CVE-2011-4958

Cross-site scripting XSS vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING to template placeholders, as demonstrated by a request to 1 admin/reports/, 2...

Cross site scripting

Cross-site scripting XSS vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING to template placeholders, as demonstrated by a request to 1 admin/reports/, 2...

Critical Infrastructure Beyond the Power Grid

The term "critical infrastructure" has earned its spot on the board of our ongoing game of cyber bingo--right next to "Digital Pearl Harbor," "Cyber 9/11," "SCADA" and "Stuxnet." With "critical infrastructure" thrown about in references to cyber threats nearly every week, we thought it was time f...

Politics, Uncertainty Slowing Down U.S. Response to Cyber Threats

WASHINGTON–The shift in the last few years to cyberespionage and online attacks against the nation’s critical infrastructure have left the United States government lagging behind, and “a day late and a dollar short”, the former director of the National Security Agency said. The ongoing campaigns...

CVE-2012-4983

The CVE-2012-4983 issue affects Forescout CounterACT/NAC devices, with XSS vulnerabilities on the login page via the a parameter and on the rangesearch query, allowing arbitrary script injection. It applies to versions prior to 7.0 (notably seen in 6.3.4.1). Impact includes potential redirection ...

Adobe Bridge Installed

Adobe Bridge is installed on the remote Windows host. Bridge is used to organize creative assets, and provide centralized access for applications in the Adobe Creative Suite. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid62681; scriptversion"1.13";...

Think Like a Hacker for Better Security

Computer hacking is truly an epidemic. It's not enough to apply the latest patches to your servers and workstations or otherwise defend yourself reactively. If you're in charge of your network's security, you must understand how hackers minds work and what tools they're using for their attacks...

webo site speedup 1.6.1 - Multiple Vulnerabilities

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2012-06-16 WEBO Site SpeedUp = 1.6.1 Multiple Vulnerabilites Script: "WEBO Site SpeedUp is a PHP solution that automatically...

Serco: 'Sophisticated' Attack On U.S. Govt. Pension Plan Nets Info On 123k

Serco Inc., a well-known contractor working with the U.S. government, announced that it was the target of a sophisticated attack that exposed data on 123,000 civil employees of the Federal government and their families, including names, addresses and social security numbers taken from the company...

Talk to IT

Well in advance of your departure date, have a sit-down with IT to talk about your trip and about how to avoid exposing sensitive corporate assets and information to compromise. Your IT group will probably be able to help you find work arounds, secure a line back to the company network and even...

Duqu - Next Major Cyber Weapon like Stuxnet

Duqu - Next Major Cyber Weapon like Stuxnet The Stuxnet cyberworm could soon be modified to attack vital industrial facilities in the US and abroad, cybersecurity experts warned Wednesday at a Senate hearing. Computer security companies agree that these virus is unprecedented and it means the daw...

Calling Mark Twain: Pseudonyms on G+

If you want to hide behind a fake name, don’t count on Google+ to be your “phony me” social network. As Threatpost has reported, the new social network doesn’t truck with fake identities – a position that’s quite similar to the one taken by Facebook. The company has also taken a hard stand on...

Scareware Takedown By FBI, Int'l Authorities Results in Two Arrests

The FBI has made a major dent in the huge scareware and rogue antivirus problem that has been plaguing Internet users for years now, arresting two people and seizing dozens of computers, servers and bank accounts as part of a large-scale coordinated operation in twelve countries. The operation,...

EC-Council Launches Center of Advanced Security Training (CAST) !

EC-Council Launches Center for Advanced Security Training CAST to Address the Growing Need for Advanced Information Security Knowledge Mar 9, 2011, Albuquerque, NM - According to the report, Commission on Cybersecurity for the 44th President, released in November 2010 by Center for Strategic and...

CVE-2011-0557

Integer overflow in Adobe Shockwave Player before 11.5.9.620 allows remote attackers to execute arbitrary code via a Director movie with a large count value in 3D assets type 0xFFFFFF45 record, which triggers a "faulty allocation" and memory corruption...

CVE-2010-4192

Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a Director movie with a crafted 3D Assets 0xFFFFFF88 type record that triggers an incorrect memory allocation, a different vulnerability than CVE-2011-0555,...

Memory corruption

Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a Director movie with a crafted 3D Assets 0xFFFFFF88 type record that triggers an incorrect memory allocation, a different vulnerability than CVE-2011-0555,...

Adobe Shockwave Player 0xFFFFFF45 Record Count Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Shockwave Player FFFFFF88 Record Count Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Security Worth Buying

I’m a dirty vendor. That may not be the best way to start a serious dialogue about security product effectiveness, but I hate to read a post on security theory by some insincere tie-wearing wonk only to discover afterwards that he or she is Lord High Poobah of Marketing at “Scaring You For Profit...