Microsoft Sharepoint - Bypass & Persistent Vulnerability

Document Title: =============== Microsoft Sharepoint - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1024 Microsoft Security Response Center MSRC ID: 15181 Release Date: ============= 2014-01-13 Vulnerability Laborator...

IG Report Shows DHS Making Progress, But Still Has Room to Improve on Information Security

Although there are still a number of issues that need to be addressed with the Department of Homeland Security’s information security efforts, the department is improving in many areas and making strong progress toward implementing better security controls, a new report from the Inspector General...

ESA-2013-067: RSA® Authentication Agent for Web for Internet Information Services (IIS) Security Controls Bypass Vulnerability

ESA-2013-067.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-067: RSA® Authentication Agent for Web for Internet Information Services IIS Security Controls Bypass Vulnerability EMC Identifier: ESA-2013-067 CVE Identifier: CVE-2013-3280 Severity Rating: CVSS v2 Base Score: 9.0...

Adobe Reader Remote Code Execution Vulnerability (APSB13-25) - Windows

Adobe Reader is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Acrobat Remote Code Execution Vulnerability (APSB13-25) - Windows

Adobe Acrobat is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cisco Releases Security Advisories

Cisco has released two security advisories to address multiple vulnerabilities. These vulnerabilities could allow an attacker to obtain elevation of privilege, bypass security controls, or cause a denial of service condition. US-CERT encourages users and administrators to review the following Cis...

4th Cybersecurity Framework Workshop: Good News and Bad News

I had a chance to visit a number of industrial events this year and can see the evolution of cybersecurity in the industrial field. One of these was the 4th National Institute of Standards and Technology’s NIST Cybersecurity Framework Workshop CFW. Kaspersky was in attendance at the previous...

Mozilla WebMaker - Filter Bypass & Cross Site Vulnerability

Document Title: =============== Mozilla WebMaker - Filter Bypass & Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=981 Mozilla Bug ID: 835445 Release Date: ============= 2013-07-09 Vulnerability Laboratory ID VL-ID:...

Google Adds Feature to Keep Malware Out of Chrome Web Store

Google is adding more security controls to its browser-based Chrome Web Store by adding a new application-vetting feature called ‘Enhanced Item Validation.’ For all intents and purposes, the search giant claims that the new policy will only impact application developers in that they will have to...

26 Million Veterans data breached by eight state sponsored organizations

Since 2010, foreign state sponsored organizations have repeatedly compromised an unencrypted database maintained by the Veterans Affairs Department that contains personally identifiable information on roughly 26 million veterans. Including at least eight foreign-sponsored organizations, mostly...

26 Million Veterans data breached by eight state sponsored organizations

Since 2010, foreign state sponsored organizations have repeatedly compromised an unencrypted database maintained by the Veterans Affairs Department that contains personally identifiable information on roughly 26 million veterans. Including at least eight foreign-sponsored organizations, mostly...

Apple Releases OS X 10.8.4 and Security Update 2013-002

Apple has released OS X 10.8.4 and Security Update 2013-002 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, obtain sensitive information, bypass security controls, or cause denial-of-service conditions. US-CERT encourages users and...

Google Releases Google Chrome 27.0.1453.110

Google has released Google Chrome 27.0.1453.110 for Windows, Macintosh, Linux and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow a remote attacker to cause a denial-of-service condition, bypass security controls or execute arbitrary code. US-CERT encourages user...

Microsoft flaw allows USB loaded with payload to bypass security controls

During March Patch Tuesday of 2013, Microsoft released seven new security bulletins, with four rated as critical, and others as Important. Most interesting one was MS13-027, which is rated as "important" because the attack requires physical access to the vulnerable machine. This flaw allows anyon...

Microsoft flaw allows USB loaded with payload to bypass security controls

During March Patch Tuesday of 2013, Microsoft released seven new security bulletins, with four rated as critical, and others as Important. Most interesting one was MS13-027, which is rated as "important" because the attack requires physical access to the vulnerable machine. This flaw allows anyon...

War on Passwords? Check with Your QSA First!

Passwords have long been the workhorse of user authentication schemes, and many security experts are speaking out on the need for more effective controls. It seems like hardly a week goes by when we dont see a password breach in the news...

GAO: FCC Network Fortification Project Fails

The Government Accountability Office has determined that the Federal Communications Commission failed to properly implement necessary security controls in the initial phases of its Enhanced Secured Networks project, and, as a result, FCC data remains vulnerable to “unnecessary risk of inadvertent...

Malware Infects Two Power Plants Lacking Basic Security Controls

During the past three months, unnamed malware infected two power plants’ control systems using unprotected USB drives as an attack vector. At both companies, a lack of basic security controls made it much easier for the malicious code to reach critical networks. In one instance, according to a...

Information of Nearly 4,000 Beth Israel Patients at Risk in Stolen Laptop Incident

The information of nearly 4,000 patients at Boston’s Beth Israel Deaconess Medical Center BIDMC may have been leaked according to a report from the Boston Globe over the weekend. A laptop was stolen from the Harvard-associated teaching hospital on May 22 that could yield the incomplete medical...

Author of LilyJade Facebook Plugin Ignores Facebook Cease-and-Desist

As the tech and investment banking worlds eagerly anticipate Facebook’s long-awaited initial public offering, the world’s largest social network is trying to put stops to a suspicious, but arguably benign, plugin. According to a Brian Krebs report, Dru Mundorff of Arizona is shamelessly selling t...