be that enterprises and individuals alike are vulnerable to cybercrimes, compromise of identities, loss of data and subject to malicio...

Cisco IOS ANI Registrar DoS (cisco-sa-20170320-ani)

According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the Autonomic Networking Infrastructure ANI registrar feature due to incomplete input validation of certain crafted packets. An unauthenticated, adjacent...

Cisco IOS XE ANI IPv6 Packets DoS (cisco-sa-20170320-aniipv6)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the Autonomic Networking Infrastructure ANI component due to incomplete input validation of certain crafted IPv6 packets. An unauthenticated, remote...

Cisco IOS XE ANI Registrar DoS (cisco-sa-20170320-ani)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the Autonomic Networking Infrastructure ANI registrar feature due to incomplete input validation of certain crafted packets. An unauthenticated,...

Moderate: Red Hat Security Advisory: Red Hat Gluster Storage 3.2.0 security, bug fix, and enhancement update

An update is now available for Red Hat Gluster Storage 3.2 on Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

SAP Vulnerability Puts Business Data at Risk for Thousands of Companies

SAP’s patch update for this month included a fix for a critical remote code execution vulnerability in the SAP GUI client that provides remote access to a central SAP server in a corporate network. Researchers at ERPScan, a Dutch company specializing in business application security, disclosed so...

Cisco IOS and IOS XE Software ANI IPv6 Message Denial of Service Vulnerability

Cisco IOS and IOS XE Software are both operating systems developed by Cisco in the United States for its network devices. The Autonomic Networking Infrastructure ANI feature in Cisco IOS and IOS XE Software fails to adequately filter packets. A remote attacker could exploit the vulnerability by...

Cisco Prime Infrastructure Security Bypass Vulnerability

Cisco Prime Infrastructure PI is a product of Cisco USA.PI is a set of wireless management solutions through Cisco Prime LAN Management Solution LMS and Cisco Prime Network ControlSystem NCS technologies. PI is a wireless management solution through Cisco Prime LAN Management Solution LMS and Cis...

CVE-2017-3850

A vulnerability in the Autonomic Networking Infrastructure ANI feature of Cisco IOS Software 15.4 through 15.6 and Cisco IOS XE Software 3.7 through 3.18, and 16 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to incomplete inpu...

Input validation

A vulnerability in the Autonomic Networking Infrastructure ANI registrar feature of Cisco IOS Software possibly 15.2 through 15.6 and Cisco IOS XE Software possibly 3.7 through 3.18, and 16 could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The...

DevOps, Automation, Security and Compliance

Phew, the title of this post alone sounds like it could be quite a lot to deal with! So what is DevOps? DevOps is simply the blending of infrastructure operations processes and software development to enable faster changes to business applications/technology. These processes share a lot of ideolo...

CVE-2017-3849

Cisco IOS and IOS XE ANI Registrar Denial of Service (CVE-2017-3849) affects the Autonomic Networking Infrastructure (ANI) registrar feature in Cisco IOS/IOS XE where incomplete input validation of crafted packets can be exploited by an unauthenticated, adjacent attacker. Conditions: device runs ...

Locky, Cerber Ransomware Skilled at Avoiding Detection

The latest versions of Cerber and Locky ransomware have been, since mid-January, finding great success in bypassing existing security detection systems through the use of a common infrastructure that allows the malicious code to bury itself inside NSIS installers, and use several layers of...

Cisco IOS Software IPv6 Denial of Service Vulnerability (cisco-sa-20170320-aniipv6)

A vulnerability in the Autonomic Networking Infrastructure ANI feature of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, a...

CVE-2016-9165

The getsessions servlet in CA Unified Infrastructure Management formerly CA Nimsoft Monitor before 8.5 and CA Unified Infrastructure Management Snap formerly CA Nimsoft Monitor Snap allows remote attackers to obtain active session ids and consequently bypass authentication or gain privileges via...