Moving Beyond EMET

EMET – Then and Now Microsoft’s Trustworthy Computing initiative was 7 years old in 2009 when we first released the Enhanced Mitigation Experience Toolkit EMET. Despite substantial improvements in Windows OS security during that same period, it was clear that the way we shipped Windows at the tim...

Week Four of National Cyber Security Awareness Month

In partnership with DHS, the National Cyber Security Alliance has released information on Navigating Your Continuously Connected Life which examines our future using Internet of Things IoT devices. The CyberAware Tip of the Week details the infographic on the growing IoT and provides safe computi...

CERT Basic Fuzzing Framework: BFF

CERT Basic Fuzzing Framework The CERT Basic Fuzzing Framework BFF is a software testing tool that finds defects in applications that run on the Linux and Mac OS X platforms. BFF performs mutational fuzzing on software that consumes file input. Mutational fuzzing is the act of taking well-formed...

Cisco Unified Computing System Local Elevation of Privilege Vulnerability

Cisco Unified Computing System Manager provides unified, embedded management of all hardware and software components within a unified computing system. An elevation of privilege vulnerability exists in Cisco Unified Computing System UCS versions prior to 3.02d in UCS Manager and UCS 6200 Fabric...

CVE-2016-6402

UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System UCS through 3.02d allow local users to obtain OS root access via crafted CLI input, aka Bug ID CSCuz91263...

CVE-2016-6402

UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System UCS through 3.02d allow local users to obtain OS root access via crafted CLI input, aka Bug ID CSCuz91263...

PT-2016-6877

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS versions through 3.02d Description The issue allows local users to obtain OS root access via crafted CLI input. Recommendations For versions through 3.02d, update to a version later than 3.02d to resolve the...

Cisco Patches Critical WebEx Meetings Server Vulnerability

Cisco warned customers of 12 vulnerabilities across its product line this week, including a critical vulnerability in the software that powers its conferencing product, WebEx Meetings Server. The company stressed on Wednesday that version 2.6 of its WebEx Meetings Server is vulnerable to a remote...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in several products. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the following Cisco Security Advisories and appl...

Cisco Unified Computing System Command Line Interface Privilege Escalation Vulnerability

A vulnerability in the command-line interface CLI of the Cisco Unified Computing System UCS Manager and UCS 6200 Series Fabric Interconnects could allow an authenticated, local attacker to access the underlying operating system with the privileges of the root user. The vulnerability is due to...

Important: Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.2 security update and bug fix update

An update for atomic-openshift and heapster is now available for Red Hat OpenShift Enterprise 3.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Enterprise Kibana security update

An update for Red Hat OpenShift Enterprise Kibana images is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

FedRAMP Prioritization

Coalfire has been participating in the American Council for Technology and the Industry Advisory Council ACT-IAC Cloud Computing community of interest in order to contribute in developing the new FedRAMP JAB Prioritization process...

CVE-2016-1374: Improper Input Validation

The web framework in Cisco Unified Computing System UCS Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request, aka Bug ID CSCuy07827...

PT-2016-4743

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS Performance Manager versions 2.0.0 and earlier Description The issue allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request. Recommendations For Cisco Unified...

CA eHealth Denial of Service Vulnerability

CA eHealth is CA's suite of software for intelligently managing complex IT environments through the IT infrastructure. The software supports monitoring, collecting and analyzing network information from network performance, virtual systems and Cisco Unified Computing Systems to provide real-time...

samba: Client side SMB2/3 required signing can be downgraded

A flaw was found in the way Samba initiated signed DCE/RPC connections. A man-in-the-middle attacker could use this flaw to downgrade the connection to not use signing and therefore impersonate the server...

Cisco Unified Computing System Performance Manager Input Validation Vulnerability

Cisco Unified Computing System Manager provides unified, embedded management of hardware and software components within a computing system. Cisco Unified Computing System UCS Performance Manager does not validate the parameter values of HTTP GET requests, which can be exploited to perform...

Cisco Unified Computing System Performance Manager Input Validation Vulnerability

A vulnerability in the web framework of Cisco Unified Computing System UCS Performance Manager could allow an authenticated, remote attacker to execute arbitrary commands. The vulnerability is due to insufficient input validation performed on parameters that are passed via an HTTP GET request. An...

[SECURITY] Fedora 24 Update: spice-0.12.8-1.fc24

The Simple Protocol for Independent Computing Environments SPICE is a remote display system built for virtual environments which allows you to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine...