Symantec Releases Security Update

Symantec has released an update to address vulnerabilities in Symantec Endpoint Protection version 12.1. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Security Advisory from...

Cisco Releases Security Updates

Cisco has released updates to address multiple vulnerabilities in its Adaptive Security Appliance ASA software. Exploitation of these vulnerabilities could allow a remote attacker to cause a denial-of-service condition. US-CERT encourages users and administrators to review the Cisco security...

Google Releases Security Update for Chrome

Google has released Chrome version 46.0.2490.71 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the Chrome Releases...

Google Releases Security Update for Chrome

Google has released Chrome version 45.0.2454.101 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of one of these vulnerabilities may allow a remote attacker to obtain sensitive information from an affected system. Users and administrators are encouraged to review the...

Lenovo Caught (3rd Time) Pre-Installing Spyware on its Laptops

Lenovo has once again been caught installing spyware on its laptops and workstations without the user's permission or knowledge. One of the most popular computer manufacturers is being criticized for selling some refurbished laptop models pre-installed with invasive marketing software that sends...

Cisco Semiannual Security Advisory Bundle

Cisco has released its semiannual IOS and IOS XE Software Security Advisory bundle to address multiple vulnerabilities. Exploitation of these vulnerabilities could allow a remote attacker to bypass user authentication or cause a denial-of-service condition. US-CERT encourages users and...

Cisco Releases Security Updates

Cisco has released updates to address vulnerabilities in Prime Collaboration Assurance, Prime Collaboration Provisioning, and TelePresence Server software. Exploitation of these vulnerabilities could allow a remote attacker to escalate privileges, obtain sensitive information, or cause a...

VMware Releases Security Update

VMware has released a security update to address a Lightweight Directory Access Protocol LDAP certificate validation vulnerability in vCenter Server. Exploitation of this vulnerability may allow an attacker to obtain sensitive information. Available updates include: VMware vCenter Server version...

Drupal Zendesk Feedback Tab Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Zendesk Feedback Tab module in versions 7.x-1.1 and prior to 7.x-1.x, which can be exploited by a remote attacker...

CVE-2015-6921

Cross-site scripting XSS vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6921

Cross-site scripting XSS vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6921

The CVE-2015-6921 vulnerability affects the Drupal Zendesk Feedback Tab module (7.x-1.x) prior to 7.x-1.1. The issue is a cross-site scripting (XSS) flaw that allows users with the Configure Zendesk Feedback Tab permission (remote administrators) to inject arbitrary web scripts or HTML via unspec...

Sql injection

SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedback/pages/feedback.php...

CVE-2015-6921: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-7402

Name of the Vulnerable Software and Affected Versions ResourceSpace versions 7.3.7009 and earlier Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the user cookie in the "plugins/feedback/pages/feedback.php" endpoint...

CVE-2015-6915: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedback/pages/feedback.php...

PT-2015-7405

Name of the Vulnerable Software and Affected Versions Zendesk Feedback Tab module versions 7.x-1.x before 7.x-1.1 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrar...

Blackhat 2015 Arsenal

Last month at Blackhat Arsenal 2015, Pete and I @willis presented on Serpico. This was our second time at Arsenal. Yet again, awesome people, great venue, and overall a highlight for me of BH/DC/LV. We got some excellent feedback on the project, so thank you to anyone who stopped by. Last year I...

Adobe Releases Security Update for Shockwave Player

Adobe has released a security update to address vulnerabilities in Shockwave Player. Exploitation of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Adobe Security Bulletin APSB15-22 and apply the necessary...