Clustering App Attacks with Machine Learning Part 3: Algorithm Results

In the previous blog posts in this series, we discussed the motivation for clustering attacks and the data used and how to calculate the distance between two attacks using different methods on each feature we extracted. In this final blog post, we’ll discuss the clustering algorithm itself – how ...

Clustering App Attacks with Machine Learning Part 2: Calculating Distance

In our previous post in this series we discussed our motivation to cluster attacks on apps, the data we used and how we enriched it by extracting more meaningful features out of the raw data. We talked about the many features that can be extracted from IP and URL. In this blog post we’ll discuss...

CVE-2017-15696

The CVE-2017-15696 entry affects Apache Geode before v1.4.0. In secure mode, the Geode configuration service fails to properly authorize configuration requests, allowing an unprivileged user with access to a Geode locator to extract configuration data and previously deployed application code. Con...

Clustering and Dimensionality Reduction: Understanding the “Magic” Behind Machine Learning

These days we hear about machine learning and artificial intelligence AI in all aspects of life. We see machines that learn and imitate the human brain in order to automate human processes. There are autonomous cars that learn the road conditions to drive, personal assistants we can converse with...

Fedora 25 : graphite2 (2017-03ef6281a8)

1.3.10 - Address floating point build parameters to give consistent positioning results across platforms - Various bug fixes 1.3.9 - Add Collision COLLISSPACE to allow for visible spaces in collision avoidance - Add segment and pass direction information to tracing output - Bug fix rule length...

Apache Geode Information Disclosure Vulnerability

Geode is a data management platform that provides real-time, consistent access to data-critical applications across the entire cloud architecture. Apache Geode sets the security-manager attribute and fails to set user permissions correctly after enabling clustering, allowing remote attackers to...

Rumble Mail Server 0.51.3135 Cross Site Scripting Vulnerability

Exploit for multiple platform in category web applications Exploit title: Rumble Mail Server v/0.51.3135 = Stored Cross Site Scripting Download Software: https://sourceforge.net/projects/rumble/?source=directory Author: Nassim Asrir Author Company: Henceforth Contact: email protected Tested On:...

Update Rollup 4 for System Center 2012 R2 Virtual Machine Manager

Update Rollup 4 for System Center 2012 R2 Virtual Machine Manager Introduction This article describes the issues that are fixed in Update Rollup 4 for Microsoft System Center 2012 R2 Virtual Machine Manager VMM. There are two updates available for System Center 2012 R2 Virtual Machine Manager. On...

WSO2 Carbon 4.4.5 - Denial of Service / Cross-Site Request Forgery

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-CSRF-DOS.txt + ISR: ApparitionSec Vendor: ============ www.wso2.com Product: ================== Ws02Carbon v4.4.5 WSO2 Carbon is the core platform on which...

openSUSE Security Update : samba (openSUSE-2016-462) (Badlock)

"samba was updated to version 4.2.4 to fix 14 security issues. These security issues were fixed : - CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks bsc936862. - CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication bsc973031. -...

openSUSE Security Update : samba (openSUSE-2016-399)

"This update for the samba server fixes the following issues : Security issue fixed : - CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target; bso11648 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

openSUSE: Security Advisory for samba (openSUSE-SU-2016:0877-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2016:0816-1)

"This update for the samba server fixes the following issues : Security issue fixed : - CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target; bso11648 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

SUSE-SU-2016:0816-1 Security update for samba

This update for the samba server fixes the following issues: Security issue fixed: - CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target; bso11648; bsc968222. Other bugs fixed: - Enable clustering CTDB support; bsc966271. - s3: smbd: Fix timestamp...

JVN#03050861: EXPRESSCLUSTER X vulnerable to directory traversal

EXPRESSCLUSTER X from NEC Corporation is software to provide high availability HA clustering. EXPRESSCLUSTER X contains an issue in WebManager, which may lead to directory traversal. Impact Arbitrary files on the server may be viewed by an attacker who can access to the WebManager. Solution Updat...

MALHEUR - Automatic Analysis of Malware Behavior

A novel tool for malware analysis Malheur is a tool for the automatic analysis of malware behavior program behavior recorded from malicious software in a sandbox environment. It has been designed to support the regular analysis of malicious software and the development of detection and defense...

Cisco AsyncOS for Web Security Appliance Denial of Service Vulnerability

Cisco AsyncOS for Web Security Appliance is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

Cisco Email Security Appliance AsyncOS Denial of Service Vulnerability

Cisco AsyncOS on Email Security Appliance ESA device is a set of operating systems running in the Email Security Appliance ESA from Cisco USA. A security vulnerability exists in Cisco AsyncOS on the Cisco ESA device. When the clustering component is enabled in the program, a remote attacker could...

Code injection

Cisco AsyncOS on Email Security Appliance ESA devices with software 8.5.6-073, 8.5.6-074, and 9.0.0-461, when clustering is enabled, allows remote attackers to cause a denial of service clustering and SSH outage via a packet flood, aka Bug IDs CSCur13704 and CSCuq05636...

CVE-2015-4236

Cisco AsyncOS on Email Security Appliance ESA devices with software 8.5.6-073, 8.5.6-074, and 9.0.0-461, when clustering is enabled, allows remote attackers to cause a denial of service clustering and SSH outage via a packet flood, aka Bug IDs CSCur13704 and CSCuq05636...