746 matches found
Government Report Critical of FAA Security Controls
The Federal Aviation Administration has been put on notice that its information security controls are not up to par and that a risk-based program must be implemented from the ground up in order to assure the safety of its networks and passengers in the sky. A scathing Government Accounting Office...
Apache Tomcat 7.0.x < 7.0.54 / 8.0.x < 8.0.8 XML Parser Information Disclosure
Binary data 8921.pasl...
Facebook Employees can Access your Account without Password
Do you know that your Facebook account can be accessed by Facebook engineers and that too without entering your account credentials? Recent details provided by the social network giant show who can access your Facebook account and when. No doubt, Facebook and other big tech companies including...
Facebook Creates .Onion Site; Now Accessible Via Tor Network
UPDATE – This story has been updated with commentary from the Tor Project. Facebook announced today that the social network will now be directly available to users as a Tor hidden service. The Tor Project is an Internet-traffic anonymization service that relays user traffic through a number of...
IBM AIX 5.x Diag Local Privilege Escalation Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/12041/info diag is reported prone to a local privilege escalation vulnerability. This issue is due to a failure of certain diag applications to properly implement security controls when executing an application specified ...
Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass
Document Title: =============== Mozilla Bug Bounty 5 - WireTap Remote Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=953 Mozilla Bug Tracking ID: 875818 Video: http://www.vulnerability-lab.com/getcontent.php?id=1182 Partner News...
Microsoft Sharepoint - Bypass & Persistent Vulnerability
Document Title: =============== Microsoft Sharepoint - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1024 Microsoft Security Response Center MSRC ID: 15181 Release Date: ============= 2014-01-13 Vulnerability Laborator...
IG Report Shows DHS Making Progress, But Still Has Room to Improve on Information Security
Although there are still a number of issues that need to be addressed with the Department of Homeland Security’s information security efforts, the department is improving in many areas and making strong progress toward implementing better security controls, a new report from the Inspector General...
ESA-2013-067: RSA® Authentication Agent for Web for Internet Information Services (IIS) Security Controls Bypass Vulnerability
ESA-2013-067.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-067: RSA® Authentication Agent for Web for Internet Information Services IIS Security Controls Bypass Vulnerability EMC Identifier: ESA-2013-067 CVE Identifier: CVE-2013-3280 Severity Rating: CVSS v2 Base Score: 9.0...
Adobe Acrobat Remote Code Execution Vulnerability (APSB13-25) - Windows
Adobe Acrobat is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Adobe Reader Remote Code Execution Vulnerability (APSB13-25) - Windows
Adobe Reader is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Cisco Releases Security Advisories
Cisco has released two security advisories to address multiple vulnerabilities. These vulnerabilities could allow an attacker to obtain elevation of privilege, bypass security controls, or cause a denial of service condition. US-CERT encourages users and administrators to review the following Cis...
4th Cybersecurity Framework Workshop: Good News and Bad News
I had a chance to visit a number of industrial events this year and can see the evolution of cybersecurity in the industrial field. One of these was the 4th National Institute of Standards and Technology’s NIST Cybersecurity Framework Workshop CFW. Kaspersky was in attendance at the previous...
Mozilla WebMaker - Filter Bypass & Cross Site Vulnerability
Document Title: =============== Mozilla WebMaker - Filter Bypass & Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=981 Mozilla Bug ID: 835445 Release Date: ============= 2013-07-09 Vulnerability Laboratory ID VL-ID:...
Google Adds Feature to Keep Malware Out of Chrome Web Store
Google is adding more security controls to its browser-based Chrome Web Store by adding a new application-vetting feature called ‘Enhanced Item Validation.’ For all intents and purposes, the search giant claims that the new policy will only impact application developers in that they will have to...
26 Million Veterans data breached by eight state sponsored organizations
Since 2010, foreign state sponsored organizations have repeatedly compromised an unencrypted database maintained by the Veterans Affairs Department that contains personally identifiable information on roughly 26 million veterans. Including at least eight foreign-sponsored organizations, mostly...
26 Million Veterans data breached by eight state sponsored organizations
Since 2010, foreign state sponsored organizations have repeatedly compromised an unencrypted database maintained by the Veterans Affairs Department that contains personally identifiable information on roughly 26 million veterans. Including at least eight foreign-sponsored organizations, mostly...
Apple Releases OS X 10.8.4 and Security Update 2013-002
Apple has released OS X 10.8.4 and Security Update 2013-002 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, obtain sensitive information, bypass security controls, or cause denial-of-service conditions. US-CERT encourages users and...
Google Releases Google Chrome 27.0.1453.110
Google has released Google Chrome 27.0.1453.110 for Windows, Macintosh, Linux and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow a remote attacker to cause a denial-of-service condition, bypass security controls or execute arbitrary code. US-CERT encourages user...
Microsoft flaw allows USB loaded with payload to bypass security controls
During March Patch Tuesday of 2013, Microsoft released seven new security bulletins, with four rated as critical, and others as Important. Most interesting one was MS13-027, which is rated as "important" because the attack requires physical access to the vulnerable machine. This flaw allows anyon...