CVE-2012-2292

The CVE-2012-2292 issue affects RSA Archer products: EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x prior to 5.2SP1. Root cause: a misconfigured Silverlight cross-domain policy that does not restrict access to the Archer application, allowing remote attackers to bypass the Same Or...

CVE-2012-2294

CVE-2012-2294 affects EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x earlier than 5.2SP1. The issue is a clickjacking vulnerability exposed via crafted web pages, allowing remote attackers to entice user actions in a legitimate session. The NVD entry lists a CVSSv2 base score of 6...

PT-2013-1522

Name of the Vulnerable Software and Affected Versions EMC RSA Archer SmartSuite Framework versions 4.x RSA Archer GRC versions 5.x before 5.2SP1 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which can lead to multiple cross-site...

PT-2013-1559

Name of the Vulnerable Software and Affected Versions EMC RSA Archer SmartSuite Framework versions 4.x RSA Archer GRC versions 5.x through 5.2 before 5.2SP1 Description The issue concerns the Silverlight cross-domain policy, which fails to restrict access to the Archer application. This allows...

PT-2013-1560

Name of the Vulnerable Software and Affected Versions EMC RSA Archer SmartSuite Framework versions 4.x RSA Archer GRC versions 5.x before 5.2SP1 Description The issue allows remote authenticated users to upload files and consequently execute arbitrary code via a relative path, due to a directory...

CVE-2012-1064: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x before 5.2SP1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2292: Undefined Security Weakness

The Silverlight cross-domain policy in EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x before 5.2SP1 does not restrict access to the Archer application, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors...

CVE-2012-2294: Improper Input Validation

EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x before 5.2SP1 allow remote attackers to conduct clickjacking attacks via a crafted web page...

CVE-2012-2293: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x before 5.2SP1 allows remote authenticated users to upload files, and consequently execute arbitrary code, via a relative path...

PT-2013-1561

Name of the Vulnerable Software and Affected Versions EMC RSA Archer SmartSuite Framework versions 4.x RSA Archer GRC versions 5.x before 5.2SP1 Description The issue allows remote attackers to conduct clickjacking attacks via a crafted web page. Recommendations For EMC RSA Archer SmartSuite...

More from the Kaspersky Lab/Threatpost Security Analyst Summit

Chris Soghoian on Wireless Carriers and Android Security Partial Disclosure Leaves Adobe Reader Zero-Day Story in Limbo Wireless Carriers Put on Notice About Providing Regular Android Security Updates How the RSA Attackers Swung and Missed at Lockheed Martin Scenes from SAS 2012 SAS2013 on Twitte...

How the RSA Attackers Swung and Missed at Lockheed Martin

SAN JUAN, PUERTO RICO–The attack that resulted in the compromise of RSA’s SecurID database in 2011 had a lot of ramifications and sent shockwaves through much of the security industry. But it could have had much broader consequences had the security team at Lockheed Martin not discovered the same...

jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key

A flaw was found in JBoss web services where the services used a weak symmetric encryption protocol, PKCS1 v1.5. An attacker could use this weakness in chosen-ciphertext attacks to recover the symmetric key and conduct further attacks...

Eddie Schwartz of RSA

Eddie Schwartz, CISO of RSA, emphasized the need for enterprises to use the data they have on their networks to help defend against targeted attacks...

GitHub Search Down After Some Credentials and Crypto Keys Exposed

GitHub’s search capability remains dark Friday after it was discovered that the code-sharing site’s search feature could be used to dredge up passwords, private crypto keys, and other credentials developers use in their projects. GitHub is a popular collaboration site for open source software...

SuSE 11.1 Security Update : strongswan (SAT Patch Number 6333)

This update fixed a security issue in strongswan's 'gmp' plugin which could be exploited by attackers to forge RSA signature/certificate to authenticate as any legitimate user. CVE-2012-2388 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

RHEL 5 : ecryptfs-utils (RHSA-2009:1307)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2009:1307 advisory. eCryptfs is a stacked, cryptographic file system. It is transparent to the underlying file system and provides per-file granularity. eCryptfs is...

Contacto SQL Injection

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Author: Ur0b0r0x Twitte: @Ur0b0r0x Email: [email protected] Line: GreyHat Home: ur0b0r0x.blogspot.com Exploit Title: Diseño CONTACTO - Sql Injection Vulnerability...

Report Contends 'Project Blitzkrieg' Threat Credible

Earlier reports of a planned, sophisticated attack on 30 U.S. banks to siphon millions from fake wire transfers have been vetted by McAfee Labs in a just-released report. Speculation about the authenticity of the planned attack, dubbed Project Blitzkrieg, on large U.S. financial institutions...

openSUSE: Security Advisory for update (openSUSE-SU-2012:0691-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...