CVE-2018-13820

CVE-2018-13820 affects CA Unified Infrastructure Management (UIM) versions 8.5.1, 8.5, and 8.4.7 due to a hardcoded passphrase, which could allow an attacker to access sensitive information. The vulnerability is described across multiple sources (NVD/NVD-derived, CNVD, CNVD-related listings), wit...

CVE-2018-13821

A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including file reading/writing...

Siemens OpenSSL Vulnerabilities (Update G)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-14-198-03F Siemens OpenSSL Vulnerabilities that was published October 16, 2014, on the NCCIC/ICS-CERT web site. --------- Begin Update G Part 1 of 3 -------- Siemens has identified four vulnerabilities in its OpenSS...

Cybercriminals Changing Tactics as Seen in First Half Report

Today, Trend Micro released its first half 2018 security roundup report in which we want to share the threat intelligence we discovered through the Trend Micro Smart Protection Network that allows us to identify the threats that have targeted our customer base. Below are some thoughts I’d like to...

infrastructurereportcard.org XSS vulnerability

Open Bug Bounty ID: OBB-670290 Description| Value ---|--- Affected Website:| infrastructurereportcard.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

[SECURITY] Fedora 27 Update: dpkg-1.18.25-1.fc27

This package provides the low-level infrastructure for handling the installation and removal of Debian software packages. This package contains the tools including dpkg-source required to unpack, build and upload Debian source packages. This package also contains the programs dpkg which used to...

Security Competition Infrastructure Automation Framework: Laforge

Laforge enables rapid development of infrastructure for the purpose of information security competitions. Using a simple and intuitive configuration language, Laforge manages a dependency graph and state management and allows for highly productive remote collaboration. The Laforge engine uses a...

New Relic: [NR Infrastructure] Restricted user can update integration provider account name via integrations API

NR Infra allows you to create a GCP integration and set a custom name. By default, the restricted user account can't change anything associated associated with this type of infra integration, but there is a missing check on changing the name of the integration through the integrations API. Observ...

Intel CPU Foreshadow-NG (foreshadow next generation version) vulnerability (CNVD-2018-15494)

The L1 endpoint failure VMM vulnerability, like CVE-2018-3620, belongs to Foreshadow-NG foreshadowed next-generation version, and similarly, other vendor CPUs may be affected as well.Using the speculation of executing side-channel attacks, an attacker with local user access privileges can achieve...

PTP, IoT & the Norwegian Government

We were privileged to be invited to speak an event in Arendal, Norway yesterday to make the case for IoT regulation. 'Arendalsuka' is the largest political gathering in Norway, an open forum event where the public can interact directly with political leaders, business leaders, entrepreneurs,...

ThreatList: Almost All Security Pros Believe Election Systems Are at Risk

As the U.S. midterm election season gets underway in earnest, concerns about the ability to hack the vote is more in the spotlight than ever. A fresh survey from Venafi has found that a full 93 percent of security pros are concerned about cyber-attacks targeting election infrastructure. The poll,...

10 Endpoint Security Problems Solved by the Cloud – Managing Infrastructure

This week marks our final post in this series. Today we’re going to step away from last week’s topic, getting the help you need, and examine how the cloud eliminates the need to manage infrastructure. On-Prem is Complex and Costly On-premise solutions require a massive amount of resources and fun...

Linux Kernel CVE-2018-5391 Remote Denial of Service Vulnerability

Description Linux Kernel is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition. Technologies Affected Arista Extendible Operating System EOS 4.20.0F Arista Extendible Operating System EOS 4.20.1F Arista Extendible Operating...

GoDaddy Leaks ‘Map of the Internet’ via Amazon S3 Cloud Bucket Misconfig

UPDATE GoDaddy, the world’s largest domain name registrar, has exposed high-level configuration information for tens of thousands of systems and competitively sensitive pricing options for running those systems in Amazon AWS, thanks to yet another cloud storage misconfiguration. The documents wer...

Enhanced Infrastructure DDoS Protection Analytics: Targeted Visibility for Greater Accuracy

We've rolled out enhanced infrastructure protection analytics which shows top traffic patterns for traffic flowing through our Incapsula Infrastructure DDoS Protection service. Imperva clients can now view network statistics categorized by source or destination IPs and ports, or by packet size fo...

DEF CON 2018: Voting Hacks Prompt Push Back from Election Officials, Vendors

LAS VEGAS – DEF CON 26, building on its work in hacking ballot machines last year, saw three days of probing into various aspects of the end-to-end voting infrastructure in place in the U.S., including a voter registration database and election reporting websites. Several vulnerabilities and...

Ed: Physical Laptop Takeover

At 6:16PM of August 11th of 2018, during H1-702, right before the sand storm beat the shit out of the rooftop party, we managed to perform a critical attack on Ed's infrastructure. F332214 Report Summary During our analysis and reconnaissance of how Ed program worked during the h1-702 event, we...

Security update for virtualbox (important)

This update for virtualbox to version 5.2.16 fixes the following issues: The following security vulnerabilities were fixed boo1101667: - CVE-2018-3005: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox...

openSUSE Security Update : virtualbox (openSUSE-2018-853)

This update for virtualbox to version 5.2.16 fixes the following issues : The following security vulnerabilities were fixed boo1101667 : - CVE-2018-3005: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox...

Building on experience: a framework for cybersecurity policy

Each year, more and more governments are developing policies to address security challenges presented by an increasingly digitized world. And to support those efforts, Im excited today to announce the release of Microsofts new Cybersecurity Policy Framework, a resource for policymakers that...