Threat Outbreak Alert RuleID28128: Email Messages Distributing Malicious Software on March 3, 2017

Medium Alert ID: 52875 First Published: 2017 March 3 16:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28128 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID27986: Email Messages Distributing Malicious Software on February 22, 2017

Medium Alert ID: 52719 First Published: 2017 February 23 13:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID27986 may contain the following files: Name |...

SQL Injection Vulnerability in Ocean CMS Order Parameter

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the adminnews.php page in the official version of Ocean CMS 6.46 utf-8. The lack of filtering of the 'order' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the...

CVE-2016-6233

The 1 order and 2 group methods in ZendDbSelect in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern \w in a regular expression...

UBUNTU-CVE-2016-4861

The 1 order and 2 group methods in ZendDbSelect in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation...

UBUNTU-CVE-2016-6233

The 1 order and 2 group methods in ZendDbSelect in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern \w in a regular expression...

IBM Sterling Order Management Cross-Site Request Forgery Vulnerability

IBM Sterling Order Management is an order management product from IBM USA. It provides better order provisioning by centralizing reserves. A cross-site request forgery vulnerability exists in IBM Sterling Order Management. An attacker could exploit this vulnerability to perform unauthorized...

CVE-2016-5953

IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL...

CVE-2016-5953

IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL...

Code injection

IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL...

CVE-2016-5953

IBM Sterling Order Management is affected by CVE-2016-5953, where the session identifier is transmitted in the URL and exposed on error pages as Base64-encoded data. The IBM security bulletin lists affected releases in the Sterling Selling and Fulfillment Foundation family (9.1.0, 9.2.0, 9.2.1, 9...

Trump Cyber Executive Order Calls for 60-Day Review

President Donald Trump cited the hack of the Democratic National Committee as a “good example” for the need of a stronger cyber security measures for both the private and public sector. “The Democratic National Committee was hacked successfully, very successfully, and terribly successfully,” Trum...

DEBIAN-CVE-2016-7798

The openssl gem for Ruby uses the same initialization vector IV in GCM Mode aes--gcm when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism...

CVE-2016-6908

CVE-2016-6908 : In Opera for Android (version 37.0.2192.105088), mishandling of certain Unicode characters (e.g., U+FE70, U+0622, U+0623) can cause URLs to render in RTL order when combined with the first strong character (often an alphabetic character). This can enable address-bar display spoofi...

IBM Sterling Order Management Information Disclosure Vulnerability (CNVD-2017-00862)

IBM Sterling Order Management is a suite of order management software that orchestrates the cross-channel sales and order fulfillment process across a dynamic business network of customers, suppliers and partners. A remote information disclosure vulnerability exists in IBM Sterling Order...

ManagEnegine ADManager Plus 6.5.40 - Multiple Vulnerabilities

Exploit for java platform in category web applications 1. ADVISORY INFORMATION ======================================== Title: ManagEnegine ADManager Plus = 6.5.40 Multiple Vulnerabilities Application: ManagEnegine Admanager Remotely Exploitable: Yes Authentication Required: Yes Versions Affected...

White House Approves New Rules for Sharing of Raw Intelligence Data

President Obama last week approved a change in the way the National Security Agency shares raw signals intelligence data with the rest of the U.S. intelligence community, a shift that privacy experts worry will erode the civil liberties of Americans. An unclassified document released by the Offic...

Cloudflare Shares National Security Letter It Received in 2013

Thanks to the lifting of a gag order, on Tuesday security firm Cloudflare was finally able to post a National Security Letter it received from the Federal Bureau of Investigation back in 2013. Cloudflare’s counsel Kenneth R. Carter acknowledged the lifting of the order and said the letter is part...

ManagEnegine ADManager Plus 6.5.40 - Multiple Vulnerabilities

ManagEnegine ADManager Plus 6.5.40 - Multiple Vulnerabilities 1. ADVISORY INFORMATION ======================================== Title: ManagEnegine ADManager Plus = 6.5.40 Multiple Vulnerabilities Application: ManagEnegine Admanager Remotely Exploitable: Yes Authentication Required: Yes Versions...

PIMS order management system controller\buy.php has SQL injection vulnerability

PIMS is an online order management system for subscription-based websites. An SQL injection vulnerability exists in controller\buy.php of the PIMS order management system. An attacker can exploit the vulnerability to obtain sensitive database information...