CVE-2013-4518

RHUI Red Hat Update Infrastructure 2.1.3 has world readable PKI entitlement certificates...

Code injection

RHUI Red Hat Update Infrastructure 2.1.3 has world readable PKI entitlement certificates...

CVE-2013-4518

Affected product: RHUI (Red Hat Update Infrastructure) 2.1.3. The vulnerability involves world‑readable PKI entitlement certificates, enabling information disclosure of sensitive PKI data. Root cause details are not fully specified in the provided documents, but the CNVD entry explicitly notes an...

CVE-2013-4518

RHUI Red Hat Update Infrastructure 2.1.3 has world readable PKI entitlement certificates...

CVE-2018-10854

cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field...

Slack: Header modification results in disclosure of Slack infra metadata to unauthorized parties

I found files.slack.com domain will honor the X-Forwarded-Host header, instead of host header. Although file.slack.com has host validation to return 500 Internal server error when host is not files.slack.com, I can bypass the validation by appending @ at the end of host name. Also, the server wil...

National Critical Infrastructure Security and Resilience Month

November is National Critical Infrastructure Security and Resilience Month. The Nation’s critical infrastructure CI relies on a highly interdependent environment, in which physical and cyber systems converge. CI plays a vital role in keeping our Nation and communities safe and secure. Everyone is...

ICS Attackers Set To Inflict More Damage With Evolving Tactics

Future attacks on industrial control system ICS networks may inflict even more damage in the long run, according to new research. Analysts expect them to evolve from attacks that have immediate, direct impact to those with multiple stages and attack vectors that are more stealthy. While it remain...

Honeywell equIP and Performance Series IP Cameras

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Honeywell Equipment: equIP series and Performance series IP cameras Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability...

Country of Georgia Suffers Widespread Cyberattack

A cyberattack hit the small country of Georgia, Monday, knocking 2,000 websites as well as the national TV station offline in the largest cyberattack the nation has ever seen. The relatively unsophisticated defacement attack—which replaced normal functionality with an image of former Georgian...

Gustuff return, new features for victims

By Vitor Ventura with contributions from Chris Neal. Executive summary The Gustuff banking trojan is back with new features, months after initially appearing targeting financial institutions in Australia. Cisco Talos first reported on Gustuff in April. Soon after, the actors behind Gustuff starte...

Updated virtualbox packages fix security vulnerabilities

This update provides the upstream 6.0.14 and fixes the following security issues: An easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability c...

CloudBees Jenkins Oracle Cloud Infrastructure Compute Classic plugin cross-site request forgery vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed execution of the task.Oracle Cloud Infrastructure...

Unspecified Vulnerability in CloudBees Jenkins Oracle Cloud Infrastructure Compute Classic Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed execution of the task.Oracle Cloud Infrastructure...

Calculating the Benefits of the Advanced Encryption Standard

NIST has completed a study -- it was published last year, but I just saw it recently -- calculating the costs and benefits of the Advanced Encryption Standard. From the conclusion: The result of performing that operation on the series of cumulated benefits extrapolated for the 169 survey...

Product update: Virtuozzo Infrastructure Platform 3.0 Update 3.1 (3.0.3-27)

This update provides a stability fix. Vulnerability id: VSTOR-27309 ABGW Fixes ABGW context leak...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in Cisco products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities see the Cisco Security Advisories page. The Cybersecurity an...

CVE-2019-3028

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.34 and prior to 6.0.14. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

CVE-2019-3010

Vulnerability in the Oracle Solaris product of Oracle Systems component: XScreenSaver. The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While t...

CVE-2019-2969

Vulnerability in the MySQL Server product of Oracle MySQL component: Client programs. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL...