CVE-2013-6180

EMC RSA Security Analytics SA 10.x before 10.3, and RSA NetWitness NextGen 9.8, does not ensure that SA Core requests originate from the SA REST UI, which allows remote attackers to bypass intended access restrictions by sending a Core request from a web browser or other unintended user agent...

CVE-2013-6180

The CVE-2013-6180 issue affects EMC RSA Security Analytics (SA) 10.x prior to 10.3 and RSA NetWitness NextGen 9.8, where SA Core does not verify that requests originate from the SA REST UI, allowing untrusted user agents (e.g., web browsers) to bypass access restrictions. This could enable core-a...

Matthew Green on How NSA Breaks SSL

In order for the National Security Agency to collect the massive amounts of communication it has from email and Web traffic, it needs to elude, leapfrog or bash through the barrier that is SSL. How it’s doing so is the real question, one that noted Johns Hopkins cryptographer Matthew Green wants...

Updated polarssl, pdns & ragel packages fix CVE-2013-5915

Updated polarssl packages fix security vulnerability: The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount ...

MGASA-2013-0353 Updated polarssl, pdns & ragel packages fix CVE-2013-5915

Updated polarssl packages fix security vulnerability: The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount ...

ruby security update

1.8.7.352-13 - Workaround build issues against OpenSSL with enabled ECC curves. - Make DRb compatible with OpenSSL 1.0.1. ruby-1.9.3-p222-generate-1024-bits-RSA-key-instead-of-512-bits.patch - Fix CVE-2013-4164 Heap Overflow in Floating Point Parsing...

EMC RSA Data Protection Manager Appliance security vulnerabilities

TLS session renegotiation vulnerability, crossite scripting...

ESA-2013-077: RSA Data Protection Manager Appliance Multiple Vulnerabilities

ESA-2013-077.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-077: RSA Data Protection Manager Appliance Multiple Vulnerabilities EMC Identifier: ESA-2013-077 CVE Identifier: CVE-2013-3288, CVE-2009-3555 Severity Rating: See below for individual scores and refer to vendor advisories for...

RSA Authentication Agent for IIS Authentication Bypass Vulnerability

RSA Authentication Agent for IIS is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2013-3288

Cross-site scripting XSS vulnerability on the EMC RSA Data Protection Manager DPM appliance 3.2.x before 3.2.4.2 and 3.5.x before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability on the EMC RSA Data Protection Manager DPM appliance 3.2.x before 3.2.4.2 and 3.5.x before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-3288

Cross-site scripting XSS vulnerability on the EMC RSA Data Protection Manager DPM appliance 3.2.x before 3.2.4.2 and 3.5.x before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-3288

RSA Data Protection Manager Appliance (3.2.x before 3.2.4.2; 3.5.x before 3.5.1) is affected by a DOM-based Cross-Site Scripting vulnerability (CVE-2013-3288). An attacker could lure an authenticated user to click a crafted URL, potentially causing execution of malicious scripts in the user’s bro...

Google upgrades SSL certificates to 2048-bit RSA

Google announced today that it has completed the upgrade of all its SSL certificates to 2048-bit RSA or better, coming in more than a month ahead of schedule. “We have completed this process which will allow the industry to start removing trust from weaker 1024-bit keys next year,” Google securit...

US-CERT Warns of More CryptoLocker Ransomware Infections

CryptoLocker is a devious evolution of now-familiar ransomware schemes in which the malware encrypts files it finds on a number of network resources and demands a ransom for the decryption key. US-CERT issued an advisory today warning businesses and consumers of the risks presented by CryptoLocke...

NIST Reviews Crypto Standards Development

The National Institute for Standards and Technology has taken an important step toward repairing what the National Security Agency has allegedly fractured by initiating a review of its cryptographic standards development processes. NIST-sponsored algorithms are at the heart of numerous crypto...

RSA Authentication Agent for Web for IIS 7.1.x < 7.1.2 Filter Bypass

The version of RSA Authentication Agent for Web for IIS is 7.1.x prior to 7.1.2. Such versions are potentially affected by an unspecified filter bypass vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70746; scriptversion"1.3"; scriptcvsdate"Date:...

RSA Authentication Agent for Web for IIS Installed

Binary data rsaauthenticationagentforwebiis.nbin...

HTTP Request Hijacking Attacks Threaten Mobile Apps

Thousands of mobile apps developed for the Apple iOS platform can be forced to display phony, even malicious content, because of a vulnerability that allows an attacker to redirect traffic to a third-party site and persistently serve content from that location. Researchers from Israeli mobile...

Cryptolocker Ransomware makes different Bitcoin wallet for each victim

When you’re online, you expose your vulnerability to malicious virus that have been growing in virulence and ferocity over the last few years. Among home PC users, you may think that you protected from malicious software by Installing an effective, trusted antivirus solution, but most if the...