CVE-2014-8666

Technical details (affected product/version, root cause, impact, exploitation vectors) for CVE-2014-8666 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories for concrete information.

PT-2014-8671

Name of the Vulnerable Software and Affected Versions SAP Business Intelligence Development Workbench affected versions not specified Description The issue allows remote attackers to obtain sensitive information by reading unspecified files. Recommendations At the moment, there is no information...

PT-2014-8672

Name of the Vulnerable Software and Affected Versions SAP Business Intelligence affected versions not specified Description The issue in the User & Server configuration, InfoView refresh, user rights BI-BIP-ADM component allows remote attackers to obtain audit event details. Recommendations At th...

CVE-2014-8665: Exposure of Sensitive Information to an Unauthorized Actor

The SAP Business Intelligence Development Workbench allows remote attackers to obtain sensitive information by reading unspecified files...

CVE-2014-8666: Exposure of Sensitive Information to an Unauthorized Actor

The User & Server configuration, InfoView refresh, user rights BI-BIP-ADM component in SAP Business Intellignece allows remote attackers to obtain audit event details via unspecified vectors...

CVE-2014-4810

IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile server and the Cognos Business Intelligence server after a logoff action on a mobile device, which makes it easier for remote attackers to bypass intended Busine...

Authentication flaw

IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile server and the Cognos Business Intelligence server after a logoff action on a mobile device, which makes it easier for remote attackers to bypass intended Busine...

NSA Director Says Agency Shares Vast Majority of Bugs it Finds

When the National Security Agency discovers a new vulnerability that looks like it might be of use in penetrating target networks, the agency considers a number of factors, including how popular the affected software is and where it’s typically deployed, before deciding whether to share the new...

CVE-2014-4810

IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile server and the Cognos Business Intelligence server after a logoff action on a mobile device, which makes it easier for remote attackers to bypass intended Busine...

PT-2014-6130

Name of the Vulnerable Software and Affected Versions IBM Cognos Mobile versions 10.1.1 before FP3 IF1 IBM Cognos Mobile versions 10.2.0 before FP2 IF1 IBM Cognos Mobile versions 10.2.1 before FP4 IF1 Description The issue allows remote attackers to bypass intended Business Intelligence...

CVE-2014-4810: Undefined Security Weakness

IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile server and the Cognos Business Intelligence server after a logoff action on a mobile device, which makes it easier for remote attackers to bypass intended Busine...

CVE-2014-7325

The Business Intelligence aka com.magzter.businessintelligence application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Business Intelligence aka com.magzter.businessintelligence application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7325

The Business Intelligence aka com.magzter.businessintelligence application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7325

The CVE-2014-7325 entry concerns the Android app “Business Intelligence” (com.magzter.businessintelligence) version 3.0, which does not verify X.509 certificates when connecting to SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and exfiltrate sensitive informati...

CVE-2014-7325: Undefined Security Weakness

The Business Intelligence aka com.magzter.businessintelligence application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Operation DeathClick APT Malvertising Campaign

Advanced persistent threat groups are using malvertising in order to compromise the networks of their adversaries in what appears to be an example of high-level, nation-state attackers borrowing tactics from the typically less sophisticated cybercriminal arsenals. Attackers are also borrowing fro...

[Onapsis Security Advisory 2014-030] SAP Business Objects Denial of Service via CORBA

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory 2014-020: SAP Business Objects Denial of Service via CORBA 1. Impact on Business ===================== By exploiting this vulnerability a remote unauthenticated attacker would be able to completely shut down the SAP Business...

Researchers Work to Predict Malicious Domains

SEATTLE–A typical phishing or Web-based malware attack usually isn’t terribly complex. But they need a few things in order to work, and one of the key components often is a malicious domain. Researchers spend a lot of time identifying and taking these domains down, but some researchers now are...

Oracle Business Intelligence Mobile App Designer Information Disclosure (CVE-2014-4249)

An information disclosure vulnerability exists in Oracle Business Intelligence Mobile App Designer. The vulnerability is due to insufficient input validation of certain parameters. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the vulnerable...