8572 matches found
90 Percent of the Information Intercepted by NSA Belongs to Ordinary Internet Users
If anybody says that NSA is watching you, nobody surprises. But, a large scale investigation published by Washington Post indicates that the scope of surveillance carried out by US National Security Agency was massive even than the expectation of you and me. Just because you are an ordinary perso...
EFF Sues NSA, ODNI Over Zero-Day Disclosure Processes
The Electronic Frontier Foundation wants a peek behind the curtain of the government’s Vulnerabilities Equities Process. The advocacy group on Tuesday filed a Freedom of Information Act FOIA lawsuit against the National Security Agency and the Office of the Director of National Intelligence hopin...
SpagoBI 4.0 - Persistent XSS Vulnerability
No description provided by source. 01. Advisory Information Title: Persistent Cross-Site Scripting XSS in SpagoBI Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE...
Panda Global Protection 2010 local Dos (unfiltered wcscpy())
No description provided by source. include windows.h include string.h include ddk/ntapi.h include tlhelp32.h define SystemModuleInfo 11 / Program : Panda Global Protection 2010 3.01.00 Homepage : http://www.pandasecurity.com Discovery : 2010/04/09 Author Contacted : 2010/07/15 Status of vuln :...
Splunk <= 4.3.3 Arbitrary File Read
No description provided by source. Exploit Title: Splunk = 4.3.3 Reading Arbitrary Files Contents Date: 09/03/2012 Exploit Author: Marcio Almeida [email protected] Vendor Homepage: http://www.splunk.com/ Software Link: http://www.splunk.com/download?r=header Version: 4.3.3 and priors...
ICS Malware Found on Vendors' Update Installers
Malware targeting industrial control systems has infected the update installers belonging to three known industrial control vendors, according to an advisory from the Industrial Control Systems Cyber Emergency Response Team ICS-CERT. The Havex remote access Trojan RAT is targeting vendors via...
New Oil and Natural Gas ONG-ISAC Launches
Energy utilities certainly have not been spared by hackers who for years have targeted vulnerabilities in process control systems and networks with alarming success. In a move to close the gap and keep that corner of the U.S.’ critical infrastructure secure, a new information sharing group popped...
New Data Shows FBI Issued More Than 19k National Security Letters in 2013
The United States federal government issued more than 19,000 National Security Letters–perhaps its most powerful tool for domestic intelligence collection–in 2013, and those NSLs contained more than 38,000 individual requests for information. The new data was released by the Office of the Directo...
Smart Pentester - An SSH based Penetration Testing Framework
Smart Pentester is an SSH based Penetration Testing Framework. It provides a GUI for well known tools like nmap, hping, tcpdump, volatility, hydra and etc. Smart Pentester Framework will provide you a User Interface for Penetration testing, Malware Analysis, Forensic Analysis, Cyber Intelligence,...
Crowdsourcing a Tool for Application Vulnerability Research
Pulling in security help on a project has traditionally meant either hiring more full-time help, or bringing in an outside consultant. Enterprises and vendors alike, however, are starting to really go outside the perimeter these days and are taking advantage of crowdsourcing. Given the paranoia i...
House Amendment Limits Funding for NSA Surveillance
The House of Representatives last night overwhelmingly passed an amendment to the Department of Defense Appropriations Act that would cut funding for two programs that grant intelligence agencies access to the private data and communications of U.S. citizens. The amendment shows that Congress is...
China Putter Panda APT Attacks Linked to PLA Unit 61486
With indictments still fresh against a handful of Chinese nationals accused of hacking American companies and stealing intellectual property, another branch of the People’s Liberation Army and allegedly one of its officers have been outed for cyberespionage against U.S. and European aerospace and...
Vodafone Reveals Some Governments Have Direct Access to Their Data Centers
Vodafone, the world’s second-largest mobile carrier with more than 400 million customers around the world has issued its first "Law Enforcement Disclosure Report", reveals that the governments in some of the countries it operates, have direct access to its network allowing them to listen to all...
Vulnerability Management: Think Like an Attacker to Prioritize Risks
Attackers care about ROI – they want to accomplish their objective with the least investment of time and resources possible. The same is true for you - to most effectively manage vulnerabilities, you need to think like an attacker. Ask yourself: How would you go about compromising systems,...
Hook Analyser 3.1 - Malware Analysis Tool
Hook Analyser is a freeware application which allows an investigator/analyst to perform “static & run-time / dynamic” analysis of suspicious applications, also gather analyse & co-related threat intelligence related information or data from various open sources on the Internet. Essentially it’s a...
Iranian Campaign Snooped on U.S. and Israeli Officials
Iranian spies have carried out an intelligence gathering campaign since at least 2011 by targeting U.S. military, diplomats, D.C. journalists, and government emissaries, just to name a few, a via social media. According to iSIGHT Partners, a cyber threat intelligence firm, attackers have long bee...
VUPEN Security Research - Adobe Acrobat & Reader XI-X Barcode Heap Overflow (Pwn2Own)
VUPEN Security Research - Adobe Acrobat & Reader XI-X Barcode Heap Overflow Pwn2Own Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Adobe Acrobat and Reader are the global standards for electronic document sharing. They are used to create, vie...
Critical Infrastructure Continues to Patch Heartbleed
Unified Automation issued a security advisory warning that its OPC UA software developers kit SDK for Windows contains the OpenSSL cryptography library that is vulnerable to Heartbleed. Schneider Electric, another industrial control system ICS manufacturer, posted its own advisory with mitigation...
IETF To Mitigate Pervasive Monitoring In Future Protocols
The Internet Engineering Task Force IETF has defined pervasive monitoring, otherwise known as unwarranted surveillance and analysis of Internet traffic and even the subversion of cryptographic keys, as an attack and wants future versions of IETF-sponsored protocols to be designed to mitigate it...
Skybox Security 6.3.x - 6.4.x - Multiple Information Disclosure
Exploit for hardware platform in category web applications Exploit Title: SKYBOX Security – Multiple Information Disclosure Date: 22-Jan-2014 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.skyboxsecurity.com Version: Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.14,...