6870 matches found
Linux Kernel IP Vulnerability 2
On the week of July 15th, researcher Juha-Matti Tilli disclosed a vulnerability in the Linux kernel to the kernel maintainers, the National Cyber Security Center - Finland NCSC-FI, CERT Coordination Center CERT/CC, and Akamai. The vulnerability, CVE-2018-5391, is a resource exhaustion attack...
Flaws in Pre-Installed Apps Expose Millions of Android Devices to Hackers
Bought a new Android phone? What if I say your brand new smartphone can be hacked remotely? Nearly all Android phones come with useless applications pre-installed by manufacturers or carriers, usually called bloatware, and there's nothing you can do if any of them has a backdoor built-inβeven if...
Black Hat 2018: Google Bug Hunter Urges Apple to Change its iOS Security Culture
LAS VEGAS β Prolific Google bug hunter Ian Beer ripped into Apple on Wednesday, urging the iPhone maker to change its culture when it comes to iOS security. He said the company suffers from an all-too-common affliction of patching an iOS bug, but not fixing the systemic roots that contribute to t...
ThreatList: Financial Services Firms Lag in Patching Habits
Almost half 45 percent of financial services firms in a recent survey have reported a data breach in the last two years β with many of those attacks being completely avoidable if known vulnerabilities were patched. In a Ponemon Institute survey of nearly 3,000 cybersecurity professionals at...
Linux Kernel TCP Vulnerability
On the week of July 15th researcher Juha-Matti Tilli disclosed a vulnerability he discovered in the Linux kernel to the kernel maintainers, the National Cyber Security Center - Finland NCSC-FI, CERT Coordination Center CERT/CC, and Akamai. The vulnerability, CVE-2018-5390, is a resource exhaustio...
What I expect from IT Asset Inventory
The main problem of vulnerability management, in my opinion, is that it is not always clear whether we know about ALL network hosts existing in our infrastructure or not. So, not the actual process of scanning and the detection of vulnerabilities, but the lack of knowledge what we should scan...
HRSale 1.0.6 Local File Disclosure
Exploit Title: HRSALE - HR Management PHP Script - LFD Google Dork: N/A Date: 2018/1/8 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: http://hrsale.com Software Buy: https://www.codester.com/items/8599/hrsale-hr-management-php-script Demo:...
A Quick-Start Introduction to Database Security: An Operational Approach
The recent SingHealth data breach incident exposed around 1.5 million patientsβ records. In its aftermath, the Cyber Security Agency of Singapore published a set of security measures aimed at improving the protection of Personally Identifiable Information PII data. The recommended security measur...
Spectre Will Haunt Us For a Long Time
During a recent Congressional hearing, Senators voiced concerns about the ongoing Spectre and Meltdown vulnerabilities. While the technical details were predictably glossed over, most of the hearing focused on Intel informing Chinese partners about the flaws six months before they went public...
How Cyber Insurance Changes the Conversation Around Risk
Premiums paid for cyber insurance could triple to more than $7.5 billion by 2020, according to consultancy PwC. Companies are waking up to the fact that cyber risk equals business risk. Ask FedExβs European arm, shipping giant Maersk or any of the other major organizations knocked out of operatio...
CVE-2018-11716
An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...
Unsanctioned Apps Invite Fox into Cybersecurity Hen House
Conventional wisdom has shown thereβs a short line between a companyβs highest point of risk β its employees and a compromise. Unsanctioned, or shadow applications, are apps that havenβt been cleared by a companyβs information security team. These apps, on employee machines, have long been a...
PYSEC-2018-88
The mpatchapply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004...
Read: Our Top Picks for 2018βs Biggest Cybersecurity Storiesβ¦ So Far
Our threat research team's been burning the candle at both ends this year, what with the sheer number of nasties out there at any given time. But with so many to choose from, how did we populate a list with just seven cybersecurity threats, and why? For one, it'll take the rest of the year to...
Security Bulletin: Vulnerability in Apache Commons FileUpload DiskFileItem File Manipulation affects IBM Platform Symphony, IBM Spectrum Symphony (CVE-2016-1000031)
Summary A security vulnerability relating to remote code execution CVE-2016-1000031 has been reported against Apache Commons FileUpload DiskFileItem File Manipulation, which IBM Platform Symphony uses as a framework for its WEBGUI service. The Commons FileUpload version that is vulnerable to thes...
Security Bulletin: SSLv3 POODLE Attack (CVE-2014-3566)
Summary SSLv3 POODLE Attack CVE-2014-3566 impacts IBM Service Deliver Manager. Vulnerability Details Review the following security bulletins for vulnerability details and information about fixes: Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere Application Server CVE-2014-3566...
Security Bulletin: Vulnerability in Flexera InstallAnywhere affects Watson Explorer and Watson Content Analytics (CVE-2016-4560)
Summary Some components of this product include a version of Flexera InstallAnywhere that could allow a remote attacker to execute arbitrary code on the system. This vulnerability can be avoided by following the instructions included in this bulletin. Vulnerability Details CVEID: CVE-2016-4560...
Security Bulletin: Apache HttpComponents vulnerable to spoofing attacks are affecting Case Manager Client (CVE-2012-6153, CVE-2014-3577)
Summary Apache HttpComponents that are vulnerable to spoofing attacks are affecting Case Manager Client. Vulnerability Details Apache HttpComponents that are being utilized by the Forms widget in Case Manager Client when you are working with IBM Forms are vulnerable to spoofing attacks. CVEID:...
Security Bulletin: Vulnerabilities in OpenSSL affect Algo Credit Limits (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)
Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by Algo Credit Limits. Algo Credit Limits has addressed the applicable CVEs and included the SSL 3.0 Fallback protection TLSFALLBACKSCSV...
Qualys Security Conference Virtual 2018. New Agents, Patch Management and Free Services
Today I attended a very interesting online event - Qualys Security Conference Virtual 2018. It consisted of 11 webinars, began at 18:00 and will end at 03:45 Moscow time. Not the most convenient timing for Russia, but it was worth it. Last time I was at offline QSC event in 2016, so for me it was...