CVE-2017-6679

The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel SSH which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for...

Design/Logic Flaw

The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel SSH which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for...

Design/Logic Flaw

Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by...

CVE-2017-9315

Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by...

Boost productivity of your DevOps teams and deliver superior digital experiences with Akamai Cloud Delivery Platform - Part 3

In the first and second part of this blog series, we discussed the challenges associated with cloud adoption and how you can leverage Akamai Cloud Delivery Platform, the world's largest and most trusted cloud delivery platform, to achieve the scalability, availability, reliability, security and...

Threat Outbreak Alert RuleID31440: Email Messages Distributing Malicious Software on November 24, 2017

Medium Alert ID: 56046 First Published: 2017 November 27 13:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31440 may contain the following files: Name |...

WordPress WP Customer Area Plugin <= 7.4.2 - Reflected Cross Site Scripting vulnerability

The value of $REQUEST‘page’ parameter is not escaped in the template files - /src/php/core-addons/admin-area/templates/. This allows an attacker to execute a reflected cross site scripting attack. The vulnerability was fixed in version 7.4.3. Solution Update the plugin...

CVE-2017-8155

The outdoor unit of Customer Premise Equipment CPE product B2338-168 V100R001C00 has a no authentication vulnerability on a certain port. After accessing the network between the indoor and outdoor units of the CPE, an attacker can deliver commands to the specific port of the outdoor unit and...

CVE-2017-8156

The outdoor unit of Customer Premise Equipment CPE product B2338-168 V100R001C00 has a no authentication vulnerability on the serial port. An attacker can access the serial port on the circuit board of the outdoor unit and log in to the CPE without authentication. Successful exploit could allow t...

CVE-2017-8156

CVE-2017-8156 is a no-authentication serial-port vulnerability in Huawei CPE outdoor unit B2338-168 V100R001C00. The issue allows an attacker with physical access to log in to the device via the serial console and take control of the outdoor unit. The Huawei PSIRT advisory confirms two related vu...

Customer Area < 7.4.3 - XSS

The WP Customer Area WordPress plugin was affected by a XSS security vulnerability...

How to enable storage-specific API logging

Need to collect storage-specific API logging by Veeam Customer Support request...

OTRS -- Multiple vulnerabilities

OTRS reports: An attacker who is logged into OTRS as an agent can request special URLs from OTRS which can lead to the execution of shell commands with the permissions of the web server user. An attacker who is logged into OTRS as a customer can use the ticket search form to disclose internal...

Forever 21 Warns Shoppers of Payment Card Breach at Some Stores

Another day, another data breach. This time a fast-fashion retailer has fallen victim to payment card breach. American clothes retailer Forever 21 announced on Tuesday that the company had suffered a security breach that allowed unknown hackers to gain unauthorized access to data from payment car...

Unauthorized Access

loopback is vulnerable to unauthorized access. If an admin instance and a customer instance share the same user id and password, the customer instance can change the password of the admin instance using their regular access token...

Zurmo Cross-Site Scripting Vulnerability

Zurmo is the United States Zurmo company's set of open source PHP-based customer relationship management system CRM. A cross-site scripting vulnerability exists in Zurmo version 3.2.1.57987acc3018. A remote attacker can exploit this vulnerability by sending a 'redirectUrl' parameter with a data:...

Unspecified Spoofing Vulnerability in SAP Customer Relationship Management (CRM) IC WebClient

SAP Customer Relationship Management is a customer relationship management solution. An unspecified spoofing vulnerability exists in SAP Customer Relationship Management CRM IC WebClient, which can be exploited by attackers to conduct spoofing attacks and perform unauthorized operations...

Simple Banking Security Tip: Verbal Passwords

There was a time when I was content to let my bank authenticate me over the phone by asking for some personal identifiers SSN/DOB that are broadly for sale in the cybercrime underground. At some point, however, I decided this wasn't acceptable for institutions that held significant chunks of our...

Threat Outbreak Alert RuleID31135: Email Messages Distributing Malicious Software on November 6, 2017

Medium Alert ID: 55784 First Published: 2017 November 6 15:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31135 may contain the following files: Name |...

SAP Customer Relationship Management Email Form Editor Cross-Site Scripting Vulnerability

SAP Customer Relationship Management is a customer relationship management solution. A cross-site scripting vulnerability exists in the SAP Customer Relationship Management email form editor because it does not properly filter user-supplied input. A remote attacker could exploit this vulnerabilit...