New PCI DSS Scoping Guidance Corroborates Coalfire’s Approach

On Friday, December 6th 2016, the PCI Security Standards Council released their formal information supplement titled, Guidance for PCI DSS Scoping and Network Segmentation. This particular information supplement has been eagerly anticipated in the PCI DSS industry for several years. The document...

Apple Delays App Transport Security Deadline

Apple backtracked on its plan to enforce a year-end deadline that would of required developers to move apps to an HTTPS-only model in an effort to thwart eavesdropping on insecure, plaintext HTTP connections. On Wednesday Apple said a requirement for developers to adopt App Transport Security wou...

[SECURITY] Fedora 23 Update: firefox-50.1.0-1.fc23

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 25 Update: firefox-50.1.0-1.fc25

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 23 Update: firefox-50.0.2-1.fc23

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 23 Update: firefox-50.0-1.fc23

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 25 Update: firefox-50.0-1.fc25

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 25 Update: firefox-49.0.2-1.fc25

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 24 Update: firefox-50.0-1.fc24

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 23 Update: firefox-49.0.2-1.fc23

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Revive Adserver: Weak Forgot Password implementation

"Cricetinae" : Short Description The Forgot Password is missing a several industry best practices. I strongly believe due to the level of the access given after a successful exploitation, the implementation could have been better. Vulnerability Details Referring to OWASP Standards and guidelines...

[SECURITY] Fedora 23 Update: firefox-49.0-2.fc23

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 24 Update: firefox-49.0-2.fc24

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 25 Update: firefox-49.0-2.fc25

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 23 Update: drupal7-theme-zen-5.6-1.fc23

Zen is a powerful, yet simple, HTML5 starting theme with a responsive, mobile-first grid design. If you are building your own standards-compliant theme, you will find it much easier to start with Zen than to start with Garland or Stark. This theme has fantastic online documentation...

[SECURITY] Fedora 23 Update: firefox-48.0-5.fc23

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Export-Grade Crypto Patching Improves

LAS VEGAS – The FREAK, LOGJAM and DROWN attacks of the last 17 months weren’t just the work of academics and security researchers who found a cool way to unmask encrypted traffic. They were ugly reminders of the Crypto Wars of the 1990s and why export-grade cryptography and intentional encryption...

The vulnerability of Adobe Pepper Flash software for Google Chrome allows a malicious intruder to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability exists in Adobe Pepper Flash for Google Chrome due to an incorrect limitation of the SWF file format. Exploiting this vulnerability allows malicious actors to carry out attacks on endpoints using JSONP requests through Cross-Site Request Forgery CSRF. These actors can gain acces...

The Correlated Vulnerability And Threat Database: vFeed

vFeed Framework is a CVE, CWE and OVAL Compatible naming scheme concept that provides extra structured detailed third-party references and technical characteristics for a CVE entry through an extensible XML/JSON schema. It also improves the reliability of CVEs by providing a flexible and...

FTC Closes 70 Percent of Data Breach Investigations, Weighing PCI-DSS Standard

The Federal Trade Commission doesn’t investigate every reported breach, but when it comes to prosecuting data security cases it has an impressive 70 percent closure rate, according to agency officials. FTC Commissioner Maureen Ohlhausen shed light on the agency’s approach to enforcing data securi...