Friday Squid Blogging: On Squid Intelligence

Two links. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Design/Logic Flaw

A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a users browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...

CVE-2019-1860

A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a users browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...

CVE-2019-1860 Cisco Unified Intelligence Center Remote File Injection Vulnerability

A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a users browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...

CVE-2019-1860

CVE-2019-1860 concerns Cisco Unified Intelligence Center. Affects the dashboard gadget rendering where lack of gadget validation lets an unauthenticated, remote attacker coerce users to load a malicious gadget, enabling access to or manipulation of sensitive information between a user’s browser a...

CVE-2019-1860 Cisco Unified Intelligence Center Remote File Injection Vulnerability

A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a users browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...

CVE-2019-1860: Improper Control of Resource Identifiers

A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a user’s browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...

Cisco Unified Intelligence Center Remote File Injection Vulnerability

Cisco Unified Intelligence Center is the United States Cisco Cisco company's set of Web-based reporting platform. The platform provides reports related to business data and call center data presentation capabilities. A remote file injection vulnerability exists in Cisco Unified Intelligence Cente...

PT-2019-2363

Name of the Vulnerable Software and Affected Versions Cisco Unified Intelligence Center affected versions not specified Description The issue is related to incorrect resource identifier control in the monitoring panel of Cisco Unified Intelligence Center. It could allow a remote attacker to impac...

CVE-2019-0287

Under certain conditions SAP BusinessObjects Business Intelligence platform Central Management Server, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

CVE-2019-0289

Under certain conditions SAP BusinessObjects Business Intelligence platform Analysis for OLAP, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

CVE-2019-0289

Under certain conditions SAP BusinessObjects Business Intelligence platform Analysis for OLAP, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

Machinae v1.4.8 - Security Intelligence Collector

Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes, and SSL fingerprints. It was inspired by Automater, another excellent tool for collecting information. The Machinae...

CVE-2019-0289

Under certain conditions SAP BusinessObjects Business Intelligence platform Analysis for OLAP, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

CVE-2019-0289

CVE-2019-0289 affects SAP BusinessObjects Business Intelligence Platform (Analysis for OLAP), specifically versions 4.2 and 4.3, where an attacker can access information that should be restricted. The provided documents confirm the affected product and the information disclosure impact but do not...

CB TAU Threat Intelligence Notification: JCry Ransomware Pretends to be Adobe Flash Player Update Installer

JCry is a new family of ransomware that has the unique characteristic of being written in the Go programming language and being delivered as multiple executables, each with their own purpose. It was pretending to be an Adobe flash player update installer on a compromised website to lure users to...

CVE-2019-0289: Undefined Security Weakness

Under certain conditions SAP BusinessObjects Business Intelligence platform Analysis for OLAP, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

CVE-2019-0287: Undefined Security Weakness

Under certain conditions SAP BusinessObjects Business Intelligence platform Central Management Server, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

PT-2019-11220

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence platform Analysis for OLAP versions 4.2 and 4.3 Description: The issue allows an attacker to access restricted information under certain conditions. Recommendations: For versions 4.2 and 4.3, at the...

PT-2019-11219

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence platform Central Management Server versions 4.2 and 4.3 Description: The issue allows an attacker to access restricted information under certain conditions. Recommendations: For versions 4.2 and 4.3, ...