CVE-2019-14318

Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar multiplication in ecp.cpp...

Amazon Prime Day is Now a Major Holiday, Driving up Traffic by More Than 14% in the U.S.

For the just-completed Amazon Prime Day a full 48 hours this year, published reports indicate that it was the largest shopping event in Amazon's history, exceeding their own 2018 sales for both Black Friday and Cyber Monday combined. And this year, there were more than 250 other retailers that...

The vulnerability of the Cisco Prime Service Catalog’s management web interface allows attackers to execute cross-site scripting attacks.

The vulnerability in the Cisco Prime Service Catalog’s web interface management interface is related to insufficient verification of the data entered by users. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the Virtual Domain component of the Cisco Prime Infrastructure monitoring and network equipment management system, as well as the Cisco Evolved Programmable Network (EPN) Manager software, allows a hacker to alter the configuration of the virtual domain and increase their privileges.

The vulnerability of the Virtual Domain component of the Cisco Prime Infrastructure monitoring and network equipment management system, as well as the Cisco Evolved Programmable Network EPN Manager software, is related to errors in API request validation. Exploiting this vulnerability could allow...

Cisco Data Center Network Manager Arbitrary File Download Vulnerability

According to its self-reported version, Cisco Data Center Network Manager is affected by an arbitrary file download vulnerability in the web-based management interface. An unauthenticated, remote attacker can exploit this, to download arbitrary files and disclose sensitive information. Please see...

A week in security (July 8 – 14)

Last week on Malwarebytes Labs, we looked at ways to send your sensitive information in a secure fashion, examined some tactics in incident response land, and explored federal data privacy law. We also looked at how security tools can turn against you, and took a deep dive into the rather fiendis...

An Amazon Phishing Scam Hits Just in Time For Prime Day

Some deals are too good to be true, even on the most made-up holiday of all...

EulerOS 2.0 SP5 : gnutls (EulerOS-SA-2019-1676)

According to the version of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A cache-based side channel attack was found in the way GnuTLS implements CBC-mode cipher suites. An attacker could use a combination of 'Just in...

The vulnerability in the web interface of the Cisco Prime Service Catalog management tool arises from the lack of protection against Cross-Site Request Forgery (CSRF) attacks. This allows attackers to perform arbitrary actions on vulnerable devices.

The vulnerability of the Cisco Prime Service Catalog management web interface is related to the lack of protection against Cross-Site Request Forgery CSRF attacks. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device using a specially create...

Cisco Prime Service Catalog Cross-Site Request Forgery Vulnerability (CNVD-2019-18752)

Cisco Prime Service Catalog PSC is a service catalog solution from Cisco that provides all IT services through a single portal. The solution supports automated ordering of a unified service catalog for compute, network, storage, and other data center resources. A cross-site request forgery...

Cisco Prime Infrastructure Virtual Domain System Privilege Permission and Access Control Issues Vulnerability

Cisco Prime Infrastructure Software is a set of Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS technologies for wireless management. Virtual Domain system is one of the virtual domain system. A privilege permission and access control error vulnerability exists ...

The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and network device management system, as well as the Cisco Evolved Programmable Network (EPN) Manager software, relates to errors in handling HTTP requests. This vulnerability allows an attacker to gain access to protected information.

The vulnerability of the web interface for managing Cisco Prime Infrastructure network equipment and the Cisco Evolved Programmable Network EPN Manager software relates to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to gain access to protected...

The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and network device management system, as well as the Cisco Evolved Programmable Network (EPN) Manager software, relates to errors in handling HTTP requests. This vulnerability allows an attacker to gain access to protected information.

The vulnerability of the web interface for managing Cisco Prime Infrastructure network equipment and the Cisco Evolved Programmable Network EPN Manager software relates to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to gain access to protected...

The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and network device management system, as well as the Cisco Evolved Programmable Network (EPN) Manager software, relates to errors in handling HTTP requests. This vulnerability allows an attacker to gain access to protected information.

The vulnerability of the web interface for managing Cisco Prime Infrastructure network equipment and the Cisco Evolved Programmable Network EPN Manager software relates to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to gain access to protected...

CVE-2019-1874

A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protection mechanisms on the...

CVE-2019-1875

A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by...

CVE-2019-1874

A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protection mechanisms on the...

CVE-2019-1906

A vulnerability in the Virtual Domain system of Cisco Prime Infrastructure PI could allow an authenticated, remote attacker to change the virtual domain configuration, which could lead to privilege escalation. The vulnerability is due to improper validation of API requests. An attacker could...

CVE-2019-1875

A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by...