au.com.turingg:turingg-files (=0.0.1), au.com.turingg:turingg-mimak (=1.0.0) +154 more potentially affected by CVE-2018-11797 via org.apache.pdfbox:pdfbox (>=2.0.0 <=2.0.11)

org.apache.pdfbox:pdfbox MAVEN version =2.0.0, =1.0.0, =0.21.0, =0.22.0-bin-20191218-35fbb34-NIGHTLY, =0.21.0, =1.0-RELEASE, =2.2, =3.1.0, =3.3.0 and more Source cves: CVE-2018-11797 Source advisory: OSV:GHSA-GX96-VGF7-HWFG...

CVE-2018-17469

Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file...

CVE-2018-3127

Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite subcomponent: Product Security. Supported versions that are affected are 7.3.5 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

Design/Logic Flaw

Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite subcomponent: User Group Management. The supported version that is affected is 6.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the...

Buffer overflow

Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite subcomponent: Product Security. Supported versions that are affected are 7.3.5 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2018-3127

Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite subcomponent: Product Security. Supported versions that are affected are 7.3.5 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2018-3127

CVE-2018-3127 affects Oracle Demantra Demand Management, a component of Oracle Supply Chain Products Suite. Affected versions are 7.3.5 and 12.2. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Demantra Demand Management; successful attacks require ...

CVE-2018-3134

CVE-2018-3134 affects Oracle Agile Product Lifecycle Management for Process (subcomponent: User Group Management) within Oracle Supply Chain Products Suite, version 6.2.0.0. The vulnerability is described as exploitable by a low-privileged user who can log on to the infrastructure hosting Oracle ...

au.com.turingg:turingg-files (=0.0.1), au.com.turingg:turingg-mimak (=1.0.0) +408 more potentially affected by CVE-2018-12418 via com.github.junrar:junrar (=0.7)

com.github.junrar:junrar MAVEN version =0.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.junrar:junrar and may be impacted: - au.com.turingg:turingg-files =0.0.1 - au.com.turingg:turingg-mimak =1.0.0 -...

de.wayofquality.blended:blended-camel-utils (>=1.1.2 <=1.1.4), de.wayofquality.blended:blended-karaf-features (>=1.1.2 <=1.1.4) +45 more potentially affected by CVE-2015-5348 via org.apache.camel:camel-servlet (>=2.10.0 <=2.15.4)

org.apache.camel:camel-servlet MAVEN version =2.10.0, =1.1.2, =1.1.2, =0.0.4, =0.0.4, =0.0.3, =0.0.3, =0.0.4, =0.0.3, =0.0.4, =0.0.5 and more Source cves: CVE-2015-5348 Source advisory: OSV:GHSA-26V6-W6FW-RH94...

Apple, Amazon in a Tussle with Bloomberg over Spy Chips Report

In our latest security news digest, we delve into the brouhaha over Chinese spy chips, check out the latest in Facebook's investigation of its recent hack, and look at Google's controversial decision to delay disclosing a potential data breach. Bloomberg's spy chip report stuns tech industry, the...

A week in security (October 8 – 14)

Last week, we warned you away from some dubious Doctor Who streams, explained how Endpoint Detection and Response may not be enough, and explored what happens during a confusing supply chain story. We also showed you how to keep up with security, explained the risks of fake browser updates, and...

Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox

This blog post was authored by Edmund Brumaghin and Holger Unterbrink with contributions from Emmanuel Tacheau. Executive Summary Cisco Talos has discovered a new malware campaign that drops the sophisticated information-stealing trojan called "Agent Tesla," and other malware such as the Loki...

Supply Chain Security 101: An Expert’s View

Earlier this month I spoke at a cybersecurity conference in Albany, N.Y. alongside Tony Sager, senior vice president and chief evangelist at the Center for Internet Security and a former bug hunter at the U.S. National Security Agency. We talked at length about many issues, including supply chain...

Bloomberg blunder highlights supply chain risks

Ooh boy! Talk about a back-and-forth, he said, she said story! No, we’re not talking about that Supreme Court nomination. Rather, we’re talking about Supermicro. Supermicro manufacturers the type of computer hardware that is used by technology behemoths like Amazon and Apple, as well as governmen...

Network Security Monitoring vs Supply Chain Backdoors

On October 4, 2018, Bloomberg published a story titled “The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies,” with a subtitle “The attack by Chinese spies reached almost 30 U.S. companies, including Amazon and Apple, by compromising America’s technology supply chain, according t...

Supply Chain Security is the Whole Enchilada, But Who’s Willing to Pay for It?

From time to time, there emerge cybersecurity stories of such potential impact that they have the effect of making all other security concerns seem minuscule and trifling by comparison. Yesterday was one of those times. Bloomberg Businessweek on Thursday published a bombshell investigation allegi...

Why Supply Chain Hacks Are a Cybersecurity Worse Case Scenario

A blockbuster report from Bloomberg says that China has compromised servers used by major US companies. It's a problem that experts have long feared, and still don't know how to resolve...

Chinese surveillance chips found in servers used by US technology giants: Report

By Waqas This can be one of one of the largest corporate spying and hardware hacking campaigns ever launched by a nation-state. Bloomberg has revealed in its recently published report that a nation-state has launched a significant supply chain attack. It is believed to be one of the largest...

China Chip Hack Shines Spotlight on Hardware and Supply-Chain Risk

Recent revelations in the press regarding hardware implants and supply-chain compromise are troubling and should be seen as an opportunity to assess our current threat model and security approach. This recently revealed situation is the hardware analogue to the software supply chain compromises w...