Vulnerability Spotlight: Multiple Vulnerabilities in Sony IPELA E Series Camera

Vulnerabilities discovered by Cory Duplantis and Claudio Bozzato of Cisco Talos. Overview Today, Cisco Talos is disclosing several vulnerabilities discovered with the Sony IPELA E Series Network Camera. Sony IPELA Cameras are network-facing cameras used for monitoring and surveillance...

Security Bulletins - Cognos Analytics and Cognos Business Intelligence

Problem Cognos Analytics and Cognos Business Intelligence Security Bulletins and Alerts. Resolving The Problem Tab navigation CA 11.0.x BI 10.2.2 BI 10.2.1 BI 10.2 Security bulletins and Alerts for Cognos Analytics 11.0.x. --- Published / Updated | Title January 2018 | Cognos Analytics is affecte...

What’s the real value—and danger—of smart assistants?

You've heard them called virtual assistants, digital personal assistants, voice assistants, or smart assistants. Operated by artificial intelligence, technologies such as Siri, Alexa, Google Assistant, and Cortana have become ubiquitous in our culture. But what exactly do they do? And how serious...

Jumpstart your Microsoft Graph Security API integration with the new JavaScript sample app

The Microsoft Graph Security API, which launched this spring, is a unified REST API for integrating data and intelligence from Microsoft products, services, and partners. Using Microsoft Graph, developers can easily build applications that consolidate and correlate security alerts from multiple...

Drupal, Phishing and A New Cryptomining Botnet

It’s a well-known fact that security solutions must quickly adapt to new attack methods. There are several ways to achieve this goal, regularly applying security patches and updates, relying on threat intelligence and more. At Imperva, we use pattern anomaly detection as one of the tools to...

Smaller Nation State Attacks: A Growing Cyber Menace

Last year, a Qatari state media website was compromised and defaced with false reports of the Emir of that country praising Iran and Hamas. The fake content was blasted on social media and amplified through bots, eventually provoking a regional boycott that persists today. Andrea Little Limbago...

Iron Rain: Gaining Situational Intelligence to Make Rapid Decisions

In our previous article we introduced the idea of cyber insurgency and irregular warfare. Building on effective techniques from the Marine Corps, we now want to discuss combating the threat. COUNTERINSURGENT FORCES MUST UNDERSTAND THE ENVIRONMENT As destructive attacks surge, integrity attacks...

How Microsoft 365 Security integrates with the broader security ecosystem—part 1

Today's post was coauthored by Debraj Ghosh, Senior Product Marketing Manager, and Diana Kelley, Cybersecurity Field CTO. This week is the annual Microsoft Inspire conference, where Microsoft directly engages with industry partners. Last year at Inspire, we announced Microsoft 365, providing a...

A week in security (July 9 – July 15)

Last week, we talked about domestic abuse fuelled by IoT, doing threat intel programs right, blocking ICO fraud, and man-in-the-middle attacks. We also explained why we block shady ad blockers and provided tips to online shoppers for Prime Day. Other news: Reports revealed that low-end Android...

12 Russian Intelligence Agents Indicted For Hacking DNC Emails

The US Justice Department has announced criminal indictments against 12 Russian intelligence officers tied to the hack of the Democratic National Committee DNC during the 2016 US presidential election campaign. The charges were drawn up as part of the investigation of Russian interference in the...

Justice Department Indicts 12 Russian Nationals Tied to 2016 Election Hacking

The United States Justice Department on Friday announced 12 indictments against Russian nationals, accusing them of engaging in a “sustained effort” to hack Democrats’ emails and computer networks. According to Rod Rosenstein, United States deputy Attorney General, all 12 defendants are members o...

Information disclosure

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 1268...

CVE-2017-1395

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive...

CVE-2017-1367

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 1268...

CVE-2017-1395

The CVE-2017-1395 entry affects IBM Security Identity Governance Virtual Appliance (IGI) 5.2 to 5.2.3.2. Root cause: HTTP Strict Transport Security was not properly enabled, enabling an information-disclosure scenario via MITM attacks. Impact: partial confidentiality loss through exposed sensitiv...

CVE-2017-1367

Summary (CVE-2017-1367): IBM Security Identity Governance and Intelligence Virtual Appliance (IGI) versions 5.2 through 5.2.3.2 store sensitive information in URL parameters. This can lead to information disclosure if URLs are captured in server logs, the Referer header, or browser history. The I...

CVE-2017-1395

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive...

CVE-2017-1395: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive...

PT-2018-5589

Name of the Vulnerable Software and Affected Versions: IBM Security Identity Governance and Intelligence Virtual Appliance versions 5.2 through 5.2.3.2 Description: The issue concerns the storage of sensitive information in URL parameters, which could lead to information disclosure if unauthorize...

G DATA Total Security 25.4.0.3 - Activex Buffer Overflow Exploit

Exploit for windows platform in category dos / poc 'for debugging/custom prolog targetFile = "C:\Program Files\G DATA\TotalSecurity\ASK\GDASpam.dll" prototype = "Function IsBlackL...