Congress to Consider Critical Infrastructure Protection Bill

The National Cybersecurity and Critical Infrastructure Protection Act of 2013 would amend the Homeland Security Act of 2002 to better protect the country against potentially destructive cyber attacks targeting national utilities and other critical infrastructure systems. The House Subcommittee on...

PYSEC-2014-69

python-keystoneclient before 0.2.4, as used in OpenStack Keystone Folsom, does not properly check expiry for PKI tokens, which allows remote authenticated users to 1 retain use of a token after it has expired, or 2 use a revoked token once it expires...

USB Malware Targeting Siemens Control Software (Update C)

Overview VirusBlokAda, an antivirus vendor based in Belarus, announcedVirusBlokAda, http://www.anti-virus.by/en/tempo.shtml, website last visited July 15, 2010. the discovery of malware that uses a zero-day vulnerability in Microsoft Windows processing of shortcut files. The malware utilizes this...

Solar Magnetic Storm Impact on Control Systems

Overview The sun generates solar flare and coronal mass ejection CME events in an approximate 11-year cycle. The plasma clouds generated from these events have the potential to cause geomagnetic storms that can interfere with terrestrial communications and other electronic systems, posing a risk ...

UK CPNI Releases Spear Phishing Paper

The United Kingdom's Centre for the Protection of National Infrastructure CPNI has recently released a paper titled "Spear Phishing - Understanding the Threat;" this document provides guidance on how spear phishing attacks work, whether you are likely to be a target, and the steps organizations c...

Solaris 10 (sparc) : 144221-17 (deprecated)

Vulnerability in the Solaris Cluster component of Oracle and Sun Systems Products Suite subcomponent: Zone Cluster Infrastructure. Supported versions that are affected are 3.2, 3.3 and 4 prior to 4.1 SRU 3. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of...

Solaris 10 (x86) : 144222-16 (deprecated)

Vulnerability in the Solaris Cluster component of Oracle and Sun Systems Products Suite subcomponent: Zone Cluster Infrastructure. Supported versions that are affected are 3.2, 3.3 and 4 prior to 4.1 SRU 3. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of...

[SECURITY] Fedora 20 Update: boinc-client-7.2.33-2.git1994cc8.fc20

The Berkeley Open Infrastructure for Network Computing BOINC is an open- source software platform which supports distributed computing, primarily in the form of "volunteer" computing and "desktop Grid" computing. It is well suited for problems which are often described as "trivially parallel". BO...

Moderate: Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.4 security update

An updated Grid component package that fixes multiple security issues is now available for Red Hat Enterprise MRG 2.4 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

[SECURITY] Fedora 20 Update: zabbix-2.0.9-2.fc20

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechan ism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

[SECURITY] Fedora 19 Update: zabbix-2.0.9-2.fc19

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechan ism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

[SECURITY] Fedora 18 Update: php-symfony2-Templating-2.2.10-1.fc18

Templating provides all the tools needed to build any kind of template syst em. It provides an infrastructure to load template files and optionally monitor them for changes. It also provides a concrete template engine implementation using PHP with additional tools for escaping and separating...

CVE-2013-6820

Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure NWDI allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors...

Unrestricted file upload

Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure NWDI allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors...

CVE-2013-6820

CVE-2013-6820 describes an unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) that allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors. According to NVD, the issue yields a CVSS v2 ba...

Critical Infrastructure Beyond the Power Grid

The term "critical infrastructure" has earned its spot on the board of our ongoing game of cyber bingo--right next to "Digital Pearl Harbor," "Cyber 9/11," "SCADA" and "Stuxnet." With "critical infrastructure" thrown about in references to cyber threats nearly every week, we thought it was time f...

Surveillance Backdoors 'Contribute to Insecurity', Report Says

The existing state of affairs in which government agencies and intelligence services work to insert backdoors into various hardware, software and networks is not only a problem in terms of civil rights but also represents a serious security risk to most users and the Internet itself, a recent...

Stuxnet also infected the internal network of a Russian nuclear plant

We have a lot of information on Stuxnet virus, a powerful malware that for the first time has shown to governments the capabilities and efficiency of a cyber weapon. Eugene Kaspersky, CEO of Kasperky security firm revealed that Stuxnet had badly infected the internal network of a Russian nuclear...

Stuxnet also infected the internal network of a Russian nuclear plant

We have a lot of information on Stuxnet virus, a powerful malware that for the first time has shown to governments the capabilities and efficiency of a cyber weapon. Eugene Kaspersky, CEO of Kasperky security firm revealed that Stuxnet had badly infected the internal network of a Russian nuclear...

NIST Publishes Preliminary Cybersecurity Framework

Following an Executive Order issued by U.S. President Barack Obama in February of this year, the National Institute of Standards and Technology NIST yesterday made public a provisional copy of the government’s cybersecurity framework and says it will accept public comment on the draft for the nex...