CVE-2011-0486

CVE-2011-0486 describes a cross-site scripting (XSS) vulnerability in IBM Cognos 8 BI (IBM Cognos 8, version 8.4.1 prior to FP1) where an attacker can inject arbitrary script/HTML via the pathinfo parameter in cognos.cgi. The issue allows remote exploitation and is classified with a MEDIUM severi...

Maltego v3.0.3 - Latest version Download !

"Maltego is a unique platform developed to deliver a clear threat picture to the environment that an organization owns and operates. Maltego's unique advantage is to demonstrate the complexity and severity of single points of failure as well as trust relationships that exist currently within the...

SECURITY ADVISORY IBM Cognos 8 Business Intelligence 8.4.1

Affected software IBM Cognos 8 Business Intelligence 8.4.1 Prior versions may also be affected. "IBM Cognos 8 Business Intelligence delivers the complete range of BI capabilities: Reporting, Analysis, Dashboarding and Scorecards on a single, service-oriented architecture SOA. Author, share and...

Oracle Business Intelligence emagent.exe nmehl_getURIParams Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Business Intelligence One. Authentication is not required to exploit this vulnerability. The flaw exists within the emagent.exe component which listens by default on TCP port 3938. When...

ZDNet Security Blogger Goes Missing in Bulgaria

A prominent blogger and security researcher, Dancho Danchev, has gone missing and security publications, including Threatpost.com, are asking for help in locating him. Danchev, who contributed regular posts to ZDNet’s Zero Day blog, part of CBS Interactive, has been missing since late October...

PandaLabs Releases : Annual Report 2010 (Must Read) !

In 2010, cyber-criminals have created and distributed a third of all existing viruses. That is, in just 12 months, they have created 34 percent of all malware that has ever existed and has been classified by the company. Furthermore, the Collective Intelligence system, which automatically detects...

Iran's Intelligence Minister Admits to Hacking Opposition Emails

Iran's Intelligence Minister, Heydar Moslehi, has publicly admitted to hacking the emails of opposition members. Iranian news agencies, including ILNA, quoted Moslehi stating that emails were the primary communication tool for opposition members during last year's postelection protests. The...

Germany to create cyber defense center !

Germany is planning the creation of a national cyber defense center in 2011 in reaction to a growing number of cyber attacks on government institutions that mostly originate in China. An interior ministry spokesman said Monday that while in 2009 the government registered only 900 attacks, there...

VUPEN Security Research - Microsoft Office Publisher Record Array Indexing Vulnerability (VUPEN-SR-2010-201)

VUPEN Security Research - Microsoft Office Publisher Record Array Indexing Vulnerability VUPEN-SR-2010-201 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Microsoft Publisher, is a desktop publishing application from Microsoft. It is an entry-level application,...

VUPEN Security Research - RealPlayer RA5 Data Handling Heap Overflow Vulnerability (VUPEN-SR-2010-31)

VUPEN Security Research - RealPlayer RA5 Data Handling Heap Overflow Vulnerability VUPEN-SR-2010-31 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "RealPlayer is a media player available to play, manage and download all your mp3, flash and video files" from real.com...

Razorback v0.1.3 - new release download

"Razorback is a framework for an intelligence driven security solution. It consists of a Dispatcher at the core of the system, surrounded by Nuggets of varying types." Again, we haven't been able to find the change log for this release. Download Razorback v0.1.3 here. Found this article...

VUPEN Security Research - Apple Safari Scrollbar Handling Use-after-free Vulnerability (VUPEN-SR-2010-245)

VUPEN Security Research - Apple Safari Scrollbar Handling Use-after-free Vulnerability VUPEN-SR-2010-245 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Apple Safari is a web browser developed by Apple. As of February 2010, Safari was the fourth most widely used...

New Bill Would Give DHS New Power Over Private Networks

The latest in what has become a long line of legislation introduced in the House and the Senate in 2010 that attempts to address the country’s computer security shortcomings is a new measure brought forward by Rep. Bennie Thompson that would, among other things, allow the to force certain private...

Firm Scores $29M for Anti Botnet-As-A-Service

Endgame Systems is expanding from the government sector to commercial anti botnet services with a $29 million investment. The headlines in recent months have been filled with news about busts of major botnet operations – Bredolab, Pushdo, Waldec and Mariposa among them. But botnets are still a...

Oracle BI Publisher HTTP Response Splitting

Digital Security Research Group DSecRG Advisory DSECRG-09-029 Application: Oracle Business Intelligence Enterprise Edition 10.1.3.4.0 Versions Affected: Oracle Business Intelligence Enterprise Edition 10.1.3.4.0 Vendor URL: http://oracle.com Bugs: Response Splitting/XSS/phishing credentials...

VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability (CVE-2010-2750)

VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability CVE-2010-2750 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- Microsoft Office Word, included in the Microsoft Office suite, is a powerful authoring program that gives the ability t...

Design/Logic Flaw

Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors...

CVE-2010-2416

CVE-2010-2416 affects Oracle E-Business Intelligence within Oracle E-Business Suite (11.5.10.2, 12.0.6, 12.1.3). The description indicates an unspecified vulnerability allowing remote integrity impact via unknown vectors. Connected sources show this CVE is listed in Oracle’s October 2010 CPU as a...

Rethinking Stuxnet

It’s hard to think of a story in the last few years that has generated more hype, conjecture, posturing, hyperbole and misdirection than Stuxnet, with the possible exception of the Aurora attacks. The commentary and hype around Stuxnet has shifted and morphed over the last few months, and now it...

Microsoft Excel - Malformed FEATHEADER Record (MS09-067) (Metasploit)

$Id: ms09067excelfeatheader.rb 10477 2010-09-25 11:59:02Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...