Design/Logic Flaw

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 and 6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request that could be used to aid future attacks. IBM X-Force ID: 129970...

Highlights from the HITRUST Third-Party Assurance Summit

The HITRUST TPA Summit brought together experts representing customers, vendors, and assessor firms in various aspects of risk management to share best practices, lessons learned and effective third-party risk management strategies leveraging the HITRUST CSF Assurance Program and HITRUST Assessme...

Carbon Black’s Victor Baez Recognized as a 2018 CRN Channel Chief

CRN®, a brand of The Channel Company, has named Victor Baez, Vice President, WW Channels of Carbon Black, to its prestigious list of 2018 Channel Chiefs. The executives on this annual list represent top leaders in the IT channel who excel at driving growth and revenue in their organization throug...

Internet Security Threats at the Olympics

There are a lot: The cybersecurity company McAfee recently uncovered a cyber operation, dubbed Operation GoldDragon, attacking South Korean organizations related to the Winter Olympics. McAfee believes the attack came from a nation state that speaks Korean, although it has no definitive proof tha...

future-recurrence.com XSS vulnerability

Open Bug Bounty ID: OBB-513457 Description| Value ---|--- Affected Website:| future-recurrence.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Happy 15th Birthday TaoSecurity Blog

Today, 8 January 2018, is the 15th birthday of TaoSecurity Blog! This is also my 3,020th blog post. I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. I don't believe I've released statistics for the blog before, so here are a few. Blogger...

Mentalist - Graphical Tool For Custom Wordlist Generation

Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper. Install from Source Prerequisites Linux APT package manager Check if Python 3 ...

Why emerging APAC markets are prime targets for the malware of the future

In many ways, Asia has led the way in technological development. Robotics, video games, dizzyingly fast Internet speeds. But when it comes to cybersecurity, several APAC countries, especially those in emerging markets, are severely lacking. And while, according to the 2017 State of Malware Report...

BACKSWING - Pulling a BADRABBIT Out of a Hat

Executive Summary On Oct. 24, 2017, coordinated strategic web compromises started to distribute BADRABBIT ransomware to unwitting users. FireEye appliances detected the download attempts and blocked our user base from infection. During our investigation into the activity, FireEye identified a...

Accelerating Security for Intelligent Transportation Systems: A New Trend Micro Report

Connected cars and autonomous vehicles are getting all the headlines these days, especially when it comes to cybersecurity concerns. But that’s only half of the story. An under-reported but hugely important piece of the puzzle relates to the Intelligent Transportation Systems ITS needed to create...

futureelectronics.com XSS vulnerability

Vulnerable URL: http://www.futureelectronics.com/en/Search.aspx?dsNav=Ntk:PlainTextSearch|aaa"'/-/-!...

Today’s Predictions for Tomorrow’s Internet

This weekend I realized just how much the future of securing the Internet of Things IoT will become a critical component to maintain our lifestyle. CyberPatriot is the National Youth Cyber Education Program created by the Air Force Association to encourage careers in STEM. Each year the program...

Girls Who Code: That's a Wrap!

The Summer Immersion Program for Girls Who Code at Akamai wrapped up this past week. The girls finished their final projects and presented them at a graduation ceremony attended by friends and family as well as supporters and mentors from Akamai. The girls were divided into five teams for their...

CVE-2016-2971

IBM Sametime Media Services 8.5.2 and 9.0 can disclose sensitive information in stack trace error logs that could aid an attacker in future attacks. IBM X-Force ID: 113898...

August 21, 2017 – Morning Cyber Coffee Headlines – “Solar Eclipse” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 21, 2017 - Headlines Carbon Black in the News: Trump increases status of...

MARVEL Future Fight - Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application MARVEL Future Fight published at the 'play' market has multiple vulnerabilities...

Forecasting the Future of Ransomware

There's no question that ransomware is one of the most formidable threats to a business. With so much riding on digitized data, important applications and other systems, any interruption to access of these crucial assets can quickly spell disaster for an organization. Despite efforts on the part ...

openSUSE Security Update : rxvt-unicode (openSUSE-2017-670)

This update for rxvt-unicode fixes the following issue : While urxvt is not directly affected by CVE-2017-7483 we have added a patch to harden urxvt to avoid similar bugs in the future. boo1036456 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

APT3 Linked to Chinese Ministry of State Security

Researchers claim that APT3, widely believed to be a China-based threat actor, is directly connected to the Chinese Ministry of State Security MSS. The allegations come from Recorded Future which released a report Wednesday that claims it has found conclusive ties that link APT3 with MSS, China’s...

My comments on Forrester’s “Vulnerability Management vendor landscape 2017”

A top consulting company, Forrester Research, recently published report "Vendor Landscape: Vulnerability Management, 2017". You can read for free by filling a small form on Tenable web site. What's interesting in this document? First of all, Josh Zelonis and co-authors presented their version of ...