CVE-2018-2720

CVE-2018-2720 affects Oracle Financial Services Liquidity Risk Management (Oracle Financial Services Applications), specifically the User Interface subcomponent in version 8.0.x . The vulnerability allows a low privileged attacker with network access via HTTP to compromise the product, enabling u...

CVE-2018-2682

CVE-2018-2682 affects Oracle Financial Services Liquidity Risk Management, subcomponent User Interface, in Oracle Financial Services Applications (version 8.0.x). The vulnerability allows an unauthenticated attacker with network access via HTTP to potentially compromise the Liquidity Risk Managem...

CVE-2018-2682

Vulnerability in the Oracle Financial Services Liquidity Risk Management component of Oracle Financial Services Applications subcomponent: User Interface. The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP...

CVE-2018-2720

Vulnerability in the Oracle Financial Services Liquidity Risk Management component of Oracle Financial Services Applications subcomponent: User Interface. The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ...

CVE-2018-2720

Vulnerability in the Oracle Financial Services Liquidity Risk Management component of Oracle Financial Services Applications subcomponent: User Interface. The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ...

The Third Question(s) Today’s CEOs Should Ask (& Know the Answers To)

In a previous blog, we discussed Commander’s Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am going to take a deeper dive into each question and break them down one at a time. We will discuss why CEOs should care about each question and the...

The Third Question(s) Today’s CEOs Should Ask (& Know the Answers To)

In a previous blog, we discussed Commander’s Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am going to take a deeper dive into each question and break them down one at a time. We will discuss why CEOs should care about each question and the...

The Second Question(s) Today’s CEOs Should Ask (& Know the Answers To)

In a previous blog, we discussed Commander’s Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am going to take a deeper dive into each question and break them down one at a time. We will discuss why CEOs should care about each question and the...

January 9, 2017 – Morning Cyber Coffee Headlines – “NCAA Football National Championship” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 9, 2018 - Headlines Carbon Black in the News: Ransomware is now estimat...

Partner Perspectives: Red Canary ATT&CKs (Part 1): Why We’re Using ATT&CK Across Red Canary

Editor's Note: This blog originally appeared on RedCanary.com Information security is grounded in risk management. And, because what gets measured gets managed, we rely on a variety of frameworks and key performance indicators to tell us whether we’re moving in the right direction. Frameworks lik...

The First Question(s) Today’s CEOs Should Ask (& Know the Answers To)

In a previous blog, we discussed Commander's Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am going to take a deeper dive into each question and break them down one at a time. We will discuss why CEOs should care about each question and the...

SimpleRisk v20170416-001 Reflected XSS Vulnerabilities

Summary SimpleRisk is an open-source risk management system released under Mozilla Public License and used for risk management activities. It enables risk managers to account for risks, plan mitigation measures, facilitate management reviews, prioritize for project planning, and track periodic...

EMC ScaleIO 2.0.1.x Buffer Overflow / Information Disclosure Vulnerabilities

EMC ScaleIO versions 2.0.1.3, 2.0.1.2, 2.0.1.1, and 2.0.1 suffer from information disclosure, denial of service, and buffer overflow vulnerabilities. ESA-2017-094: EMC ScaleIO Multiple Vulnerabilities EMC Identifier: ESA-2017-094 CVE Identifier: CVE-2017-8001, CVE-2017-8019, CVE-2017-8020 Severit...

Protecting Critical Infrastructure from Cyber Threats

This last week of National Cyber Security Awareness Month NCSAM, we focus on critical infrastructure CI. For many years now we have discussed and seen the result of poorly designed and protected control system networks. I wrote on this very topic back in 2016. Now the threat landscape has evolved...

The Value of Governance in Minimizing Cybersecurity Incidents

Part Two of a Three Part Series Since Equifaxs September 15th statement about their well-publicized, broadly discussed major security incident, Coalfire has fielded multiple inquiries from clients who are wondering if such an incident could happen to them, and if there is anything that they can d...

Building a Security Risk Management Program

The frequency of data breaches today highlights the need to peel back the onion on security programs and identify a laser-focused mission and ultimate goal. As a compliance manager, I know the horror stories first hand. Let’s take a deeper dive into security and risk management basics to enable...

Three Ways to Use Data Classification Scan Results

In July we launched Classifier, a free data classification tool that allows you to quickly and easily uncover sensitive data in your databases. Since its launch, the tool has been widely used around the globe, which comes as no surprise given the heightened focus on data protection. Furthermore,...

Cybersecurity Executive Order 13800: More than a Risk Assessment?

Written by Sr. Solutions Engineer, Micah Maryn. Most folks around the Washington DC beltway have heard the cybersecurity Executive Order EO 13800 - Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure referred to as a simple risk assessment. But the reality is that it i...

How to Address Major Gaps in Third-Party Risk Management Programs

While securing the organizational environment, its easy to focus on the enterprise assets without thinking as much about the vendor ecosystem. However, that extended ecosystem and how it interacts with the organization is a potential significant risk if not secured properly...

CVE-2017-10046

CVE-2017-10046 is an HTTP Response Splitting vulnerability in Oracle Primavera P6 Enterprise Project Portfolio Management (Web Access). Affected versions: 8.3, 8.4, 15.1, 15.2, 16.1. An attacker with network access via HTTP and low privileges can exploit a crafted input (languageCode cookie) to m...