CVE-2018-2966

CVE-2018-2966 affects Oracle Primavera Unifier (Core) within Oracle Construction and Engineering Suite. Affected releases are Primavera Unifier 16.x, 17.x, and 18.x. The vulnerability is exploitable over HTTP and can be triggered by an unauthenticated attacker with network access; exploitation re...

CVE-2018-2967

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. Supported versions that are affected are 16.x, 17.x and 18.x. Easily exploitable vulnerability allows physical access to compromise Primavera Unifier. While the vulnerability is in...

CVE-2018-2960

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Easily exploitable vulnerability allows unauthenticated attacker with netwo...

CVE-2018-2969

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. The supported version that is affected is 16.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successfu...

CVE-2018-2962

CVE-2018-2962 affects Oracle Primavera P6 EPPM Web Access subcomponent across 8.4, 15.x, 16.x, and 17.x. The vulnerability is exploitable by a low-privileges user who can reach Primavera P6 over HTTP, with exploitation requiring user interaction. The impact includes possible unauthorized update/i...

CVE-2018-2968

CVE-2018-2968 affects Oracle Primavera Unifier (Core) in Primavera Unifier; affected versions are 16.x, 17.x, 18.x. The vulnerability is exploitable over HTTP by an unauthenticated attacker with network access and requires user interaction to successfully compromise data integrity. The impact, as...

CVE-2018-2965

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. The supported version that is affected is 16.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successf...

CVE-2018-2969

CVE-2018-2969 affects Oracle Primavera Unifier (Core) in the Primavera Unifier component of Oracle Construction and Engineering Suite, specifically the 16.x series. The vulnerability allows a low-privilege, network-accessible attacker (via HTTP) to read a subset of Primavera Unifier data, indicat...

CVE-2018-2961

CVE-2018-2961 affects Oracle Primavera P6 Enterprise Project Portfolio Management (P6 EPPM) Web Access. Web-access component vulnerabilities impact supported versions 8.4, 15.x, 16.x, and 17.x, allowing an unauthenticated attacker with network access via HTTP to compromise P6 EPPM. Attacks requir...

CVE-2018-2968

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. Supported versions that are affected are 16.x, 17.x and 18.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera...

Unspecified Vulnerability in Oracle Primavera P6 Enterprise Project Portfolio Management (CNVD-2018-24117)

Oracle Construction and Engineering Suite is a suite of portfolio management solutions for construction projects from Oracle Corporation.Primavera P6 Enterprise Project Portfolio Management P6 is one of the components for planning, managing and executing projects. Primavera P6 Enterprise Project...

Humans Are the Weakest Link in Security

In our recent analysis of penetration testing engagements contained in our Penetration Risk Report, we discuss the impact that social engineering, specifically phishing, has on the ability to allow attackers insider access to compromise an organization...

21-Year-Old Woman Charged With Hacking Selena Gomez's Email Account

A 21-year-old New Jersey woman has been charged with hacking into the email accounts of pop star and actress Selena Gomez, stealing her personal photos, and then leaked them to the Internet. Susan Atrach of Ridgefield Park was charged Thursday with 11 felony counts—five counts of identity theft,...

Humans Are the Weakest Link in Security

In our recent analysis of penetration testing engagements contained in our Penetration Risk Report, we discuss the impact that social engineering, specifically phishing, has on the ability to allow attackers insider access to compromise an organization...

FTC Issues Alert on Tech Support Scams

The Federal Trade Commission has released an alert on tech support scams. Scammers use pop-up messages, websites, emails, and phone calls to entice users to pay for fraudulent tech support services to repair problems that don’t exist. Users should not pay or give control of their devices to any...

Hackers Used Malicious MDM Solution to Spy On 'Highly Targeted' iPhone Users

Security researchers have uncovered a "highly targeted" mobile malware campaign that has been operating since August 2015 and found spying on 13 selected iPhones in India. The attackers, who are also believed to be operating from India, were found abusing mobile device management MDM protocol—a...

IC3 Warns of Business Email Compromise Scams

The Internet Crime Complaint Center IC3 has released an alert on business email compromise scams. This type of scam targets businesses and individuals by using social engineering or computer intrusion to compromise legitimate email accounts and conduct unauthorized fund transfers or obtain...

Security Bulletin: Information disclosure in Liberty for Java for IBM Cloud (CVE-2018-1553)

Summary There is an information disclosure in WebSphere Application Server Liberty using the SAML Web SSO feature. Vulnerability Details CVEID: CVE-2018-1553 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by mishandling ...

kencoengineering.asureforce.net XSS vulnerability

Open Bug Bounty ID: OBB-643593 Description| Value ---|--- Affected Website:| kencoengineering.asureforce.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

DomainFactory Hacked—Hosting Provider Asks All Users to Change Passwords

Besides Timehop, another data breach was discovered last week that affects users of one of the largest web hosting companies in Germany, DomainFactory, owned by GoDaddy. The breach initially happened back in last January this year and just emerged last Tuesday when an unknown attacker himself...