Input validation

Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page...

CVE-2019-14672

Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page...

CVE-2019-14672

Firefly III 4.7.17.5 is vulnerable to a stored XSS due to lack of filtration of user-supplied data in the liability name field. The JavaScript executes upon an error condition during visits to the account show page. Root cause: unsanitized input in the liability name. Impact: stored XSS; no expli...

Business banking fraud. Keep your eggs in TWO baskets. Here’s why…

This post has a cautionary tale all about spreading your business banking fraud risk. So, does your business have two bank accounts, with different banks? No? Then you would be well advised to do so, or risk being left unable to trade. WHY? Business banking ‘cyber’ fraud is increasingly common; I...

Incident Response: Do Your Vendor Contracts Have Claws (for Liability)?

In previous blogs, weve discussed some of the struggles organizations have when responding to cyber incidents. For many, it is the recovery aspect, and specifically vendor liability for the data or privacy breach, that poses many questions. In trying to assign liability, the obvious place to star...

When It Comes To IoT Security, Liability Is Muddled

BOSTON—From hacked connected cars to power grids, the implications of IoT security issues seem to be getting graver – yet when it comes to pointing fingers for security troubles, many times victims don’t even know where to start. IoT experts said at the Security of Things Forum today said that a...

Cybersecurity Insurance

Good article about how difficult it is to insure an organization against Internet attacks, and how expensive the insurance is. Companies like retailers, banks, and healthcare providers began seeking out cyberinsurance in the early 2000s, when states first passed data breach notification laws. But...

GDPR: The Stakes Are High and Time Is of the Essence

With the General Data Protection Regulation GDPR going into effect in under three months, the countdown clock is fast approaching zero for organizations worldwide that handle personal data of EU residents. GDPR is a very broad and wide-ranging regulation that requires organizations to obtain a lo...

Unspecified Vulnerability in Oracle Financial Services Asset Liability Management Component (CNVD-2018-01708)

Oracle Financial Services Applications is Oracle's suite of financial services software that integrates core banking, online banking, and property management.Oracle Financial Services Asset Liability Management is one of the financial services asset liability management components. Oracle Financi...

Unspecified Vulnerability in Oracle Financial Services Asset Liability Management Component

Oracle Financial Services Applications is Oracle's suite of financial services software that integrates core banking, online banking, and property management.Oracle Financial Services Asset Liability Management is one of the financial services asset liability management components. Oracle Financi...

CVE-2018-2723

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications subcomponent: User Interface. Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access...

CVE-2018-2723

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications subcomponent: User Interface. Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access...

CVE-2018-2692

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications subcomponent: User Interface. Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network acces...

CVE-2018-2692

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications subcomponent: User Interface. Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network acces...

Design/Logic Flaw

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications subcomponent: User Interface. Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access...

Buffer overflow

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications subcomponent: User Interface. Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network acces...

CVE-2018-2723

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications subcomponent: User Interface. Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access...

CVE-2018-2723

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications subcomponent: User Interface. Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access...

CVE-2018-2692

CVE-2018-2692 affects Oracle Financial Services Asset Liability Management (A LM) UI in Oracle Financial Services Applications. Affected versions are 6.1.x and 8.0.x. The vulnerability permits an unauthenticated attacker with network access via HTTP to compromise the A LM component. Successful at...

CVE-2018-2692

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications subcomponent: User Interface. Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network acces...