Intel® Ready Mode Technology File Permissions Advisory

Summary: A potential security vulnerability in the Intel® Ready Mode Technology may allow for escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation notice for Intel® Ready Mode Technology. Vulnerability Details:...

SQL Injection Vulnerability in Frog Smile Online Business Management Software of Shenzhen Kewe Technology Co.

Frog Smile Online Business Management Software is an online management software based on cloud service model and B/S architecture for all kinds of franchised industries on the Internet platform. Shenzhen Pulse Technology Co., Ltd. Pulse - frog smile online business management software SQL injecti...

New Docker-based Dev Pipeline: Microservice Projects Just Got A ‘Speed-Boost’

A bulwark of software engineering projects, the development pipeline is an automated process used to deliver changes from development through to production; enabling near real-time updates. The dev pipeline is a critical time saver as it enables you to: Avoid mistakes and wasted time as a result...

New Boom in Facial Recognition Tech Prompts Privacy Alarms

Somewhat quietly over the past couple of years there has been a flurry of breakthroughs in biometric technology, led by some leapfrog advances in facial recognition systems. Now facial recognition appears to be on the verge of blossoming commercially, with security use-cases paving the way. Last...

Threatpost News Wrap Podcast for Nov. 9

Midterm elections aside, it has been a busy week in the infosec world. On Monday, the Pentagon suddenly started uploading malware samples from APTs and other nation-state sources to the website VirusTotal. On Wednesday, Cisco in an advisory revealed that it had “inadvertently” shipped an in-house...

Embracing the Cybersecurity ‘Grey Space’

It is just as tiring for security teams to keep saying “No” as it is for every other department to keep hearing it. To preserve some level of smooth operations in an organization, security teams need to find a way to let employees move data around while still protecting digital assets like IP and...

Carbon Black’s Susan An Named to Rev Boston’s 2018 Top 20 Women List

It is a great honor to announce that Rev Boston recently listed Susan An, Senior Director of Corporate Sales at Carbon Black, on its annual ‘Top 20 Women’ list. Susan is part of the fourth cohort of women to be acknowledged by Rev Boston, an event and award recognizing the top women in technology...

Security Bulletin: Security vulnerability has been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2018-11784)

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about a security vulnerability affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details CVEID: CVE-2018-11784 DESCRIPTION: Apache Tomcat could...

Apple Modernizes Its Hardware Security with T2

When Apple launched its latest MacBook Air last month, one of its more unusual features is that the built-in microphone automatically turns off when the lid is closed. Apple introduced the feature to eliminate any possibility of malware – or other unwanted applications – using the laptop’s...

Cisco Energy Management Suite Detection

Detection of Cisco Energy Management Suite. The script sends a connection request to the server and attempts to detect Cisco Energy Management Suite and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Midterm Elections 2018: Voting Machine Meltdowns Are Normal—That’s the Problem

Americans watched their voting technology break down right in front of their eyes—or on social media—Tuesday, but it's too soon to tell if the problems reached historic proportions...

SQL Injection Vulnerability in Qichen Technology's Website Building System

KiChen Technology Company Website Building System is an enterprise website building system developed by KiChen Technology Company. KiChen Technology's website builder system suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the...

Yi Technology Home Camera Time Sync Code Execution (CVE-2018-3892)

A remote code execution exists in the time syncing functionality of Yi Home Camera. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

SQL Injection Vulnerability in Quamicro Technologies Warehouse Management System and Customs Management System

Wuxi Quamicro Technology Co., Ltd. is a high-tech enterprise that sends enterprise management software. SQL injection vulnerability exists in the warehouse management system and customs management system of Quamicro Technology. An attacker can utilize the vulnerability to obtain sensitive...

Extreme Office suffers from a memory corruption vulnerability

Extreme Office is an independently controlled office learning software developed by Beijing Haiteng Times Technology Co. A memory corruption vulnerability exists in Extreme Office. An attacker can exploit the vulnerability to cause memory corruption, leading to code execution...

Feds accuse Chinese firm of stealing trade secrets of US tech giant

By Uzair Amir The US Justice Department has accused China to be involved in industrial espionage. According to a press release from the department, the Chinese government has made memory chips that store data its centralized science and technology strategy only to cover its espionage activities. ...

Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affect IBM Performance Management products

Summary Multiple vulnerabilities in the Oracle Java SE and the Java SE Embedded impact the IBM SDK, Java Technology Edition. Vulnerability Details CVEID: CVE-2017-3736 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a carry propagation flaw in the x86...

Anviz AIM CrossChex Standard 4.3 - CSV Injection

Anviz AIM CrossChex Standard 4.3 - CSV Injection Exploit Title: Anviz AIM CrossChex Standard 4.3 - CSV Injection Author: Gjoko 'LiquidWorm' Krstic @zeroscience Date: 2018-11-01 Vendor: Anviz Biometric Technology Co., Ltd. Product web page: https://www.anviz.com Affected version: 4.3.6.0 Tested on...

Intel (Skylake / Kaby Lake) - 'PortSmash' CPU SMT Side-Channel

Summary This is a proof-of-concept exploit of the PortSmash microarchitecture attack, tracked by CVE-2018-5407. Setup Prerequisites A CPU featuring SMT e.g. Hyper-Threading is the only requirement. This exploit code should work out of the box on Skylake and Kaby Lake. For other SMT architectures,...

CyberVets U.S.A.: The mission after transition

Christopher Marshall, a veteran of the U.S. Navy, currently serves as Director of Cybersecurity Research for Cisco Talos Intelligence Group. As a veteran of the U.S. Navy, I’ve had the opportunity to use some of the greatest technology this country has to offer — from night vision goggles, to...