Oracle BI Publisher HTTP Response Splitting

Digital Security Research Group DSecRG Advisory DSECRG-09-029 Application: Oracle Business Intelligence Enterprise Edition 10.1.3.4.0 Versions Affected: Oracle Business Intelligence Enterprise Edition 10.1.3.4.0 Vendor URL: http://oracle.com Bugs: Response Splitting/XSS/phishing credentials...

VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability (CVE-2010-2750)

VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability CVE-2010-2750 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- Microsoft Office Word, included in the Microsoft Office suite, is a powerful authoring program that gives the ability t...

Design/Logic Flaw

Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors...

CVE-2010-2416

CVE-2010-2416 affects Oracle E-Business Intelligence within Oracle E-Business Suite (11.5.10.2, 12.0.6, 12.1.3). The description indicates an unspecified vulnerability allowing remote integrity impact via unknown vectors. Connected sources show this CVE is listed in Oracle’s October 2010 CPU as a...

Rethinking Stuxnet

It’s hard to think of a story in the last few years that has generated more hype, conjecture, posturing, hyperbole and misdirection than Stuxnet, with the possible exception of the Aurora attacks. The commentary and hype around Stuxnet has shifted and morphed over the last few months, and now it...

Microsoft Excel - Malformed FEATHEADER Record (MS09-067) (Metasploit)

$Id: ms09067excelfeatheader.rb 10477 2010-09-25 11:59:02Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Researchers Cripple Pushdo Botnet

Researchers have made a huge dent in a major variant of the Pushdo botnet, virtually crippling the network by working with hosting providers to take down about two thirds of the command-and-control servers involved in the botnet. Pushdo for years has been one of the major producers of spam and...

VUPEN Security Research - Microsoft Internet Explorer "CIframeElement" Object Use-after-free Vulnerability (CVE-2010-2558)

VUPEN Security Research - Microsoft Internet Explorer "CIframeElement" Object Use-after-free Vulnerability CVE-2010-2558 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Microsoft Internet Explorer is a web browser developed by Microsoft and included as part of the...

VUPEN Security Research - Adobe Acrobat and Reader "newfunction" Memory Corruption Vulnerability (CVE-2010-2168)

VUPEN Security Research - Adobe Acrobat and Reader "newfunction" Memory Corruption Vulnerability CVE-2010-2168 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Adobe Acrobat and Reader are the global standards for electronic document sharing. They are used to create,...

Researcher to Release Hacker Footprint Tool

A researcher at Black Hat USA next month plans to give away a homemade tool that helps organizations glean intelligence about the attacker behind the malware that includes information about native tongue, geographic location, and ties to other attacks. Read the full article. Dark Reading...

IBM Cognos Server Backdoor Account Remote Code Execution (CVE-2010-0557)

IBM Cognos Express is an integrated business intelligence BI and planning solution developed for midsized companies. It provides reporting, analysis, dashboard, scorecard, planning, budgeting and forecasting capabilities. A remote code execution vulnerability has been reported in IBM Cognos...

Friending HR: A Rich and Mineable Source of Intelligence

One of the most common complaints I hear from information security executives in large organizations is that they are constantly playing defense, not offense. Their network security apparatus is designed to wait for an attack, see if it’s successful and, if it is, to plug the hole, then repeat. T...

CVE-2010-1490

Unspecified vulnerability in IBM Cognos 8 Business Intelligence before 8.4.1 FP1 has unknown impact and attack vectors...

Code injection

Unspecified vulnerability in IBM Cognos 8 Business Intelligence before 8.4.1 FP1 has unknown impact and attack vectors...

CVE-2010-1490

Unspecified vulnerability in IBM Cognos 8 Business Intelligence before 8.4.1 FP1 has unknown impact and attack vectors...

VUPEN Security Research - Adobe Acrobat and Reader GIF Data Buffer Overflow Vulnerability

VUPEN Security Research - Adobe Acrobat and Reader GIF Data Buffer Overflow Vulnerability http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Adobe Acrobat and Reader are the global standards for electronic document sharing. They are used to create, view, search,...

Code injection

Unspecified vulnerability in the E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote authenticated users to affect integrity via unknown vectors...

Google Attack Was Tip of the Iceberg

The recent disclosure by Google, Adobe and other companies that their networks had been thoroughly compromised by attackers who may have been after their source code has prompted a tremendous amount of discourse both in the security community and in the general public about the political and...

Five Important Security Resolutions for Adobe

The year was 2001. Code Red, the Microsoft Web Server worm was running rampant and underscored every security professional’s perception that Microsoft products were both a necessary evil and a serious security liability. Fast-forward to nine years later. Microsoft products still contain more than...

Worms and Scareware Attacks on the Rise

Microsoft today released its biannual Security Intelligence Report which demonstrates some surprising conclusions about how the threat landscape is impacting enterprise networks. For example, the number of rogue security software infections, which experienced a high-profile scourge earlier this...