Choose Your Own Infosec Adventure

I often reflect on how difficult choices in our industry can be. Do we invest more in prevention, detection or response? Do we automate or add more staff? Do we use a managed service or keep it in house? These represent some of the strategic decisions defenders are faced with on a yearly basis...

CVE-2017-6783

A vulnerability in SNMP polling for the Cisco Web Security Appliance WSA, Email Security Appliance ESA, and Content Security Management Appliance SMA could allow an authenticated, remote attacker to discover confidential information about the appliances that should be available only to an...

CVE-2017-6783

A vulnerability in SNMP polling for the Cisco Web Security Appliance WSA, Email Security Appliance ESA, and Content Security Management Appliance SMA could allow an authenticated, remote attacker to discover confidential information about the appliances that should be available only to an...

CVE-2017-6783

CVE-2017-6783 affects Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA). The root cause is that these devices do not protect confidential information at rest in SNMP poll responses, enabling an authenticated, remote attacker to dis...

Cisco Content Security Management Appliance SNMP Polling Information Disclosure Vulnerability (cisco-sa-20170816-csa)

A vulnerability in SNMP polling for the Cisco Content Security Management Appliance SMA could allow an authenticated, remote attacker to discover confidential information about the appliances that should be available only to an administrative user. SPDX-FileCopyrightText: 2017 Greenbone AG Some...

SQL Injection Vulnerability in Internet Security Management System of Qingdao Hengxin Technology Development Co.

Qingdao Hengxin Technology Development Co., Ltd. is positioned as a high-tech enterprise specializing in the research and development of computer network and information security technology products. Qingdao Hengxin Technology Development Co., Ltd. Internet security management system SQL injectio...

AlienVault Unified Security Management nfcapd Process_ipfix_template_withdraw Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault Unified Security Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within nfcapd's Processipfixtemplatewithdraw function. The issue resul...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of July 10, 2017

Before the world of laptops, tablets and smart phones, some of us had to use paper-based solutions to keep track of our calendars and to-do lists. I used a Franklin Planner, where I kept track of my calendar as well as my never-ending to-do list. The Franklin Planner used the “ABC” system to help...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Email Security Appliance ESA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an...

CVE-2017-6661

CVE-2017-6661 affects Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA). The issue is a cross-site scripting (XSS) vulnerability in the web-based management interface that allows an unauthenticated, remote attacker to execute script code in the context of ...

Cisco Email Security and Content Security Management Appliance Cross-Site Scripting Vulnerability

The Cisco Email Security Appliance is a suite of email security appliances.Cisco Content Security Management is a unified email and Web security management solution. A cross-site scripting vulnerability in the Cisco Email Security and Content Security Management Appliance allows remote attackers ...

Cisco Content Security Management Appliance Message Tracking Cross-Site Scripting Vulnerability (cisco-sa-20170607-esa)

A vulnerability in the web-based management interface of Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. SPDX-FileCopyrightText:...

What to look for when considering a WAF?

When web based applications become important components of business IP, protecting these applications is a key part of doing business. Most of IT and DevOps professionals are not thinking whether they need a Web Application Firewall WAF. Instead, they are trying to decide which WAF is right for...

Nationwide information security management system suffers from st2_045 remote command execution vulnerability

Information security management system is a set of organizations in the overall or specific scope of the establishment of information security policy and objectives, as well as the methods used to complete these objectives. The nationwide information security management system uses Apache as the...

Oracle FLEXCUBE Investor Servicing Remote Vulnerability (CNVD-2017-06277)

Oracle Financial Services Applications is Oracle's suite of financial services software for core banking, online banking and asset management. Oracle FLEXCUBE Investor Servicing is one of the components that provides life-cycle processing of cross-business hedge funds, mutual funds and unit-linke...

CVE-2017-3489

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications subcomponent: Security Management System. Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Easily "exploitable" vulnerability allows low...

AlienVault OSSIM and USM Remote Command Execution Vulnerabilities

AlienVault OSSIM and USM are both products of AlienVault Corporation, U.S.A. OSSIM is an open source security information management system. USM is a security management platform that provides security monitoring, security event management and reporting, and threat awareness system. A remote...

HelpDEZK 1.1.1 CSRF / Code Execution

Exploit Title: Multiple CSRF Remote Code Execution Vulnerability on HelpDEZK 1.1.1 Date: 05-April-2017 Exploit Author: @runggareksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy Vendor Homepage: http://www.helpdezk.org/ Software Link: https://codeload.github.com/albandes/helpdezk/zip/v1.1...

AlienVault OSSIM/USM < 5.3.6 RCE Vulnerability - Active Check

AlienVault OSSIM and USM are prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

AlienVault USM Local Command Execution Vulnerability

AlienVault Unified Security Management USM is a security management platform from AlienVault, Inc. that provides security monitoring, security event management and reporting, and threat awareness systems. An arbitrary command execution vulnerability exists in AlienVault USM, where an attacker cou...