Code injection

SAP BusinessObjects Business Intelligence Platform Administration Console, versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript co...

TRISIS Group, Known for Physical Destruction, Targets U.S. Electric Companies

XENOTIME, the APT group behind the TRISIS industrial control system ICS event, has expanded its focus beyond the oil and gas industries, according to researchers. The group has recently been seen probing the networks of electric utility organizations in the U.S. and elsewhere – perhaps a precurso...

Computers and Video Surveillance

It used to be that surveillance cameras were passive. Maybe they just recorded, and no one looked at the video unless they needed to. Maybe a bored guard watched a dozen different screens, scanning for something interesting. In either case, the video was only stored for a few days because storage...

RapidScan - The Multi-Tool Web Vulnerability Scanner

Evolution: It is quite a fuss for a pentester to perform binge-tool-scanning running security scanning tools one after the other sans automation. Unless you are a pro at automating stuff, it is a herculean task to perform binge-scan for each and every engagement. The ultimate goal of this program...

Integrating Threat and Vulnerability Management with Patch Management: The (Feasible) Quantum Leap

The rise of sophisticated attacks combined with the security-skills shortage have driven many organizations to go back to basics and review their processes for vulnerability and patch management. The approach is definitely a winning one, given that shrinking and managing the vulnerability surface...

AI Isn't Good Enough When Lives Are on the Line, Experts Warn

LONDON, UK – With the infosec community eyeing artificial intelligence as the next big frontier for cyber defense, experts here at Infosecurity Europe on Tuesday warned that several challenges in how AI processes and interprets data need to first be fleshed out before widespread adoption. AI, in...

Vthunting - A Tiny Script Used To Generate Report About VirusTotal Hunting And Send It By Email, Slack Or Telegram

Virus Total Hunting is a tiny tool based on the VT api version 3 to run daily, weekly or monthly report about malware hunting. The report can be send via email, Slack channel or Telegram. The tool can also be used in cli to get a report anytime. The default number of result is 10 but it can be...

How to become a better writer with Wordeep using artificial intelligence

By Owais Sultan Wordeep uses Artificial Intelligence to improve what you write. Writing may seem to be an easy task to overcome, but it is definitely not for the faint-hearted. No one can even master writing overnight, and it may take someone years to master it. You also have to consider the fact...

The vulnerability of the Interaction Center Intelligence component of the Oracle E-Business Suite automation system allows a perpetrator to access confidential information.

The vulnerability of the Interaction Center Intelligence component of the Oracle E-Business Suite automation system for enterprises is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to confidential...

AI, the Mandatory Element of 5G Mobile Security

THE HAGUE, Netherlands – Artificial intelligence will be a requirement for securing carrier 5G networks – which is shaping up to be a technology juggernaut that presents unique challenges unlike any ever seen in the world of telecom until now. That was the assessment at the GSMA Mobile 360 Securi...

Security Bulletin: Vulnerabilities in IBM Java SDK (January 2019) affecting IBM Application Delivery Intelligence for IBM Z V5.1.0, V5.0.5 and V5.0.4

Summary Multiple vulnerabilities are identified in IBM® SDK Java™ Technology Edition Version 1.7 and Version 1.8 that are used by IBM Application Delivery Intelligence for IBM Z V5.1.0, V5.0.5, and V5.0.4 respectively. These issues were disclosed as part of the IBM Java SDK updates in January 201...

The vulnerability of the Data Exchange Layer Platform, a messaging application between applications, and the Threat Intelligence Exchange Server, related to the lack of protection for operational data, allows access to confidential information.

The vulnerability of the Data Exchange Layer Platform, a messaging application between applications, and the Threat Intelligence Exchange Server, a threat protection system, is related to the lack of protection for operational data. Exploiting this vulnerability can allow attackers to gain access...

The 5 Conversations I want to have at CB Connect 2019

In a few weeks, I’ll be attending CB Connect in my hometown of San Diego, CA. If you’ve read my earlier blogs, you know I’m passionate about this event because it brings together some of the best and brightest in the security space to network and collaborate on solving some of our industry’s...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2019-4279)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: Remote...

Sharing Threat Intelligence: Time for an Overhaul

Most organizations don’t really have a good way of sharing threat-related data outside of their own industry verticals. Sure, there are Information Sharing and Analysis Centers ISACs; i.e. FS-ISACs for the financial-services industry. But the information still tends to stay in industry-specific...

Threat Intelligence – What It Is and Why You Need It

Threat intelligence is a broad term. Some might think it refers to having information about what threats are out there. But in the evolved world of cybersecurity, threat intelligence is actually a verb. Cybersecurity threat intelligence is the ability to take closed-source or open-source data fro...

Friday Squid Blogging: On Squid Intelligence

Two links. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Design/Logic Flaw

A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a users browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...

CVE-2019-1860

A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a users browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...

CVE-2019-1860 Cisco Unified Intelligence Center Remote File Injection Vulnerability

A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a users browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...