Symantec Endpoint Protection Manager/Protection Center 12.x Buffer Overflow

SUMMARY A dynamic link library dll in the Symantec Endpoint Protection Manager SEPM 12.1.x server and Symantec Protection Center SPC 12.0.x Small Business Edition server does not properly validate all external input. This could potentially result in a buffer overflow and remote code execution wit...

FDA Issues Security Guidelines For Medical Device Manufacturers

Hoping to strengthen the security of medical devices, the Food and Drug Administration today issued a new series of guidelines for manufacturers. The document was released to encourage companies to mitigate viruses and malware on devices such as defibrillators, insulin pumps and pacemakers before...

[OWASP Bricks] Modular Deliberately Vulnerable Web Application

Bricks is a deliberately vulnerable web application built on PHP and MySQL. The project focuses on variations of commonly seen application security vulnerabilities and exploits. Each 'brick' has some sort of vulnerability which can be exploited using tools Mantra and ZAP. The mission is to 'break...

Symantec Messaging Gateway Management Console Stored XSS

SUMMARY Symantec's Messaging Gateway 9.5.x management console is susceptible to stored cross-site scripting XSS issues found in some of the administrative interface pages. Successful exploitation could result in potential unauthorized privileged access to the management console. AFFECTED PRODUCTS...

Osama Bin Laden-Themed Phishing

Summary The intent of this advisory is to provide general guidance to public and private sector organizations and individuals on potential targeted phishing attacks often referred to as “spear phishing” with respect to the Osama Bin Laden related media reporting, and to offer some suggested metho...

ACLU Asks FTC to Investigate Carriers on Android Security

The next shoe has fallen in an effort to force wireless carriers and handset makers to provide regular security updates to Android mobile devices. The American Civil Liberties Union filed a complaint this week with the U.S. Federal Trade Commission accusing four leading carriers of deceptive...

Oracle Releases April 2013 Security Advisory

Oracle has released its Critical Patch Update for April 2013 to address 128 vulnerabilities across multiple products. This update contains the following security fixes: 4 for Oracle Database Server 29 for Oracle Fusion Middleware 6 for Oracle E-Business Suite 3 for Oracle Supply Chain Products...

Getting Your Databases Audit Ready

Your database is perhaps one of the most sensitive targets for cybercriminals as they are your companys primary repository for confidential and proprietary data. Besides knowing what vulnerabilities exist for your perimeter network and also for your internal systems, best practices require you to...

Deduplication Appliance Best Practices

To learn about the Performance Impacts of Deduplicated Storage Systems, visit KB2660. Purpose This article provides links to vendor-provided best practices documents and vendor-specific configuration advice found in the Veeam Backup & Replication User Guide. It also offers general recommendations...

Phishers hijacking Facebook Pages using apps

Another phishing campaign come in action recently targeting Facebook accounts and company pages with millions of followers. Phishers continue to devise new fake apps for the purpose of harvesting confidential information. Not a new method, but very creative phishing example in Facebook hacking...

Phishers hijacking Facebook Pages using apps

Another phishing campaign come in action recently targeting Facebook accounts and company pages with millions of followers. Phishers continue to devise new fake apps for the purpose of harvesting confidential information. Not a new method, but very creative phishing example in Facebook hacking...

Android developer said 'F-Secure can say that anything is malware'

As the popularity of Android has boomed, more and more malware is targeting the platform. Digital miscreants are using fraudulent developer accounts on Google's Play marketplace to spread malware. According to latest Mobile Threat report from F-Secure, Android malware continued to gain in share i...

Android developer said 'F-Secure can say that anything is malware'

As the popularity of Android has boomed, more and more malware is targeting the platform. Digital miscreants are using fraudulent developer accounts on Google's Play marketplace to spread malware. According to latest Mobile Threat report from F-Secure, Android malware continued to gain in share i...

Seven-Year Facebook Study Warns of 'Silent Listeners'

Facebook users are sharing less information publicly, yet continue to share countless bits of information with what one group of researchers has dubbed “silent listeners.” The researchers, from Carnegie Mellon University, recently wrapped up the world’s first multiyear, longitudinal privacy study...

Privacy of Millions of HTC devices at risk

More than 18 million smartphones and other mobile devices made by HTC are at risk vulnerable to many security and privacy issue. The Federal Trade Commission charged HTC with customizing the software on its Android- and Windows based phones in ways that let third-party applications install softwa...

Symantec Encryption Desktop Local Access Elevation of Privilege

SUMMARY Symantec's PGP Desktop and Encryption Desktop system kernel driver is susceptible to a local access integer overflow on all versions of Microsoft Windows operating systems. The driver is also susceptible to a local buffer overflow only on Microsoft Windows XP and Windows Server 2003...

Kaiser Permanente Case Underscores Due Diligence Requirement

California and U.S. authorities are investigating whether Kaiser Permanente violated some 300,000 patients’ privacy when dealing with a Mom and Pop document storage company that kept medical records in a shared warehouse and stored sensitive data on home computers. The investigation, according to...

University of Michigan Health Systems Admits Patient Data Stolen

UPDATE – Some 4,000 University of Michigan Health Systems patients had their medical data compromised last month when a vendor’s laptop containing medication log files was stolen from a vehicle. That medication management provider, Mountain View, Calif.-based Omnicell, admits it violated both its...

FTC Launches Investigations into Mobile Apps for Kids

The Federal Trade Commission on Monday said it’s launching “non-public investigations” to determine if mobile application providers are violating federal laws by collecting information on children without their parents’ permission. A report indicates almost 60 percent 235 of the children-centric...

Malware called 'Eurograbber' steals 36 million Euros

A new version of the Zeus botnet was used to steal about $47 million from European banking customers in the past year. This Zeus variant Trojan is blamed for attacks that stole more than 36 million Euros $47 million U.S. dollars from an estimated 30,000 consumer and corporate accounts at European...