CVE-2017-10236

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

CVE-2017-3636

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.56 and earlier and 5.6.36 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server execut...

Engineering Firm Leaks Data on Dell, SBC and Oracle

A Texas-based firm called Power Quality Engineering publicly exposed sensitive electrical infrastructure data on the public internet. Firms impacted by the leak were Dell Technologies, SBC, Freescale, Oracle, Texas Instruments and the City of Austin. Chris Vickery, cyber risk analyst at security...

Moxa SoftNVR-IA Live Viewer

CVSS v3 7.2 Vendor: Moxa Equipment: SoftNVR-IA Live Viewer Vulnerability: Uncontrolled Search Path Element AFFECTED PRODUCTS The following versions of SoftNVR-IA Live Viewer, a video surveillance software designed for industrial automation systems, are affected: SoftNVR-IA Live Viewer, Version...

Code injection

A vulnerability in the Autonomic Networking feature of Cisco IOS XE Software could allow an unauthenticated, remote, autonomic node to access the Autonomic Networking infrastructure of an affected system, after the certificate for the autonomic node has been revoked. This vulnerability affected...

Cisco Fixes DoS, Authentication Bypass Vulnerabilities, OSPF Bug

Cisco fixed 15 vulnerabilities this week in more than a dozen products, including two high severity vulnerabilities that could have let an attacker trigger a denial of service condition or bypass local authentication. The more severe bugs fixed on Wednesday exist in the company’s Identity Service...

New Relic: [New Relic Infrastructure] Restricted User can still integrate with AWS via forced browsing (plus, a few other bugs)

Hi all - recently I took a look at the User Restrictions settings that were recently implemented, and I have to say it is much more defined and looks like your devs did a great job, however, there is an issue within Infrastructure which enables a Restricted User to create integrations with AWS,...

tcpdump: tcp printer rpki_rtr_pdu_print() missing length check

The rpkirtrpduprint function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service out-of-bounds read or write and crash via a crafted header length in an RPKI-RTR Protocol Data Unit PDU...

Winning at Launch Time

Your extraordinary work on game development through concept to crunch, your tireless community building, brand awareness, and engagement all converge on one moment: Launching the game. Is it possible to ever finish building a video game? The longer the dev cycle, the more likely it is you'll run...

Oracle FLEXCUBE Universal Banking Unauthorized Operation Vulnerability (CNVD-2017-24334)

Oracle Financial Services Applications is a suite of financial services software from Oracle that combines core banking, online banking, and property management.Oracle FLEXCUBE Universal Banking is one of the real-time, online coverage of retail, group...Oracle FLEXCUBE Universal Banking is a...

Mirion Technologies Telemetry Enabled Devices

CVSS v3 5.0 Vendor: Mirion Technologies Equipment: Telemetry Enabled Devices Vulnerabilities: Use of Hard-Coded Cryptographic Key, Inadequate Encryption Strength AFFECTED PRODUCTS The following telemetry enabled devices are affected: DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-3...

Sweden Accidentally Leaks Personal Details of Nearly All Citizens

Another day, Another data breach! This time sensitive and personal data of millions of transporters in Sweden, along with the nation's military secrets, have been exposed, putting every individual's as well as national security at risk. Who exposed the sensitive data? The Swedish government itsel...

Cisco Prime Infrastructure and EPNM multiple functions Cross Site Scripting (CVE-2017-6699)

A reflected cross-site scripting vulnerability has been reported in Cisco Prime Infrastructure and Evolved Programmable Network Manager. The vulnerability is due to insufficient validation of some request parameters in jsp functions. A remote user can exploit this vulnerability by enticing a targ...

Virtual Machine Automation (vm-automation) repository released

Rapid7 just released a new public repo called vm-automation. The vm-automation repository is a Python library that encapsulates existing methodologies for virtual machine and hypervisor automation and provides a platform-agnostic Python API. Currently, only ESXi and VMWare workstation are...

CVE-2017-3636

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.56 and earlier and 5.6.36 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server execut...

How to Become a Master Threat Hunter

Editor’s Note: The text appears in the free eBook: “Threat Hunting for Dummies.” After you’ve been threat hunting in an environment forsix months, a year, or more, you’re going to become a senior in most circles. You’re expanding your skills and knowledge, you’re building and using tools, and...

Virtuozzo 6 : nss / nss-devel / nss-pkcs11-devel / nss-sysinit / etc (VZLSA-2017-1364)

An update for nss is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Virtuozzo 7 : nss / nss-devel / nss-pkcs11-devel / nss-sysinit / etc (VZLSA-2017-1365)

An update for nss is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Katyusha Scanner — Telegram-based Fully Automated SQL Injection Tool

A new powerful hacking tool recently introduced in an underground forum is making rounds these days, allowing anyone to rapidly conduct website scans for SQL injection flaws on a massive scale — all controlled from a smartphone using the Telegram messaging application. Dubbed Katyusha Scanner, th...

OSIsoft PI Coresight

CVSS v3 7.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: OSIsoft Equipment: PI Coresight Vulnerability: Cross-Site Request Forgery AFFECTED PRODUCTS OSIsoft reports that the vulnerability affects the following PI Coresight products: PI Coresight 2016 R2 and earlier versions...