Final Report on DigiNotar Hack Shows Total Compromise of CA Servers

The attacker who penetrated the Dutch CA DigiNotar last year had complete control of all eight of the company’s certificate-issuing servers during the operation and he may also have issued some rogue certificates that have not yet been identified. The final report from a security company...

ManageEngine ServiceDesk 8.0 Multiple Vulnerabilities

Exploit for php platform in category web applications ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities Introduction: ============= ServiceDesk Plus integrates your help desk requests and assets to help you manage your IT effectively. It helps you implement ITIL best practices and...

Secunia launches Secunia Vulnerability Intelligence Manager 4.0

78% of vulnerabilities are found in third-party programs. Security teams cannot monitor all of them manually or determine which ones are critical to their organization. Secunia, the leading provider of IT security solutions that enables businesses and private individuals to manage and control...

Alliance Issues Guidance for Cloud-Based SIEM Services

The non-profit Cloud Security Alliance today released guidelines for the nascent Security as a Service SecaaS specialization within the broader realm of cloud computing. The goal, the group says, is to help companies and consumers gain a better handle on how best to evaluate, build and deploy...

IT Security Horror Stories: Truth is Scarier Than Fiction

At Coalfire Labs, we discover--and help our clients address--some pretty scary security and compliance problems. Everyones heard of blood-sucking cyber criminals looking for vulnerable IT systems. Even when organizations have protections in place, these monsters just wont give up. Their appetite ...

IT Security Horror Stories: The Case of the Phantom Technician

At Coalfire Labs, we discover--and help our clients address--a lot of scary security and compliance problems. Like zombies out looking for a victim, nefarious characters are out to attack your IT infrastructure and compromise your systems. Even when organizations have protections in place, the...

Novell ZENworks Asset Management Detection

The remote host is running the Novell ZENworks Asset Management, which is a suite of tools for the management of IT resources. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid62703; scriptversion"1.3"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"Novell ZENwork...

Verizon DBIR Analysis: Opportunistic Attacks Crushing Certain Industries

Regardless of the market or industry, the majority of attacks are financially motivated. Even in data-rich environments such as health care, attackers are still after profits and exploit the same weaknesses and transaction processing systems that are vulnerable in other industries such as hotels...

Cyber threats a major risk to business

When it comes to security, small and midsize businesses are largely unaware of the risks they face. Cybercrime is a serious problem which affects businesses of all sizes and can have devastating consequences. U.S. small businesses should understand they cannot completely remain safe from...

Multiple vulnerabilities in Megapolis.Portal Manager

Hello 3APA3A! I want to warn you about multiple Cross-Site Scripting vulnerabilities in Megapolis.Portal Manager. It's commercial CMS from Softline-IT earlier Softline, which in particularly widespread among Ukrainian government sites including ministry, parliament, two special services and many...

Infographic: Veracode on Mobile Security and Protecting Your Device

Veracode have put out another snazzy infographic, this time to help illustrate the mobile computing boom of the last few years. To accompany the BYOD Bring Your Own Device policy that’s becoming commonplace in offices around the world, the web security firm uses two characters, Joe Worker and Joe...

MS12-064: Vulnerabilities in Microsoft Word could allow remote code execution: October 9, 2012

Fixes vulnerabilities in Microsoft Word could allow remote code execution, that was released on October 9, 2012.INTRODUCTIONMicrosoft has released security bulletin MS12-064. To view the complete security bulletin, go to one of the following Microsoft websites:Home...

MS12-070: Description of the security update for SQL Server 2012 QFE: October 9, 2012

None None...

Megapolis.Portal Manager Cross Site Scripting

Hello list! I want to warn you about multiple Cross-Site Scripting vulnerabilities in Megapolis.Portal Manager. It's commercial CMS from Softline-IT earlier Softline, which in particularly widespread among Ukrainian government sites including ministry, parliament, two special services and many...

Microsoft Internet Explorer 6/7/8/9 contain a use-after-free vulnerability

Overview Microsoft Internet Explorer versions 6, 7, 8, and 9 are susceptible to a use-after-free vulnerability CWE-416 that may result in remote code execution. Description Microsoft Internet Explorer 6/7/8/9 contains a use-after-free vulnerability in the CMshtmlEd::Exec function. An attacker may...

CVE-2012-0746

Cross-site scripting XSS vulnerability in IBM Maximo Asset Management 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database CCMDB, allows remote authenticated users to inject...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database CCMDB, allows remote attackers to...

CVE-2012-0746

Cross-site scripting XSS vulnerability in IBM Maximo Asset Management 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database CCMDB, allows remote authenticated users to inject...

CVE-2012-0714

IBM Maximo-related CVE-2012-0714 is a Cross-Site Request Forgery affecting Maximo Asset Management 6.2–7.5 (and related IBM products such as SmartCloud Control Desk, Tivoli AIT, Tivoli Service Request Manager, Maximo Service Desk, and CCMDB). The IBM bulletin confirms the root cause as CSRF that ...

CVE-2012-3313

CVE-2012-3313 is an XSS vulnerability in IBM Maximo Asset Management 6.2–7.5 (and related products such as SmartCloud Control Desk, Tivoli AM for IT, TS RM, Maximo Service Desk, and CCMDB). The issue allows an attacker to inject arbitrary web script/HTML via unspecified vectors in affected deploy...