[security bulletin] HPSBMU03048 rev.1 - HP Software Executive Scorecard, Remote Execution of Code, Directory Traversal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04341295 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04341295 Version: 1 HPSBMU03048 rev....

CVE-2014-2609: Improper Authentication

The Java Glassfish Admin Console in HP Executive Scorecard 9.40 and 9.41 does not require authentication, which allows remote attackers to execute arbitrary code via a session on TCP port 10001, aka ZDI-CAN-2116...

PT-2014-4814

Name of the Vulnerable Software and Affected Versions HP Executive Scorecard versions 9.40 through 9.41 Description The issue allows remote authenticated users to execute arbitrary code by uploading an executable file due to a directory traversal vulnerability in the Content Acceleration Pack CAP...

PT-2014-4815

Name of the Vulnerable Software and Affected Versions HP Executive Scorecard versions 9.40 through 9.41 Description The issue allows remote authenticated users to execute arbitrary code, obtain sensitive information, or delete data via unspecified vectors. Recommendations For versions 9.40 and...

Hewlett-Packard IT Executive Scorecard fndwar Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard IT Executive Scorecard. Authentication is required to exploit this vulnerability. The specific flaw exists within the fndwar web application. A directory traversal vulnerability can...

Hewlett-Packard IT Executive Scorecard CAP File Upload Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard IT Executive Scorecard. Authentication is required to exploit this vulnerability. The specific flaw exists within the Content Acceleration Pack web application code. A file upload...

PT-2014-4813

Name of the Vulnerable Software and Affected Versions HP Executive Scorecard versions 9.40 through 9.41 Description The Java Glassfish Admin Console does not require authentication, allowing remote attackers to execute arbitrary code via a session on TCP port 10001. Recommendations For versions...

Executive Agencies Pass on New Cybersecurity Regulations

Three Executive Branch federal agencies crucial to critical infrastructure protection will be allowed to continue to voluntarily assess cyber risk, rather than force the development and implementation of additional regulations. The White House yesterday released its conclusions as they relate to...

Threat Outbreak Alert: Fake Email Messages Distributing Malicious Software on May 17, 2014

Medium Alert ID: 34264 First Published: 2014 May 19 13:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that contain malicious software for the recipient. The text in the email message attempts to convince the recipient to open the attachme...

NSA Surveillance Reform Demonstrate Need for Public Scrutiny

The Snowden leaks and the ensuing critical spotlight shone on the National Security Agency’s surveillance programs have nudged many technologists, privacy hounds and politicians away from their desks and onto the front lines calling for reforms. Two nights ago, the New York Times reported that...

Cybersecurity Framework for U.S. Critical Infrastructure

Critical infrastructure operators have been delivered a cybersecurity framework by the U.S. government that paints broad strokes as to how to defend IT and SCADA networks in some of the country’s most sensitive industries such as energy, water and financial services. NIST today announced the...

Obama Orders NSA Bulk Metadata Surveillance Reforms

President Obama today announced reforms to the National Security Agency’s bulk metadata collection program under Section 215 of the PATRIOT Act, ordering a transition that would end the program as it exists today, and prohibit the government from storing and accessing the data without secret cour...

Preparing for Managed Security Services

Wade Woolwine Presents at MIRcon® 2013 As a complement to my MIRcon® 2013 presentation titled "Getting the Best Bang for the Buck with Managed Security Providers" and to address some questions I received from the audience, I have prepared a quick summary of my presentation. Many businesses consid...

NIST Publishes Preliminary Cybersecurity Framework

Following an Executive Order issued by U.S. President Barack Obama in February of this year, the National Institute of Standards and Technology NIST yesterday made public a provisional copy of the government’s cybersecurity framework and says it will accept public comment on the draft for the nex...

HTTPS, SSL Minimal Security, Privacy Standard for Email

Yahoo is being second-guessed more today than a mediocre baseball manager. Two days after announcing it would finally turn SSL on by default for its email users starting in January, the company is getting a halfhearted pat on the back from the security industry, which can’t help but ask: “What to...

Protecting Critical Infrastructure: Input Data

Kaspersky Lab is always working to develop new technologies for protecting critical computer systems from cybercriminals. In July, I had the opportunity to represent Kaspersky at a symposium sponsored by the National Institute of Standards and Technology NIST, focused on the national Cybersecurit...

The PCI DSS Cloud Computing Guidelines: An Executive Summary

The PCI SSC and its Cloud Special Interest Group has released its Cloud Computing Guidelines after a year of collaboration and input from SIG members. Coalfire was a big contributor to this document, and we think it is required reading for anyone who has front-line responsibility for managing...

White House Executive Order on Cyber Security

The tense standoff between an unresponsive Congress and a reluctant critical infrastructure industry has been broken. On February 13, 2013, the President issued an Executive Order that provides initial guidance for the country to confront escalating cyber threats. Finally, we have someone with th...

Cybersecurity Executive Order Short on Action, Long on Voluntary Initiatives

The executive order that President Barack Obama signed yesterday in advance of his State of the Union Address contains a lot of provisions for information sharing on attacks and threats on critical infrastructure, and also calls for the development of a framework to reduce cybersecurity risks in...

Obama Cybersecurity Executive Order Expected Tomorrow

This week figures to be a high-profile time for cybersecurity on Capitol Hill. Reports say President Barack Obama will issue a long-awaited executive order shortly after tonight’s State of the Union address, while another stab at getting the controversial CISPA cybersecurity bill signed into law...