CVE-2017-3360: Undefined Security Weakness

Vulnerability in the Oracle Customer Intelligence component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2017-3359: Undefined Security Weakness

Vulnerability in the Oracle Customer Intelligence component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

PT-2017-15816

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Customer Intelligence, requiring human interaction from a person other than the...

PT-2017-15815

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1, 12.1.2, and 12.1.3 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Customer Intelligence, requiring human interaction from a person other than...

Detecting threat actors in recent German industrial attacks with Windows Defender ATP

When a Germany-based industrial conglomerate disclosed in December 2016 that it was breached early that year, the breach was revealed to be a professionally run industrial espionage attack. According to the German press, the intruders used the Winnti family of malware as their main implant, givin...

IBM Cognos Business Intelligence Server Cross-Site Scripting Vulnerability (CNVD-2017-01025)

IBM Cognos is an integrated business intelligence BI and planning solution. A cross-site scripting vulnerability exists in IBM Cognos Business Intelligence Server that stems from a failure to adequately validate user input. An attacker could exploit the vulnerability to execute arbitrary script...

Cloud-AI: Artificially Intelligent System Found 10 Security Bugs in LinkedIn

2017 is the year of Artificial Intelligence A.I., Big Data, Virtual Reality VR and Cyber Security with major companies like Google, Facebook, Apple, IBM and Salesforce and technology pioneers like SpaceX founder Elon Musk investing in these hot technologies. Since everyone seems to be talking abo...

Oracle E-Business Suite Remote Security Vulnerability (CNVD-2017-00653)

Oracle E-Business Suite E-Business Suite is a fully integrated set of Oracle's global business management software. Oracle Customer Intelligence is one of the Web-based customer information viewer, customer data analyzer and customer performance monitor components. A remote vulnerability exists i...

Ghost Blog 0.11.3 Cross Site Scripting Vulnerability

Tempest Security Intelligence Advisory ADV-9/2017 - Ghost Blog version 0.11.3 suffers from a persistent cross site scripting vulnerability. Persistent Cross-Site Scripting XSS in Ghost ------------------------------------------------------- Author: - Patrick Costa Tempest Security Intelligence -...

Ghost Blog 0.11.3 Cross Site Scripting

===== Tempest Security Intelligence - ADV-9/2017 ======================== Persistent Cross-Site Scripting XSS in Ghost ------------------------------------------------------- Author: - Patrick Costa Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents...

Oracle E-Business Multiple Vulnerabilities (January 2017 CPU)

The version of Oracle E-Business installed on the remote host is missing the January 2017 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple unspecified vulnerabilities in multiple components and subcomponents, the most severe of which can allow an unauthenticated, remote...

Tinfoleak v2.0 - Get detailed information about a Twitter user activity

Are you interested in OSINT tools? Tinfoleak is the best OSINT tool for Twitter, and is open-source! The new version includes a lot of new and improved features: Search by coordinates Geolocated users Tagged users User conversations Identification in other social networks More powerful and flexib...

Andrew Macpherson on Intelligence Gathering with Maltego

Ryan Naraine talks with Operations Manager at Paterva Andrew Macpherson who outlines the details of the “Digital Intelligence Gathering using Maltego” course being offered at the SAS 2017 and talks about the benefits for data mining by pen testers, malware analysts and law enforcement agencies...

White House Approves New Rules for Sharing of Raw Intelligence Data

President Obama last week approved a change in the way the National Security Agency shares raw signals intelligence data with the rest of the U.S. intelligence community, a shift that privacy experts worry will erode the civil liberties of Americans. An unclassified document released by the Offic...

APT28: At the Center of the Storm

On Jan. 6, 2017, the U.S. Director of National Intelligence released its Intelligence Community Assessment: Assessing Russian Activities and Intentions in Recent US Elections. Still, questions persist about Russian involvement. Did the Russian government direct the group responsible for the...

PT-2017-3097

Name of the Vulnerable Software and Affected Versions SAP Business Intelligence platform versions prior to January 2017 Description The issue allows remote attackers to obtain sensitive information, modify data, cause a denial of service, or launch administrative operations via a crafted SQL quer...

U.S. Intelligence Report Due Next Week on Election Hack

The various branches of the U.S. intelligence community said they will next week deliver a joint report that corroborates claims that Russian intelligence attempted to influence the 2016 presidential election. Outgoing Director of National Intelligence James R. Clapper also confirmed to a U.S...

Telegram Desktop 0.10.1 DLL Hijacking Vulnerability

Tempest Security Intelligence Advisory ADV-6/2016 - Telegram Desktop version 0.10.1 is vulnerable to dll hijacking as it tries to load "COMBASE.dll" without supplying the absolute path, thus relying upon the presence of such dll on the system directory. Unsafe DLL search path in Telegram Desktop...

Atlassian Confluence < 5.10.6 - Persistent Cross-Site Scripting

===== Tempest Security Intelligence - ADV-3/2016 CVE-2016-6283 ============== Persisted Cross-Site Scripting XSS in Confluence Jira Software ---------------------------------------------------------------- Authors: - Jodson Santos - [email protected] Tempest Security Intelligence -...

Audacity 2.1.2 DLL Hijacking Vulnerability

Tempest Security Intelligence Advisory ADV-7/2016 - Audacity version 2.1.2 is vulnerable to dll hijacking as it tries to load avformat-55.dll without supplying the absolute path, thus relying upon the presence of such dll on the system directory. This behavior results in an exploitable dll...