426 matches found
Trane Comfortlink II DSS Service REG Handling Remote Code Execution Vulnerability
Talos Vulnerability Report TALOS-2016-0027 Trane Comfortlink II DSS Service REG Handling Remote Code Execution Vulnerability February 8, 2016 CVE Number CVE-2015-2868 DESCRIPTION An exploitable remote code execution vulnerability exists in the Trane ComfortLink II DSS service. An attacker who can...
Report from the PCI SSC North American Community Meeting
The Payment Card Industry Security Standards Council held their 2015 North American Community Meeting this year in Vancouver, BC, from September 29 - October 1. Coalfire was well represented at the meeting, with Dan Fritsche, Managing Director, Application Security, making two presentations at th...
Amazon Web Services Inspector Application Security Scanner
Amazon answered many security and compliance prayers yesterday with the release of its Inspector tool. Inspector scans applications launched in Amazon Web Services instances, looking for issues on two fronts: compliance with certain regulations such as the Payment Card Industry Data Security...
PCI Scope Assessments for Higher Education Institutions
With the release of PCI DSS version 3.0 and more recently 3.1, many Higher Education Institutions have found it hard to know which SAQs they should be filling out since there are now nine options. Higher Education Institutions have very complex merchant card environments and with the new...
TLS Version 1.0 Protocol Detection (PCI DSS)
The remote service accepts connections encrypted using TLS 1.0. This version of TLS is affected by multiple cryptographic flaws. An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected service and clients. C Tenable Network...
PCI DSS version 3.1 released!
As expected, a "minor" revision to the PCI DSS 3.0 standard now version 3.1 was released by the PCI SSC today to address the vulnerabilities exposed by the POODLE and BEAST browser attacks. PCI DSS 3.1 primarily addresses the insecure use of SSL as an encryption protocol within a Cardholder Data...
CVE-2015-2764
Multiple cross-site scripting XSS vulnerabilities in Websense TRITON AP-DATA before 8.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the DSS 1 Mobile or 2 DLP report catalog...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Websense TRITON AP-DATA before 8.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the DSS 1 Mobile or 2 DLP report catalog...
CVE-2015-2764
CVE-2015-2764 describes multiple XSS vulnerabilities in Websense TRITON AP-DATA prior to 8.0.0, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors to the DSS Mobile or DLP report catalog. The root cause is not more precisely defined in the provided documents,...
DSS TFTP Server <= 1.0 Path Traversal Vulnerability - Active Check
DSS TFTP Server is prone to a path traversal vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
DSS TFTP 1.0 Server - Path Traversal Vulnerability
Document Title: =============== DSS TFTP 1.0 Server - Path Traversal Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1440 Release Date: ============= 2015-02-26 Vulnerability Laboratory ID VL-ID: ==================================== 1440...
What does PCI DSS 3.1 and PA-DSS 3.1 mean for you and your organization
In the wake of the POODLE vulnerability identified by NIST and subsequent attacks, the PCI SSC has announced its intent to release the first revision of the PCI DSS 3.0 and PA-DSS 3.0 standards. The PCI DSS 3.1 and PA-DSS 3.1 standards will indicate that the SSL v3.0 protocol no longer meets the...
POS Service Confirms Goodwill Breach Lasted 18 Months
Third-party payment vendor C&K Systems released further details this week regarding a breach that affected its systems for 18 months and went on to affect customers who shopped at Goodwill, in addition to two unnamed retailers. The company provided an update on the breach via a press release Mond...
Pixie CMS 1.0 - Multiple Local File Inclusion Vulnerabilities
No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-09-005 Application: Pixie CMS Versions Affected: 1.0 Vendor URL: http://www.getpixie.co.uk/ Bug: Multiple Local File Include Exploits: YES Reported: 29.08.2008 Vendor Response: 30.08.2008 Solution: NONE Date...
IBM Bladecenter Management - Multiple web application vulnerabilities
No description provided by source. DSECRG-09-054 IBM Bladecenter Management - Multiple vulnerabilities The BladeCenter management module is prone to multiple security vulnerabilities: Unauthorized Access, Directory Listing, XSS Digital Security Research Group DSecRG Advisory DSECRG-09-054...
velocity web-server 1.0 - Directory Traversal file download vulnerability
No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-028 Application: Velocity web-server a part of Velocity Security Management System Versions Affected: Old version 1.0 Vendor URL: http://hirschelectronics.com Bugs: Directory traversal File Download...
PowerNews (Newsscript) 2.5.6 - Local File Inclusion Vulnerabilities
No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-014 Application: PowerNews Newsscript Versions Affected: 2.5.6 Vendor URL: http://www.powerscripts.org/ Bug: Multiple Local File Include Exploits: YES Reported: 01.02.2008 Vendor Response: none Solution:...
SSL Certificate Chain Contains RSA Keys Less Than 2048 bits (PCI DSS)
At least one of the X.509 certificates sent by the remote host has a key that is shorter than 2048 bits. According to industry standards set by the Certification Authority/Browser CA/B Forum, certificates issued after January 1, 2014 must be at least 2048 bits. Some browser SSL implementations ma...
Regulators To US Banks: Be Vigilant of ATM Fraud, DDoS
U.S. regulators are warning banks this week about a recent rash of “large dollar value” ATM fraud and the ongoing risks distributed denial of service DDoS attacks that target public bank websites can pose. Members of FFIEC, the Federal Financial Institutions Examination Council, an interagency se...
[Lynis 1.4.6] Security and System Auditing Tool to Harden Linux Systems
Lynis is an auditing tool for Unix/Linux. It performs a security scan and determines the hardening state of the machine. Any detected security issues will be provided in the form of a suggestion or warning. Beside security related information it will also scan for general system information,...