CVE-2017-3972 SB10192 - Network Security Management (NSM) - Infrastructure-based foot printing vulnerability

Infrastructure-based foot printing vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows attackers to execute arbitrary code via the server banner leaking potentially sensitive or security relevant information...

AlienVault USM and OSSIM Remote Code Execution Vulnerabilities

AlienVault USM and OSSIM are both products of AlienVault Inc. of the U.S. USM is a set of security management platform that provides security monitoring, security event management and reporting, threat awareness system, etc. OSSIM is an open source security information management system. A securi...

Solaris 10 (sparc) : 121161-01

System Manager 1.1: Common Core Patch. Date this patch was last updated by Sun : May/15/06 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Cisco Email Security Appliance and Cisco Content Security Management Appliance Information Disclosure Vulnerability

Cisco Email Security Appliance ESA and Cisco Content Security Management Appliance SMA are both products of Cisco USA.Cisco ESA is a set of email security appliances, which provides spam protection, email encryption, data loss protection and other functions. Cisco ESA is an email security applian...

AlgoSec Detection

Detection of AlgoSec Security Management Solution. The script sends a connection request to the server and attempts to detect AlgoSec and to extract its version. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted...

Website Security Dog suffers from SQL Injection Vulnerability

Security Dog is a comprehensive server security protection tool that integrates server security protection and security management. Website Security Dog suffers from SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

CVE-2018-0140

A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of...

Cisco Content Security Management Appliance Privilege Escalation Vulnerability

According to its self-reported version, the Cisco Content Security Management Appliance SMA is affected by a privilege escalation vulnerability. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

CVE-2018-0095

A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance ESA and Content Security Management Appliance SMA could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential wi...

CVE-2018-0095

A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance ESA and Content Security Management Appliance SMA could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential wi...

CVE-2018-2630

Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications subcomponent: Security Management System. Supported versions that are affected are 11.5.0, 11.6.0 and 11.7.0. Easily exploitable vulnerability allows low privileged attacker with network...

CVE-2018-2630

CVE-2018-2630 affects Oracle FLEXCUBE Universal Banking (Security Management System subcomponent). Affected versions: 11.5.0, 11.6.0, 11.7.0. The vulnerability allows a low-privileged, network-accessible attacker over HTTP to compromise data: unauthorized update/insert/delete of some data and una...

CVE-2018-2630

Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications subcomponent: Security Management System. Supported versions that are affected are 11.5.0, 11.6.0 and 11.7.0. Easily exploitable vulnerability allows low privileged attacker with network...

Cisco ESA and Content SMA Elevation of Privilege Vulnerabilities

Cisco Email Security Appliances ESAs are email security gateway products designed to detect and block a variety of email-borne threats, such as malware, spam, and phishing attacks.The Cisco Content Security Management Appliance SMA centralizes multiple Cisco email and network security appliances'...

Cisco Email Security and Content Security Management Appliance Privilege Escalation Vulnerability

A vulnerability in the administrative shell of the Cisco Email Security Appliance ESA and Content Security Management Appliance SMA could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a...

Unspecified Vulnerability in Oracle FLEXCUBE Universal Banking (CNVD-2018-02390)

Oracle FLEXCUBE Universal Banking is a real-time, online, comprehensive global core banking solution covering retail, corporate and investment banking. An unspecified vulnerability exists in the Security Management System component of Oracle FLEXCUBE Universal Banking. An attacker could exploit...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 8, 2018

Last week, three interesting vulnerabilities popped up on the news and security feeds. Researchers disclosed CVE-2017-5753 and CVE-2017-5715, collectively known as Spectre, and CVE-2017-5754, known as Meltdown. These vulnerabilities take advantage of “speculative execution” of instructions...

HP ArcSight Enterprise Security Manager and ArcSight Enterprise Security Manager Express Access Control Error Vulnerability

HP ArcSight ESM Enterprise Security Manager and ESM Express are both enterprise security management software with event correlation and security analysis capabilities from Hewlett Packard Enterprise HPE. The software collects, correlates and reports on enterprise-wide security events in real time...

Building a Security Risk Management Program

The frequency of data breaches today highlights the need to peel back the onion on security programs and identify a laser-focused mission and ultimate goal. As a compliance manager, I know the horror stories first hand. Let’s take a deeper dive into security and risk management basics to enable...

McAfee ePolicy Orchestrator DataChannel Blind SQL Injection Vulnerability(CVE-2016-8027)

Summary An exploitable blind sql injection vulnerability exists within McAfee's ePolicy Orchestrator 5.3.0 that is accessible without authentication. A specially crafted HTTP post can allow an aggressor to alter a sql query which can result in disclosure of information within the database or...