Xxe

IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related ...

CVE-2013-3030

The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote attackers to cause a denial of service temporary gateway outage via crafted HTTP requests...

CVE-2013-3030

The CVE-2013-3030 entry affects IBM Cognos Business Intelligence (BI) and Cognos Analytics platforms. Affected is the servlet gateway in IBM Cognos BI 10.2.1 and earlier (including 8.4.1 before IF3, 10.1.x before various IFs, and 10.2.1.x before IF1/IF2/IF4 as listed). The vulnerability allows re...

CVE-2013-4034

IBM Cognos BI is vulnerable to an XML External Entity (XXE) issue (CVE-2013-4034). Affected: IBM Cognos BI 8.4.1 before IF3; 10.1.0 before IF4; 10.1.1 before IF4; 10.2.0 before IF4; 10.2.1 before IF2; 10.2.1.1 before IF1. Description: remote authenticated users can read arbitrary files via an XML...

Surveillance Transparency Act Would Limit NSA Spying

There have been countless hearings in both the House and Senate since the Snowden leaks began in June, and there seems to be no end in sight. The latest committee to get in on the action was the Senate Committee on the Judiciary’s Subcommittee on Privacy, Technology and the Law, which held a...

Automated Attack, Threat Intelligence Sharing Sought

BOSTON – If you’re looking for tangible information sharing success stories around attack intelligence, some might point to the prompt publishing of indicators of compromise IOC as an example. Security and forensics companies will publish MD5 hashes of malware, IP addresses involved in attacks,...

MIRcon 2013 – Day 1 Highlights

Happy Day 2 of MIRcon®! Yesterday, Mandiant's CEO Kevin Mandia kicked off MIRcon 2013 with a keynote on attacking the security gap, discussing the necessity of information-sharing and his experience witnessing the evolution of cybercrime. From there we moved on to thought-provoking discussions in...

Finland's Ministry of Foreign Affairs networks hit by sophisticated Malware attack

Finnish commercial broadcaster MTV3 reports that the Finnish Ministry of Foreign Affair networks has been targeted in a four-year-long cyber espionage operation. Finland's foreign minister said, "I can confirm there has been a severe and large hacking in the ministry's data network," A large scal...

Tech Giants Plead for U.S. Surveillance Reforms

Giant technology companies have been vocal about the need for more transparency with regard to the national security requests for user data they receive. But until now, they’ve stayed out of the political fight to address government surveillance, in particular by the National Security Agency...

Major Companies Fall Victim to Social Engineering

The annual Social Engineering Capture the Flag contest held during DEF CON may seem on the surface to be just an opportunity for pen-testers and hackers to flex their pretexting muscles. But if you’re one of the 10 major technology, manufacturing and critical infrastructure organizations targeted...

Obama Administration to Review NSA Capabilities

President Barack Obama has initiated a review of the procedures and methods that the NSA uses to collect intelligence at home and overseas to ensure that the agency isn’t overstepping its bounds in phone and Internet data collection. The review comes at a time when Congress is set to consider...

Google Retools reCAPTCHA Authentication System

Google announced a change to its reCAPTCHA authentication system late Friday wherein the company will begin creating different types of puzzles for different users, use numeric CAPTCHAs and move away from more obscure, hard-to-read distorted letters. CAPTCHAs are the series of distorted letter...

EFF: Congress Has Opportunity to Stop Mass Surveillance

Since the leaks of NSA surveillance methods began in June, there has been a flurry of activity in Congress, with members scurrying to line up on either side of the issue, either defending the agency’s methods or condemning them. That mad scramble also has included the introduction of a number of...

FBstalker Does Data Mining on Facebook Graph Search

Facebook’s Graph Search feature connects a lot of dots between friends on the social network—as well as between others who interact with your Facebook friends. Anyone with a keyboard has a nifty data mining tool at their fingertips that can bring up an intricate list of friends and acquaintances,...

Schneider Electric IGSS Buffer Overflow

Overview Independent researcher Aaron Portnoy of Exodus Intelligence has identified a buffer overflow vulnerability in Schneider Electric’s Interactive Graphical SCADA System IGSS application. Schneider Electric has produced a patch that fully resolves this vulnerability. Aaron Portnoy has...

Snoopy Project mobile tracking and intelligence grows up

A year ago, the Snoopy Project was a neat research initiative that packaged a number of existing technologies into a framework to profile and track mobile devices. After a summer of Snowden revelations, something like Snoopy takes on a whole new meaning. Snoopy devices, called drones by researche...

HTTPS, SSL Minimal Security, Privacy Standard for Email

Yahoo is being second-guessed more today than a mediocre baseball manager. Two days after announcing it would finally turn SSL on by default for its email users starting in January, the company is getting a halfhearted pat on the back from the security industry, which can’t help but ask: “What to...

FISC Court renews the Permission to collect Telephony Metadata again

The Foreign Intelligence Surveillance Court has once again has renewed the permission to the U.S. government for a controversial program to collect the telephony metadata from American phone companies. The News that the NSA collects bulk phone call metadata including phone numbers, call times and...

IBM Cognos Business Intelligence - XML External Entity Information Disclosure

IBM Cognos Business Intelligence - XML External Entity Information Disclosure source: https://www.securityfocus.com/bid/63719/info IBM Cognos Business Intelligence is prone to an information-disclosure vulnerability due to an error when parsing XML external entities. An attacker can exploit this...

IBM Cognos Business Intelligence - XML External Entity Information Disclosure

source: https://www.securityfocus.com/bid/63719/info IBM Cognos Business Intelligence is prone to an information-disclosure vulnerability due to an error when parsing XML external entities. An attacker can exploit this issue to gain access to sensitive information; this may lead to further attack...