4799 matches found
Data Pours from Cloud—And ‘The Enemy is Us’
Accenture, Verizon, Dow Jones and Deep Root Analytics are just the tip of the iceberg when it comes to the millions of private records and sensitive enterprise data exposed on cloud backends this year. And the problem is getting worse not better. “The enemy is us,” said Chris Vickery, director of...
SUSE-SU-2017:2922-1 Security update for ceph
CEPH was updated to version 10.2.10, which brings several fixes and enhancements. Upstream 10.2.10 release summary can be found at: https://ceph.com/releases/v10-2-10-jewel-released/ Security issues fixed: - CVE-2017-7519: libradosstriper processed arbitrary printf placeholders in user input...
Protecting Xero’s Cloud-Based Accounting Platform from Cyber Attacks
Meeting with customers is always insightful, and recently I got a chance to sit down with Aaron McKeown, head of security engineering and architecture at Xero, to talk about how they use Imperva SecureSphere for their cloud-hosted applications. Founded in 2006, Xero provides cloud accounting...
UBUNTU-CVE-2012-6707
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a...
DEBIAN-CVE-2012-6707
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a...
Move WEM SQL database to a new SQL instance with/without SysAdmin permissions
Unable to perform a migration of the WEM Database to a new SQL Server due to minimal permissions in SQL. SysAdmin permissions on new SQL Server are not allowed and thus can not be used from the WEM broker...
USN-3449-1 nova vulnerabilities
George Shuklin discovered that OpenStack Nova incorrectly handled the migration process. A remote authenticated user could use this issue to consume resources, resulting in a denial of service. CVE-2015-3241 George Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly handled deleti...
CVE-2017-1000113
The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with...
App Layering/Unidesk V2: Migrating a Unidesk System to a Different VMware vCenter
...
September 19, 2017—KB4038803 (Preview of Monthly Rollup)
None None...
Security update for qemu (important)
This update for qemu fixes the following issues: Security issues fixed: CVE-2017-10664: Fix DOS vulnerability in qemu-nbd bsc1046636 CVE-2017-10806: Fix DOS from stack overflow in debug messages of usb redirection support bsc1047674 CVE-2017-11334: Fix OOB access during DMA operation bsc1048902...
openSUSE Security Update : qemu (openSUSE-2017-1072)
This update for qemu fixes the following issues : Security issues fixed : - CVE-2017-10664: Fix DOS vulnerability in qemu-nbd bsc1046636 - CVE-2017-10806: Fix DOS from stack overflow in debug messages of usb redirection support bsc1047674 - CVE-2017-11334: Fix OOB access during DMA operation...
Informatica: Reflected XSS
Researcher has found Reflected XSS on one of the Informatica's domain, and was resolved by migration of the web application...
Google reminds website owners to move to HTTPS before October deadline
With the release of Chrome v62 in less than 3 months, Google will begin marking non-HTTPS pages with text input fields—like contact forms and search bars—and all HTTP websites viewed in Incognito mode as "NOT SECURE" in the address bar. The company has started sending out warning emails to web...
TippingPoint Threat Intelligence and Zero-Day Coverage – Week of August 28, 2017
The only topic I can bring up this week is the devastation in Texas caused by Hurricane Harvey. Many cities have been completely destroyed and to add insult to injury, Harvey moved back to the Gulf of Mexico and made landfall again in Louisiana. Catastrophic flooding has left tens of thousands...
GSA Bounty: federalist.18f.gov vulnerable to Sweet32 attack
The researcher noted that federalist.18f.gov allows use of the TLSRSAWITH3DESEDECBCSHA cipher, which is now marked as "weak" in SSL labs because of risks of MitM attacks given this vulnerability: https://sweet32.info/, which requires monitoring of a long lived HTTPS connection. We inherit this...
Product update: Virtuozzo 7.0 Update 5 Hotfix 1 (7.0.5-631)
The Hotfix 1 for Virtuozzo 7.0 Update 5 provides a new feature as well as stability and usability bug fixes. Vulnerability id: PSBM-70449 Copying small service files stored on MDS could result in cluster unmount. Vulnerability id: PSBM-69911 VNC console in PowerPanel did not work for VMs running ...
MindPoint Group and Trend Micro Help Secure NASA’s Successful Journey to the AWS Cloud
For decades NASA has launched countless successful explorations into space, but just recently took on the mission of launching their data into the cloud, similarly to many other organizations today. With the help of MindPoint Group using Trend Micro Deep Security, powered by XGen™, this was yet...