Details Disclosed On Critical Flaws Affecting Nagios IT Monitoring Software

Cybersecurity researchers disclosed details about 13 vulnerabilities in the Nagios network monitoring application that could be abused by an adversary to hijack the infrastructure without any operator intervention. "In a telco setting, where a telco is monitoring thousands of sites, if a customer...

Security Bulletin: IBM Agile Lifecycle Manager is affected by an Apache Zookeeper vulnerability (CVE-2019-0201)

Summary IBM Agile Lifecycle Manager 2.1 has addressed the following vulnerability in Apache ZooKeeper. Vulnerability Details CVEID: CVE-2019-0201 DESCRIPTION: Apache ZooKeeper could allow a remote attacker to obtain sensitive information, caused by the failure to check permissions by the getACL...

5G technology predictions 2020

Kaspersky Security Bulletin 2019. Advanced threat predictions for 2020 Cybersecurity of connected healthcare 2020: Overview and predictions Corporate security prediction 2020 Cyberthreats to financial institutions 2020: Overview and predictions It is estimated that data will reach 175 zettabytes...

(RHSA-2019:1301) Low: Red Hat Enterprise Linux 7.2 E4S and TUS Support 6 month Retirement Notice

In accordance with the Red Hat Enterprise Linux Errata Support Policy, Update Services for SAP Solutions E4S and Telecommunications Update Service TUS for Red Hat Enterprise Linux 7.2 will retire as of November 30, 2019, and active support will no longer be provided. Accordingly, Red Hat will no...

Lax Telco Security Allows Mobile Phone Hijacking and Redirects

As anyone who has called into a bank or utility provider lately knows, security for customer service routines – the prescribed ways in which support reps verify the identity of customers that call in – are being continually upgraded. Two-factor authentication, voice passwords, various security...

MuddyWater APT Hones an Arsenal of Custom Tools

An array of customized attack tools are helping the MuddyWater advanced persistent threat APT group to successfully exfiltrate data from its governmental and telco targets in the Middle East; an analysis of this toolset reveals a moderately sophisticated threat actor at work – with the potential ...

I know what you did last summer, MuddyWater blending in the crowd

Introduction MuddyWater is an APT with a focus on governmental and telco targets in the Middle East Iraq, Saudi Arabia, Bahrain, Jordan, Turkey and Lebanon and also a few other countries in nearby regions Azerbaijan, Pakistan and Afghanistan. MuddyWater first surfaced in 2017 and has been active...

Do High Vanity Bitrates Choke Your Live OTT Service Out of the Gate?

Studies show that video consumption demand is growing faster than capacity. While capacity overhead does exist, current trends suggest that we'll see more bottlenecking on last-hop connectivity, especially with regionally targeted content. By pushing "vanity bitrates" -- those topmost speeds that...

(RHSA-2019:0031) Low: Red Hat Enterprise Linux 6.6 Telco Update Support Final Retirement Notice

In accordance with the Red Hat Enterprise Linux Errata Support Policy, Telco Update Service TUS for Red Hat Enterprise Linux 6.6 was retired as of December 31, 2018, and active support will no longer be provided. Accordingly, Red Hat will no longer provide updated packages, including Critical...

(RHSA-2018:3806) Low: Red Hat Enterprise Linux 6.6 Telco Update Service One-Month Notice

In accordance with the Red Hat Enterprise Linux Errata Support Policy, Telco Update Service TUS for Red Hat Enterprise Linux 6.6 will be retired as of December 31, 2018, and active support will no longer be provided. Accordingly, Red Hat will no longer provide updated packages, including Critical...

A week in security (August 20 – August 26)

Last week on Labs, we took a look at insider threats, doubled back on the privacy of search browser extensions, profiled green card scams, revisited Defcon badgelife, and talked about what happens to a user's accounts when they die. Other cybersecurity news There was an archiving error in Twitch...

CVE-2014-2191

Cross-site scripting XSS vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless aka BAC-TW allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun91113...

CVE-2014-2190

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless aka BAC-TW allows remote attackers to hijack the authentication of arbitrary users for requests that make BAC-TW changes, aka Bug IDs CSCuo23804 and CSCuo26389...

Cross site scripting

Cross-site scripting XSS vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless aka BAC-TW allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun91113...

CVE-2014-2190

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless aka BAC-TW allows remote attackers to hijack the authentication of arbitrary users for requests that make BAC-TW changes, aka Bug IDs CSCuo23804 and CSCuo26389...

CVE-2014-2190

Cisco BAC-TW’s web framework suffers a CSRF vulnerability where an unauthenticated attacker can trick an authenticated user into performing changes on the BAC-TW interface. The issue stems from insufficient CSRF protections, enabling cross-site requests that may modify BAC-TW settings. Cisco’s ad...

CVE-2014-2191

The CVE-2014-2191 entry affects Cisco’s Broadcast Access Center for Telco and Wireless (BAC-TW). It is a Cross-Site Scripting (XSS) vulnerability in the BAC-TW web framework caused by insufficient input validation of a parameter, enabling an unauthenticated, remote attacker to inject arbitrary sc...

Oracle Linux 4 : kernel (ELSA-2007-0085)

From Red Hat Security Advisory 2007:0085 : Updated kernel packages that fix two security issues and a bug in the Red Hat Enterprise Linux 4 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the...

Out-of-Band IE Patch Released as More Sites Attacked

Internet Explorer users, exposed to a zero-day vulnerability in the browser and a faulty temporary Fix It from Microsoft, finally got some relief today when the company, as promised, released an out-of-band patch. Meanwhile, a handful of new telco, manufacturing and human rights sites have been...

LivePerson Cross Site Scripting

Exploit Title: LivePerson Cross Site Scripting Date: 15.03.2012 Author: Sony Software Link: http://liveperson.com/ Google Dorks: inurl:/window/top.asp?site= or inurl:/window/main.asp?site= Web Browser : Mozilla Firefox Site : http://insecurity.ro PoC:...