Department of Education Lambasted Over Database Vulnerabilities

Like the Office of Personnel Management before it, the Department of Education has failed to heed repeated warnings that its systems contain multiple weaknesses. In a House Committee on Oversight and Government Reform hearing held this week, Congressman and committee chair Jason Chaffetz R-Utah...

[SECURITY] Fedora 22 Update: seamonkey-2.38-1.fc22

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...

Amazon Web Services Inspector Application Security Scanner

Amazon answered many security and compliance prayers yesterday with the release of its Inspector tool. Inspector scans applications launched in Amazon Web Services instances, looking for issues on two fronts: compliance with certain regulations such as the Payment Card Industry Data Security...

The vulnerability of the SAP Afaria mobile device management program allows a hacker to inject arbitrary web or HTML code.

The vulnerability of the Device Inspector page of the SAP Afaria mobile device management software exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code using a specially crafted request...

SAP Afaria Device Inspector Page Cross-Site Scripting Vulnerability

SAP Afaria is a mobile device management solution from SAP. The solution supports the effective management of mobile devices, applications, and data lifecycles and ensures their security during transmission and storage. A cross-site scripting vulnerability exists in the Client form in the Device...

CVE-2015-2873

Trend Micro Deep Discovery Inspector DDI on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct...

CVE-2015-2872

Multiple cross-site scripting XSS vulnerabilities in Trend Micro Deep Discovery Inspector DDI on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Trend Micro Deep Discovery Inspector DDI on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web...

Design/Logic Flaw

Trend Micro Deep Discovery Inspector DDI on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct...

CVE-2015-2873

CVE-2015-2873 affects Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances. The root cause is improper authorization checks on direct access to critical management URLs (system log, whitelist, blacklist). An unauthenticated, non-admin user could view or modify sensitive ...

CVE-2015-2872

Multiple cross-site scripting XSS vulnerabilities in Trend Micro Deep Discovery Inspector DDI on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web...

CVE-2015-2872

Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances is affected by CVE-2015-2872 through input handling flaws in the web interface: crafted input to index.php and the widget feature can trigger cross-site scripting. Documented impact: unauthenticated remote injection of...

Trend Micro Deep Discovery Inspector Cross-Site Scripting Vulnerability

Trend Micro Deep Discovery Inspector is a set of protection products from Trend Micro that can detect and identify hard-to-find threats in real time and propose solutions. A cross-site scripting vulnerability exists in Trend Micro Deep Discovery Inspector, which arises from the program's failure ...

Trend Micro Deep Discovery Inspector Authentication Bypass Vulnerability

Trend Micro Deep Discovery Inspector is a set of protection products from Trend Micro that can detect and identify undetectable threats in real time and propose solutions. An authentication bypass vulnerability exists in Trend Micro Deep Discovery Inspector. An attacker could use this vulnerabili...

Device Inspector 1.5 Command Injection

Document Title: =============== Device Inspector v1.5 iOS - Command Inject Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1558 Release Date: ============= 2015-08-07 Vulnerability Laboratory ID VL-ID: ====================================...

Device Inspector v1.5 iOS - Command Inject Vulnerabilities

Document Title: =============== Device Inspector v1.5 iOS - Command Inject Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1558 Release Date: ============= 2015-08-07 Vulnerability Laboratory ID VL-ID: ====================================...

SAP Afaria - Stored XSS

Application: SAP Afaria 7 Vendor URL: http://www.sap.com Bugs: XSS Reported: 18.02.2015 Vendor response: 18.02.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2152669 Authors: Dmitry Chastukhin ERPScan Vulnerability information Class: XML External Entity CWE-79 Impact: Store...

Chinese Attackers Hack NOAA's Systems

Systems belonging to the National Oceanic and Atmospheric Administration NOAA were recently compromised, purportedly by Chinese hackers. The NOAA confirmed that four of the scientific agency’s websites were targeted and compromised in an “internet-sourced attack” earlier this fall, in a statement...

[SECURITY] Fedora 20 Update: seamonkey-2.30-1.fc20

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...

U.S. Nuclear Regulator Hacked Three Times in Three Years

Hackers hit the U.S. Nuclear Regulatory Commission NRC three separate times during the past three years, duping employees of the agency into spreading malware and clicking through phishing links intended to harvest log-in credentials. A NextGov report on Monday said hackers in an unnamed foreign...