PT-2013-2727

Name of the Vulnerable Software and Affected Versions EMC RSA Archer versions 5.x before 5.3SP1 Archer Smart Suite Framework versions 4.x Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which can lead to multiple cross-site scripting X...

PT-2013-2726

Name of the Vulnerable Software and Affected Versions EMC RSA Archer versions 5.x before 5.3SP1 Archer Smart Suite Framework versions 4.x Description The issue allows remote authenticated users to bypass intended access restrictions and upload arbitrary files. Recommendations For EMC RSA Archer...

CVE-2013-0933: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

EMC RSA Archer multiple security vulnerabilities

Code execution, crosite scripting, authorization bypass...

ESA-2013-015: RSA Archer® GRC Multiple Vulnerabilities

ESA-2013-015.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-015: RSA Archer® GRC Multiple Vulnerabilities EMC Identifier: ESA-2013-015 CVE Identifier: CVE-2013-0932, CVE-2013-0933, CVE-2013-0934 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected Products: RS...

Chinese Hackers targeting American Drones under Operation Beebus

FireEye experts have been tracking the Operation Beebus campaign for a few months now, and new same gang of hackers are being blamed for a set of recently discovered spear-phishing attacks that aim to steal information related to American drones. These attacks exploited previously discovered...

Online Poker Rooms Fraught With Vulnerabilities

In the lucrative world of online gambling, many poker rooms – especially those that rely on the user to download a client to play – are marred by insecurities. A recent study conducted by a pair of researchers suggests a number of online gaming companies whose poker clients rely on “skins,” aren’...

Verax NMS Hardcoded Private Key (CVE-2013-1352)

Verax NMS Hardcoded Private Key CVE-2013-1352 I. BACKGROUND ---------------------- Verax NMS provides a service-oriented, unified management & monitoring of networks, applications and infrastructure enabling quick problem detection, root-cause analysis, reporting and automating recovery, reducing...

CVE-2013-0931

EMC RSA Authentication Agent 7.1.x before 7.1.2 on Windows does not enforce the Quick PIN Unlock timeout feature, which allows physically proximate attackers to bypass the passcode requirement for a screensaved session by entering a PIN after timeout expiration...

Design/Logic Flaw

EMC RSA Authentication Agent 7.1.x before 7.1.2 on Windows does not enforce the Quick PIN Unlock timeout feature, which allows physically proximate attackers to bypass the passcode requirement for a screensaved session by entering a PIN after timeout expiration...

CVE-2013-0931

EMC RSA Authentication Agent 7.1.x before 7.1.2 on Windows does not enforce the Quick PIN Unlock timeout feature, which allows physically proximate attackers to bypass the passcode requirement for a screensaved session by entering a PIN after timeout expiration...

CVE-2013-0931

CVE-2013-0931 affects EMC RSA Authentication Agent for Windows 7.1.x prior to 7.1.2. The Quick PIN Unlock timeout is not enforced, allowing a physically proximate attacker to bypass the passcode on a screensaved session by entering a PIN after timeout. The issue is documented by multiple sources ...

CVE-2013-0931: Undefined Security Weakness

EMC RSA Authentication Agent 7.1.x before 7.1.2 on Windows does not enforce the Quick PIN Unlock timeout feature, which allows physically proximate attackers to bypass the passcode requirement for a screensaved session by entering a PIN after timeout expiration...

PT-2013-2725

Name of the Vulnerable Software and Affected Versions EMC RSA Authentication Agent version 7.1.x before 7.1.2 on Windows Description The issue allows physically proximate attackers to bypass the passcode requirement for a screensaved session by entering a PIN after timeout expiration, due to the...

RSA Authentication Agent protection bypass

In some cases only PIN is requested insted of full authentication sequence...

ESA-2013-012: RSA® Authentication Agent 7.1.1 for Microsoft Windows® Access Control Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-012: RSA® Authentication Agent 7.1.1 for Microsoft Windows® Access Control Vulnerability EMC Identifier: ESA-2013-012 CVE Identifier: CVE-2013-0931 Severity Rating: CVSS v2 Base Score: 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P Affected Products: Product...

Costin Raiu on the Intricacies of the miniDuke Malware Campaign

With Dennis Fisher out of pocket at the RSA Conference in San Francisco, Ryan Naraine hijacks the Digital Underground podcast and gets on the phone with Kaspersky Lab research guru Costin Raiu to talk about the intricacies of the miniDuke malware campaign. Download: digitalunderground113 Subscrib...

Latest Kelihos Botnet Shut Down Live at RSA Conference 2013

SAN FRANCISCO – Down goes Kelihos—again. The third version of the prolific peer-to-peer botnet responsible for volumes of pharmaceutical spam, Bitcoin wallet theft and credential harvesting was shut down before a live audience today at RSA Conference 2013. With the execution of a few commands tha...

Buffalo LinkStation Direct Request Remote File Disclosure

The web server included with the remote Buffalo LinkStation device does not properly configure access rights, which allows an unauthenticated remote attacker to gain access to sensitive files such as the device's private RSA key. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

RSA Conference 2013: Experts Say It's Time to Prepare for a 'Post-Crypto' World

SAN FRANCISCO–In the current climate of continuous attacks and intrusions by APT crews, government-sponsored groups and others organizations, cryptography is becoming less and less important and defenders need to start thinking about new ways to protect data on systems that they assume are...