CVE-2018-2924

CVE-2018-2924 affects Sun ZFS Storage Appliance Kit (AK) within Oracle Sun Systems Products Suite, specifically the API frameworks subcomponent. The vulnerability is exploitable via a locally authenticated attacker and compromises AK data confidentiality, integrity and availability, with potentia...

CVE-2018-2920

CVE-2018-2920 affects the Sun ZFS Storage Appliance Kit (AK) API frameworks subcomponent of Oracle Sun Systems Products Suite, with impact pre-8.7.19. A vulnerability in AK’s API frameworks could allow a low-privilege, network-accessible attacker to read, update, insert, or delete data and cause ...

CVE-2018-2921

CVE-2018-2921 affects Oracle Sun Systems Products Suite, specifically the Sun ZFS Storage Appliance Kit (AK) User Interface, with affected versions prior to 8.7.18. The vulnerability allows an unauthenticated, network-accessible attacker (via HTTP) to read data from the AK UI, and attackers may i...

CVE-2018-2937

Vulnerability in the Sun ZFS Storage Appliance Kit AK component of Oracle Sun Systems Products Suite subcomponent: User Interface. The supported version that is affected is Prior to 8.7.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2018-2918

The CVE-2018-2918 entry concerns the Sun ZFS Storage Appliance Kit (AK) in the Oracle Sun Systems Products Suite, specifically its API frameworks subcomponent. Affected are versions prior to 8.7.18. The vulnerability is described as exploitable by an unauthenticated attacker who has network acces...

This Week in Security News: Security and Safety on Social Media

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, California lawmakers passed a new online privacy bill guaranteeing more control over user data. Also, Typeform announced a breach involving...

RIG Exploit Kit Delivering Monero Miner Via PROPagate Injection Technique

Introduction Through FireEye Dynamic Threat Intelligence DTI, we observed RIG Exploit Kit EK delivering a dropper that leverages the PROPagate injection technique to inject code that downloads and executes a Monero miner similar activity has been reported by Trend Micro. Apart from leveraging a...

RIG Exploit Kit Delivering Monero Miner Via PROPagate Injection Technique

Introduction Through FireEye Dynamic Threat Intelligence DTI, we observed RIG Exploit Kit EK delivering a dropper that leverages the PROPagate injection technique to inject code that downloads and executes a Monero miner similar activity has been reported by Trend Micro. Apart from leveraging a...

CVE-2018-5435

The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contain multiple...

CVE-2018-5437

The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contain multiple...

dpdk: Information exposure in unchecked guest physical to host virtual address translations

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Integrated Information Core (Java Technology Edition CPU July 2016 - Includes Oracle July 2016 CPU + CVE-2016-3485)

Summary IBM WebSphere Application Server is shipped as a component of IBM Integrated Information Core. Oracle released the July 2016 critical patch updates which contain multiple fixes for security vulnerabilities in the IBM Java Development Kit that is included with IBM WebSphere Application...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Integrated Information Core - Oracle CPU April 2016

Summary Oracle released the April 2016 critical patch updates which contain multiple fixes for security vulnerabilities in the IBM Java Development Kit that is included with the IBM WebSphere Application Server. Vulnerability Details New IBM WebSphere Application Server updates are available that...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Integrated Information Core - Oracle CPU January 2016

Summary Oracle released the January 2016 critical patch updates which contain multiple fixes for security vulnerabilities in the IBM Java Development Kit that is included with the IBM WebSphere Application Server. Vulnerability Details New IBM WebSphere Application Server updates are available th...

UBUNTU-CVE-2018-12028

An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates a...

Determining which CVE fixes are included in a JRE

Question IBM Security Bulletins list CVEs that must be applied to the JRE that RPT scripts use to run tests. How can you determine whether a specific JRE version includes a particular CVE? Answer IBM Security Bulletins list Common Vulnerabilities and Exposures CVE that must be fixed in the T6...

Security Bulletin: CM OnDemand GSKit Vulnerability (CVE-2013-6329)

Summary A vulnerability exists in IBM Global Security Kit GSKit that is shipped with Content Manager OnDemand. Vulnerability Details CVEID: CVE-2013-6329 DESCRIPTION: A vulnerability in relation to SSL/TLS Handshake Processing has been discovered related to the SSLV3 Session Resumption when using...

Security Bulletin: IBM InfoSphere Streams update of IBM® SDK Java™ Technology Edition (CVE-2016-0363, CVE-2016-0376)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 Service Refresh 2 Fix Pack 11 and earlier releases, Version 7R1 Service Refresh 3 Fix Pack 31 and earlier releases, and Version 6 Service Refresh 16 Fix Pack 21 and earlier releases provided with IBM...

WannaCry Kill Switch Hero Faces New Charges, But Code Evals Say Little

A fresh FBI charge against Marcus Hutchins has led to the Kronos banking trojan and the UPAS Kit backdoor being linked in the news over the past week. However, a fresh analysis this week shows that, at least on a code level, the similarities and differences between the two are far from conclusive...

Marcus Hutchins, WannaCry-killer, hit with four new charges by the FBI

Marcus Hutchins, the British malware analyst who helped stop global Wannacry menace, is now facing four new charges related to malware he allegedly created and promoted it online to steal financial information. Hutchins, the 24-year-old better known as MalwareTech, was arrested by the FBI last ye...