Security Event : Hack In Paris (16-17 June, 2011)

Security Event : Hack In Paris 16-17 June, 2011 Hack In Paris is an international and corporate security event that will take place in Disneyland Paris® fromJune 16th to 17th of 2011. Please refer to the homepage to get up-to-date information about the event. Topics The following list contains...

IT Security Metrics: The Enterprise FUD Killer

One of the greatest knocks on the information security profession is that IT security is always asking for budget to spend against the latest threat, only to abandon the cause like harried firefighters, jumping from one conflagration to the next. Viruses, worms, spam, network access control, data...

IT Compliance Matures into Risk Management

Over the past ten years rapid change and an evolving threat landscape has better prepared Coalfire to defend our clients against known risks. Not surprisingly, much of the progress is due to compliance-related investments. As we look towards the next ten years, we see a proactive risk management...

Elcom CommunityManager.NET Auth Bypass Vulnerability - Security Advisory - SOS-10-004

Elcom CommunityManager.NET Auth Bypass Vulnerability - Security Advisory - SOS-10-004 Release Date. 20-Dec-2010 Last Update. - Vendor Notification Date. 22-Jan-2010 Product. Elcom Technology's CommunityManager.NET Platform. IIS with ASP.NET Affected versions. v6.7 verified and possibly others...

Elcom CommunityManager.NET - Authentication Bypass

Elcom CommunityManager.NET Auth Bypass Vulnerability - Security Advisory - SOS-10-004 Release Date. 20-Dec-2010 Last Update. - Vendor Notification Date. 22-Jan-2010 Product. Elcom Technology's CommunityManager.NET Platform. IIS with ASP.NET Affected versions. v6.7 verified and possibly others...

The Case for Enterprise Cyber Ranges

The illustrious op-ed page of the Wall Street Journal featured talk of cyberwar again this week with “How to Fight and Win the Cyberwar.” The piece, written by Mortimer Zuckerman, rehashes some important facts: U.S. critical infrastructure, including the parts of it owned by major enterprises, is...

Cloud Security Alliance Releases New Toolkit

In an effort to better weigh the security of cloud-based infrastructures, the Cloud Security Alliance has released a new toolkit, the Governance, Risk Management and Compliance GRC Stack. Available as a free download on the organization’s website, the collection consists of three tools: CloudAudi...

Lean Times Demand Smart Security Spending

When it comes to security, it’s planning and execution – not the size of the budget – that matter. With the U.S. economy showing the barest signs of recovering from the recession, the consensus among economists is for a very flat recovery to continue through 2011. For IT security staff, that mean...

DLL Hijacking: Facts and Fiction

It’s been interesting watching DLL hijacking grow from interesting phenomena to a full-on snowball of hype and FUD over the last few days. As of this writing Google turns up 152 news articles on the subject. The vast majority of coverage is calling this a “new class of attack” and pointing out ho...

Protecting Customers From Online Threats

Allison Miller of PayPal’s Global Risk Management group discusses the challenges of keeping the service’s customers safe online in a session at the SOURCE conference in Boston...

Fixing a Security Problem Isn't Always the Right Answer

An unidentified man breached airport security at Newark Airport on Sunday, walking into the secured area through the exit, prompting an evacuation of a terminal and flight delays that continued into the next day. This problem isn’t common, but it happens regularly. The result is always the same,...

Trident Risk Management's Nick Selby on Metasploit and Rapid7

The Big Story podcast with Ryan Naraine – October 22, 2009 Trident Risk Management‘s Nick Selby joins the Big Story podcast to discuss the latest news around Metasploit and Rapid7 and how this affects issues around penetration testing and exploit creation and release. Download Podcast audio...

Piwigo SQL Injection Vulnerability - Security Advisory - SOS-09-007

Piwigo SQL Injection Vulnerability - Security Advisory - SOS-09-007 Release Date. 17-Aug-2009 Last Update. - Vendor Notification Date. 15-Jun-2009 Product. Piwigo Platform. Independent Affected versions. 2.0.0 verified, possibly others Severity Rating. Medium Impact. Manipulation of data Attack...

XOOPS 2.3.3 Cross Site Scripting

XOOPS Multiple Cross-Site Scripting Vulnerabilities - Security Advisory - SOS-09-005 Release Date. 31-Jul-2009 Vendor Notification Date. 15-Jun-2009 Product. XOOPS Platform. Independent Affected versions. 2.3.3 verified, possibly others Severity Rating. Medium Impact. Cookie/credential theft,...

Feds should let private sector lead on cybersecurity

From SearchSecurity.com Eric Ogren The federal government has whipped itself into a frenzy on the issue of cybersecurity recently, as evidenced by the numerous competing bills in the House and Senate and the high-level wrangling over which agency should run cybersecurity. Washington certainly has...

Dan Geer: Risk management should change the future

By Joan Goodchild, CSO “The dean of the security deep thinkers,” “security luminary, ” and “risk-management pioneer” are all phrases that have been used to describe Dan Geer. Considered one of the foremost leaders in information security, his resume includes time as president and chief scientist ...

Symantec Altiris Deployment Solution Local Access Elevation of Privilege in Client GUI

SUMMARY A local access elevation of privilege issue has been identified and resolved in the Symantec Altiris Deployment Solution Client GUI. Successful exploitation could result in unauthorized local system access on a client system. Severity Medium Remote Access adjacent network | No ---|--- Loc...

verisign-xss.txt

VeriSign Kontiki Delivery Management System DMS Cross-Site Scripting Vulnerability CVE Number: CVE-2008-4393 Vulnerability Type / Importance: XSS / Medium Problem discovered: September 24th 2007 Vendor contacted: September 26th 2007 Advisory published: March 28th 2008 Abstract The Kontiki Deliver...

Unfixed XSS vulnerability at www.vertica-risk-management.co.uk

Security researcher PaPPy, has submitted on 08/11/2008 a cross-site-scripting XSS vulnerability affecting www.vertica-risk-management.co.uk, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 03/07/2009. It...

Symantec Altiris Notification Server Agent GUI Local Elevation of Privilege

SUMMARY A non-privileged user can leverage the Symantec Altiris Notification Server Agent Graphical User Interface GUI to gain privileged access to the system. Severity Medium Remote Access adjacent network | No ---|--- Local Access | Yes Authentication Required | Yes Exploit available | No...