Attackers Exploiting Windows OLE Vulnerability

Attackers are using a zero day vulnerability in nearly all supported versions of Windows in a series of targeted attacks. The flaw is in the OLE technology in Windows and can be used for remote code execution is a targeted user opens a rigged Office file. Microsoft is warning customers that there...

Microsoft Patches 3 Zero-day Vulnerabilities actively being Exploited in the Wild

As part of monthly patch update, Microsoft released eight security bulletins on Tuesday that address dozens of vulnerabilities including a zero-day flaw reportedly being exploited by Russian hackers to target NATO computers and a pair of zero-day Windows vulnerabilities that attackers have been...

Sandworm APT Team Found Using Windows Zero Day Vulnerability

UPDATE–A cyberespionage team, possibly based in Russia, has been using a Windows zero day vulnerability to target a variety of organizations in several countries, including the United States, Poland, Ukraine and western Europe. The vulnerability, which will be patched today by Microsoft, is...

anaconda clipper 3.3 - Directory Traversal vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2512/info Clipper is a headline-gathering tool from Anaconda! Partners which, in certain versions, is vulnerable to directory traversal attacks. By including '/../' sequences in requested URLs, an attacker can cause the...

HIMSS Privacy & Security Forum – West 2014 Wrap-Up

The first HIMSS Privacy & Security Forum in the western U.S. proved to be a success and was attended by over 300 people including attendees CEs and BAs, speakers, exhibitors, and partners. We reconnected with several clients and met new friends at our booth, which was located right in the middle ...

Cryptanalysis Remains for TrueCrypt Audit

Phase two of the TrueCrypt audit figures to be a labor-intensive, largely manual cryptanalysis, according to the two experts behind the Open Crypto Audit Project OCAP. Matthew Green, crypto expert and professor at Johns Hopkins University, said a small team of experts will have to, by hand, exami...

First Phase of TrueCrypt Audit Turns Up No Backdoors

A initial audit of the popular open source encryption software TrueCrypt turned up fewer than a dozen vulnerabilities, none of which so far point toward a backdoor surreptitiously inserted into the codebase. A report on the first phase of the audit was released today by iSEC Partners, which was...

CVE-2013-2210

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2013-2210: Apache Santuario XML Security for C++ contains a heap overflow during XPointer evaluation Severity: Critical Vendor: The Apache Software Foundation Versions Affected: Apache Santuario XML Security for C++ library versions prior to...

Debian DSA-2717-1 : xml-security-c - heap overflow

Jon Erickson of iSIGHT Partners Labs discovered a heap overflow in xml-security-c, an implementation of the XML Digital Security specification. The fix to address CVE-2013-2154 introduced the possibility of a heap overflow in the processing of malformed XPointer expressions in the XML Signature...

DSA-2717-1 xml-security-c - heap overflow

Bulletin has no description...

DSA-2652-1 libxml2 - external entity expansion

Bulletin has no description...

Business Partners Give Hackers Easy Access to Secure Firms

As frequently targeted, high-value companies continue fortifying their defenses, FireEye researchers claim that attackers are increasingly setting their sights on the affiliated but not-as-well-protected third-party organizations that do business with them. By aiming phishing email campaigns at...

Small Medical Offices Biggest Risk to Patient Data Security, Privacy

Small physician practices, much like their small commercial business counterparts, have been the primary source of health care related data breaches, according to an analysis of breaches from 2009 to October 2012 released today by the Health Information Trust Alliance HITRUST. These smaller medic...

Facebook strengthens security with AntiVirus Marketplace

Facebook strengthens security with AntiVirus Marketplace Facebook has launched Anti-Virus Marketplace , a new portal to protect the social network's users.Members are being encouraged to download anti-malware programs which they can use at no cost for six months. Facebook is strengthening its...

Chengdu Bureau Of Commerce SQL Injection

Title: ====== Chengdu Bureau of Commerce - SQL Injection Vulnerability Date: ===== 2012-04-23 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=312 VL-ID: ===== 312 Introduction: ============= May 20, by my bureau composed of 10 members, participated in by the Chinese...

Microsoft Partners - Persistent Vulnerabilities MSRC

Document Title: =============== Microsoft Partners - Persistent Vulnerabilities MSRC References: =========== Download: http://www.vulnerability-lab.com/resources/videos/439.wmv View: http://www.youtube.com/watch?v=Zou2ZSiL6g http://www.vulnerability-lab.com/getcontent.php?id=433...

NSA Director Says Agency Should Not Monitor Private Networks

The hysteria in Washington regarding the comprehensive infiltration of U.S. government and civilian networks by China has gotten to the point now that the director of the National Security Agency is saying in open Congressional hearings that his agency, the U.S. Cyber Command and others should be...

Was the Koobface Expose the Right Move?

Just as a stand-up comedian carefully places his punch line at the end of the joke, I also usually leave my conclusions for the end of a post. Except for this time. This time, I would like to start with the conclusion: For an ongoing investigation not to be jeopardized, it is extremely important...

Sprint Disables Carrier IQ Software On Its Devices

Sprint has decided to stop using Carrier IQ’s diagnostic software in light of the ongoing controversy about user privacy, according to reports. A Sprint spokesperson told the Website MobileBurn that the carrier has “weighed customer concerns and…disabled use of the tool so that diagnostic...

US military's offensive operations in cyberspace to shoot Hackers

US military's offensive operations in cyberspace to shoot Hackers The US military is now legally in the clear to launch offensive operations in cyberspace, the commander of the US Strategic Command has said. The Pentagon has just sent a report to Congress where it says that it has the right to...