Cisco IOS Software Autonomic Networking Infrastructure Overwrite Vulnerability

A vulnerability in the Autonomic Networking Infrastructure ANI feature of Cisco IOS software could allow an unauthenticated, remote attacker to overwrite some configuration values received via ANI. The vulnerability is due to insufficient validation of received Autonomic Networking AN messages. A...

OpenSSL to Patch High Severity Vulnerability this Week

The OpenSSL Foundation is set to release a handful of patches for undisclosed security vulnerabilities in its widely used open source software later this week, including one that has been rated "high" severity. In a mailing list note published last night, Matt Caswell of the OpenSSL Project Team...

CloudFlare Aims to Defeat Massive DDoS Attacks with Virtual DNS

DDoS attacks have been a persistent problem for the the better part of 20 years, and as ISPs and enterprises have adjusted their defenses, attackers have adapted their tactics. One of the more effective tools in the attackers’ arsenal now is the use of botnets to generate massive numbers of DNS...

OpenSSL Security Audit Ready to Start

Funding from the Core Infrastructure Initiative has helped the maintainers of OpenSSL, one of the Internet’s most-deployed pieces of open source software, begin to get the crypto implementation on its feet. Despite its ubiquity, OpenSSL has historically been under-funded and under-resourced, thou...

CVE-2015-0659

CVE-2015-0659 concerns Cisco IOS Autonomic Networking Infrastructure (ANI). The ANI implementation allows remote attackers to trigger self-referential adjacencies by sending crafted Autonomic Networking (AN) messages (Bug ID CSCup62157). Affected: ANI component of Cisco IOS. Reported impact indic...

Attacks Against Critical Infrastructure Seek Operational Intel

In most critical industries—petroleum refineries or energy utilities, for example—there is very little in the way of proprietary information. Refining crude oil into gasoline requires science, not a secret sauce. Same goes for power generation. So why are advanced attackers using the same data...

How to Diagnose Network Fault with Log & Event Manager

Diagnosing network fault is one of the toughest questions for an IT Pro to answer because there is no single or best way. IT infrastructures are multi-layered and integrate many different systems which makes identifying the cause of network fault a difficult task. At a high level, the process of...

Securing DNS Essential to Web's Future, Dan Kaminsky

CANCUN – “2015 got weird… really weird.” Those were some of the first words spoken by Dan Kaminsky in his talk today at the Kaspersky Security Analyst Summit Monday. He was referring to a few key events from the last several weeks: the Sony hack debacle, or what he called “North Korean or...

CVE-2014-2153

Multiple cross-site scripting XSS vulnerabilities in INSERT pages in Cisco Prime Infrastructure allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun21869...

CVE-2014-2152

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in INSERT pages in Cisco Prime Infrastructure allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun21869...

CVE-2014-2147

The web interface in Cisco Prime Infrastructure 2.1 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka B...

CVE-2014-2153

Multiple cross-site scripting XSS vulnerabilities in INSERT pages in Cisco Prime Infrastructure allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun21869...

CVE-2014-2153

CVE-2014-2153 concerns Cisco Prime Infrastructure, where multiple XSS vulnerabilities exist in INSERT pages. The root cause is insufficient input validation on several parameters in INSERT-related HTML pages, allowing an unauthenticated, remote attacker to craft a link that injects arbitrary scri...

CVE-2014-2152

Cisco Prime Infrastructure (PI) contains a Cross-Site Request Forgery (CSRF) vulnerability on the INSERT page that could allow an unauthenticated/remote attacker to hijack the authentication of an authenticated PI user and perform actions on behalf of that user. Root cause is insufficient CSRF pr...

CVE-2014-2147

The CVE-2014-2147 issue affects Cisco Prime Infrastructure 2.1 and earlier, where the web interface does not properly restrict IFRAME use, due to insufficient HTML iframe protection. This enables cross-frame scripting (XFS) attacks, including clickjacking, via a crafted attacker-controlled page. ...

CVE-2014-2152

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

CVE-2014-2147

The web interface in Cisco Prime Infrastructure 2.1 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka B...

Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability

A vulnerability in the web interface of the Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user ...