The FFIEC proposes guidance on social media - can you stay two steps ahead?

On January 22, 2013, the FFIEC put out a press release called "Financial Regulators Propose Guidance on Social Media". We should begin by saying that even without a social media presence, every company should address social media risks in their annual risk assessment. In this day and age where th...

dopvSTAR* vulnerable to cross-site scripting

Overview dopvSTAR provided by bayashi.net is a software to analyze web access logs. dopvSTAR contains a cross-site scripting vulnerability. Masahiro YAMADA reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

White House Executive Order on Cyber Security

The tense standoff between an unresponsive Congress and a reluctant critical infrastructure industry has been broken. On February 13, 2013, the President issued an Executive Order that provides initial guidance for the country to confront escalating cyber threats. Finally, we have someone with th...

PT-2013-1601 · Zend · Zend Framework

Name of the Vulnerable Software and Affected Versions: Zend Framework versions 1.x prior to 1.11.12 Zend Framework versions 1.12.x prior to 1.12.0 Description: The issue allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element...

RHEL 5 / 6 : freetype (RHSA-2013:0216)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0216 advisory. - freetype: heap buffer over-read in BDF parsing bdfparseglyphs 37906 CVE-2012-5669 Note that Nessus has not tested for this issue but has instea...

GitHub Search Down After Some Credentials and Crypto Keys Exposed

GitHub’s search capability remains dark Friday after it was discovered that the code-sharing site’s search feature could be used to dredge up passwords, private crypto keys, and other credentials developers use in their projects. GitHub is a popular collaboration site for open source software...

RHEL 5 : flash-plugin (RHSA-2010:0623)

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0623 advisory. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes multiple...

RHEL 6 : kernel (RHSA-2012:1148)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1148 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue: A NULL pointer...

RHEL 5 : kernel (RHSA-2012:0720)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0720 advisory. - kernel: x86-64: avoid sysret to non-canonical address CVE-2012-0217 - kernel: ipv6: panic using raw sockets CVE-2012-1583 Note that Nessus...

PT-2013-1504 · Oracle +4 · Mysql Server +4

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 5.1.66 and earlier Oracle MySQL versions 5.5.28 and earlier Description: The issue affects the Server component in Oracle MySQL, allowing remote authenticated users to impact availability through unspecified vectors...

Siemens COMOS Database Privilege Escalation Vulnerability

Overview Siemens has reported a privilege escalation vulnerability in the Siemens COMOS database application. Siemens has produced an update that fixes this vulnerability. This vulnerability could be exploited remotely. Affected Products Siemens reports that the vulnerability affects the followin...

RHEL 5 / 6 : php (RHSA-2012:0546)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0546 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the php-cgi executable processe...

PT-2012-3445 · Mysql Server +3 · Mysql Server +3

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.1.61 and earlier MySQL Server versions 5.5.21 and earlier Description: The issue affects the availability of the system, related to Server DML, and can be exploited by remote authenticated users. Recommendations: For...

Ubuntu Update for linux-lts-backport-natty USN-1386-1

Ubuntu Update for Linux kernel vulnerabilities USN-1386-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN13861.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for linux-lts-backport-natty USN-1386-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH,...

CVE-2006-7249

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-7250, CVE-2012-1410. Reason: this candidate was intended for one issue, but CVE users may have associated it with multiple unrelated issues. Notes: All CVE users should consult CVE-2006-7250 for the OpenSSL candidate or...

New SEC Guidance May Impact Corporate Disclosure

As companies begin submitting their regulatory filings and financial reports from 2011, the SEC is pushing for more comprehensive data breach, cyber attack, and general risk-assessment disclosures. As it stands, companies not only downplay the severity of hacking and other Internet-borne threats ...

MS11-100: Vulnerability in the .NET Framework could allow elevation of privilege: December 29, 2011

This article contains details for the ASP.NET update for the .NET Framework.IntroductionMicrosoft has released security bulletin MS11-100. To view the complete security bulletin, visit one of the following Microsoft websites:Home...

PT-2011-1247 · Adobe +2 · Reader +3

Name of the Vulnerable Software and Affected Versions: Adobe Reader versions 9.x through 9.4.6 Adobe Reader and Adobe Acrobat versions 10.1.1 and earlier Description: The issue is related to a memory corruption vulnerability in the U3D component of Adobe Reader and Adobe Acrobat. This vulnerabili...

PT-2011-4838 · Php · Phpldapadmin

Name of the Vulnerable Software and Affected Versions: phpLDAPadmin versions 1.2.x through 1.2.1 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an debug command in the cmd.php fil...

RHEL 5 : postgresql84 (RHSA-2011:1378)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1378 advisory. - cryptblowfish: 8-bit character mishandling allows different password pairs to produce the same hash CVE-2011-2483 Note that Nessus has not tested f...