Code injection

The ADDW macro in stdio-common/vfscanf.c in the GNU C Library aka glibc or libc6 before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service segmentation violatio...

CVE-2015-1473

The ADDW macro in stdio-common/vfscanf.c in the GNU C Library aka glibc or libc6 before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service segmentation violatio...

Top 10 Cybersecurity Predictions for 2015

Fueled by cybercrime, cyber warfare, and cyber terrorism, the cost of cybersecurity and risk management will double in 2015. Thats the bad news. The good news is there will be a shift to cyber offense that will begin to stem the tide of cyber threats...

Michael Chertoff Risk Management ACSC Keynote

BOSTON – Former Homeland Security secretary Michael Chertoff gave enterprises a pep talk Wednesday during his keynote address at the Advanced Cyber Security Center’s annual conference. In a climate where massive financial services organizations such as JP Morgan Chase have been breached, the Whit...

jQuery.com Hacked, Redirecting to RIG Exploit Kit

Owners of websites built using the jQuery library are being warned of an attack against the toolkit’s website which is redirecting visitors to a third-party site hosting the RIG exploit kit. JQuery is a free and open source JavaScript library used for a number of things, including building AJAX...

IBM Algorithmics RICOS 4.5.0 - 4.7.0 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications title: Multiple severe vulnerabilities product: IBM Algorithmics RICOS vulnerable version: 4.5.0 - 4.7.0 fixed version: 4.7.0.03 CVE number: CVE-2014-0894 CVE-2014-0871 CVE-2014-0870 CVE-2014-0869 CVE-2014-0868 CVE-2014-0867 CVE-2014-0866...

PHP Captcha / Securimage 2.0.2 - Authentication Bypass - SO-11-007

No description provided by source. Sense of Security - Security Advisory - SOS-11-007 Release Date. 20-May-2011 Last Update. - Vendor Notification Date. 04-Apr-2011 Product. Securimage / PHPCaptcha Platform. PHP Affected versions. 1.0.4 - 2.0.2 Severity Rating. Medium Impact. Authentication bypas...

SimpleRisk 20130915-01 - Multiple Vulnerabilities

No description provided by source. 1. Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS CWE-79, OWASP-...

QNAP Turbo NAS 3.6.1 Build 0302T Multiple Vulnerabilities

No description provided by source. Sense of Security - Security Advisory - SOS-12-006 Release Date. 13-Jun-2012 Last Update. - Vendor Notification Date. 12-Mar-2012 Product. QNAP Platform. Turbo NAS verified and possibly others Affected versions. Firmware Version: 3.6.1 Build 0302T and prior...

IBM Algorithmics RICOS Disclosure / XSS / CSRF

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple severe vulnerabilities product: IBM Algorithmics RICOS vulnerable version: 4.5.0 - 4.7.0 fixed version: 4.7.0.03 CV...

Regulators Planning Cybersecurity Assessments for Banks

A government agency in charge of developing standards for the nation’s banks announced last week that it will work harder to try to identify vulnerabilities in smaller community banks and that it’s planning to better raise awareness when it comes to cyber threats. The Federal Financial Institutio...

Microsoft Releases Free Threat Modeling Tool 2014

Threat modeling has been part of the security culture at Microsoft for the better part of a decade, an important piece of the Security Development Lifecycle that’s at the core of Trustworthy Computing. Today, Microsoft updated its free Threat Modeling Tool with a number of enhancements that bring...

Threat Outbreak Alert: Fake Account Payment Confirmation Email Messages on March 27, 2014

Medium Alert ID: 33537 First Published: 2014 March 27 15:30 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an account payment confirmation notice for the recipient. The text in the email message attempts to convince the...

IBM Algo One Algo Risk Application目录遍历漏洞

Bugtraq ID:65929 CVE ID:CVE-2013-6304 IBM Algo One是一个风险管理软件解决方案。 IBM Algo One不正确过滤用户提交的输入，允许远程攻击者利用漏洞提交目录遍历序列请求获取任意文件内容。 0 IBM Algo One 2.x IBM Algo One 4.x 厂商补丁： IBM ----- 用户可参考如下厂商提供的安全补丁以修复该漏洞： https://www.ibm.com/support/docview.wss?uid=swg21666093...

IBM Algo One Algo多个安全漏洞

CVE ID:CVE-2013-6299、CVE-2013-6300、CVE-2013-6301、CVE-2013-6302、CVE-2013-6303、CVE-2013-6318、CVE-2013-6319、CVE-2013-6320、CVE-2013-6331、CVE-2013-6333 IBM Algo One是一个风险管理软件解决方案。 IBM Algo One存在多个安全漏洞： 1，应用程序不正确校验用户权限，允许攻击者利用漏洞获取受限内容。 2，存在多个跨站脚本漏洞，允许攻击者构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。...

Cybersecurity Framework for U.S. Critical Infrastructure

Critical infrastructure operators have been delivered a cybersecurity framework by the U.S. government that paints broad strokes as to how to defend IT and SCADA networks in some of the country’s most sensitive industries such as energy, water and financial services. NIST today announced the...

CVE-2013-2747

The password reset feature in Courion Access Risk Management Suite Version 8 Update 9 allows remote authenticated users to bypass intended Internet Explorer usage restrictions and execute arbitrary commands by using keyboard shortcuts to navigate the file system and open a command prompt...

CVE-2013-2747

The password reset feature in Courion Access Risk Management Suite Version 8 Update 9 allows remote authenticated users to bypass intended Internet Explorer usage restrictions and execute arbitrary commands by using keyboard shortcuts to navigate the file system and open a command prompt...

CVE-2013-2747

The CVE-2013-2747 affects Courion Access Risk Management Suite (Version 8 Update 9). The password reset feature allows remote authenticated users to bypass Internet Explorer usage restrictions and execute arbitrary commands by using keyboard shortcuts to navigate the file system and open a comman...

[CVE-2014-1238] Cross Site Scripting(XSS) in q-pulse application

Cross-Site Scripting XSS in Q-Pulse application Advisory ID: hag201475 Product: q-pulse risk management software Vendor: q-pulse Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: Januray 14, 2013 Vendor Notification: July 31, 2013 Public Disclosure: December 31...