4733 matches found
Securing Healthcare Data and Applications
The healthcare industry is quickly growing as a sweet spot for hackers to steal large amounts of patient records for profit. The US Department of Health and Human Services breach tool reports over 340 data breaches in 2017 impacting more than 3 million individuals, and 176.5 million individuals...
Trend Micro Email Encryption Gateway XML External Entity Injection Vulnerability
Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. An XML external entity injection vulnerability exists in the configuration scrip...
If You Think File Integrity Monitoring is Boring, Think Again
You’ll be hard pressed to find file integrity monitoring on any list of cool, emerging, cutting-edge cybersecurity technologies. But if you choose to ignore this mature, foundational technology, it’ll be at great risk. File integrity monitoring, or FIM, plays a key role in critical security and...
SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2018:0279-1)
This update for libvirt provides several fixes. This security issue was fixed : - CVE-2018-5748: Prevent resource exhaustion via qemuMonitorIORead method which allowed to cause DoS bsc1076500. These security issues were fixed : - Add a qemu hook script providing functionality similar to Xen's...
SUSE-SU-2018:0279-1 Security update for libvirt
This update for libvirt provides several fixes. This security issue was fixed: - CVE-2018-5748: Prevent resource exhaustion via qemuMonitorIORead method which allowed to cause DoS bsc1076500. These security issues were fixed: - Add a qemu hook script providing functionality similar to Xen's...
A week in security (January 22 – January 28)
Last week on Labs, we analyzed a rogue app outbreak on Twitter, took a look at how Singapore's government is faring with network defense, and rolled out our 2017 State of Malware report. We also became visionaries in Gartner's Magic Quadrant report and explored a VR data mishap. Other news Man...
SSL/TLS Services Support RC4 (PCI DSS)
At least one of the SSL or TLS services on the remote host supports the use of RC4 for encryption. RC4 does not meet the PCI definition of strong cryptography as defined by NIST Special Publication 800-57 Part 1. The RC4 cipher is flawed in its generation of a pseudo-random stream of bytes so tha...
Weak DH Key Exchange Supported (PCI DSS)
At least one of the services on the remote host supports a Diffie-Hellman key exchange using a public modulus smaller than 2048 bits. Diffie-Hellman key exchanges with keys smaller than 2048 bits do not meet the PCI definition of strong cryptography as specified by NIST Special Publication 800-57...
Debian: Security Advisory (DLA-964-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
OnePlus Site’s Payment System Reportedly Hacked to Steal Credit Card Details
This year's first bad news for OnePlus users—a large number of OnePlus customers are reporting of fraudulent credit card transactions after buying products from the Chinese smartphone manufacturer's official online store. The claim initially surfaced on the OnePlus support forum over the weekend...
Design/Logic Flaw
Use-after-free vulnerability in hw/pci/pcie.c in QEMU aka Quick Emulator allows local guest OS users to cause a denial of service QEMU instance crash via hotplug and hotunplug operations of Virtio block devices...
DEBIAN-CVE-2014-3471
Use-after-free vulnerability in hw/pci/pcie.c in QEMU aka Quick Emulator allows local guest OS users to cause a denial of service QEMU instance crash via hotplug and hotunplug operations of Virtio block devices...
PCI DSS v3.2 & Private IP Address Disclosure
Private IP addresses disclosure such as QID 86247 “Web Server Internal IP Address/Internal Network Name Disclosure Vulnerability” will be marked as a Fail for PCI as of February 1, 2018 in accordance with PCI DSS v3.2. QID 86247 is a PCI Fail according to PCI DSS v3.2 Requirement 1.3.7: 1.3.7 Do...
OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0002)
The remote OracleVM system is missing necessary patches to address critical security updates : - fuse: Call endqueuedrequests after releasing fc-lock in fusedevrelease Ashish Samant Orabug: 26431550 - rds: Fix inaccurate accounting of unsignaled wrs in rdsibxmitrdma Hå kon Bugge Orabug:...
qemu-kvm security update
1.5.3-141.el74.6 - Fix CVE-2017-5715 1.5.3-141.el74.5 - kvm-vfio-pci-Only-mmap-TARGETPAGESIZE-regions.patch bz1515110 - Resolves: bz1515110 Regression in QEMU handling for sub-page MMIO BARs for vfio-pci devices rhel-7.4.z...
Deploying and Troubleshooting Compliance Baselines
If you are in the IT space, youve most likely encountered or are bound by some form of regulation/framework such as PCI, HIPAA, FISMA, and/or CGIS. Most of these compliance programs require a hardened baseline to be implemented within your information systems to reduce the risk and impact of an...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3657)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3657 advisory. - mm: Tighten x86 /dev/mem with zeroing reads Kees Cook Orabug: 26675925 CVE-2017-7889 - more biomapuseriov leak fixes Al Viro Orabug: 27069042...
Cloudflare: Cloudflare does not sufficiently truncate credit card numbers in invoices
When a Cloudflare user has a paid account, but Cloudflare can't process the user's credit card, Cloudflare emails the user from [email protected], subject line "Cloudflare Failed Taking Payment for INV-D1234567". The email contains an attachment, "2017-11-19CloudflareINV-D1234567.pdf", a PDF...
TLS Version 1.0 Protocol Detection
The remote service accepts connections encrypted using TLS 1.0. TLS 1.0 has a number of cryptographic design flaws. Modern implementations of TLS 1.0 mitigate these problems, but newer versions of TLS like 1.2 and 1.3 are designed against these flaws and should be used whenever possible. As of...
GDPR Talk Dominates Barcelona’s PCI DSS Community Conference
Recently, I returned from the European PCI DSS community conference in Barcelona. As always, the conference featured analysis of current hot topics within the PCI community and was helpful for any security professional looking to learn about the latest advancements in data security and protection...