Inspector General Talks Limitations of US-CERT

DHS Inspector General Richard Skinner spoke before the House Committee on Homeland Security yesterday and detailed his office’s latest report on the progress US-CERT has made in securing cyberspace and included noting limitations with enforcement, staffing and strategic planning. Read the full...

Apple Releases Security Update 2010-004 and Mac OS X v10.6.4

Apple has released Security Update 2010-004 and Mac OS X v10.6.4 to address multiple vulnerabilities that affect a number of applications. These vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, operate with elevated privileges, conduct...

Adobe Releases Flash 10.1

Adobe has released a Security Bulletin to address vulnerabilities in Adobe Flash Player 10.0.45.2 and earlier versions and in Adobe AIR 1.5.3.9130 and earlier versions. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition...

Google Releases Chrome 5.0.375.70

Google has released Chrome 5.0.375.70 for Linux, Mac, and Windows to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, conduct cross-site scripting attacks, bypass security restrictions, or obtain sensitive information. US-CERT encourages use...

Microsoft Releases June Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Internet Explorer, Office, SharePoint, and .NET Framework as part of the Microsoft Security Bulletin Summary for June 2010. These vulnerabilities may allow an attacker to execute arbitrary code or operate with elevate...

Adobe Releases Security Advisory for Flash Player, Reader, and Acrobat

Adobe has released a security advisory to notify users of a vulnerability in Adobe Flash Player, Reader, and Acrobat. Exploitation of this vulnerability may allow an attacker to execute arbitrary code and take control of the affected system. The advisory indicates that Adobe is aware of active...

Microsoft Releases Advance Notification for June Security Bulletin

Microsoft has issued a Security Bulletin Advance Notification, indicating that its June release will contain ten bulletins. Three of these bulletins will have the severity rating of critical and will be for Microsoft Windows and Internet Explorer. The remaining bulletins will have the severity...

US CERT: Rock Web Server Has XSS Vulns

The Accoria web server, also known as Rock Web Server, contains several cross-site scripting XSS and cross-site request forgery XSRF vulnerabilities. Read the full advisory. Department of Homeland Security...

Cisco Network Building Manager Vulnerabilities

Cisco has released a security advisory to address multiple vulnerabilities in Network Building Manager. The advisory indicates that the legacy Richards-Zeta Mediator products are also affected by these vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to operate with...

Google Releases Chrome 5.0.375.55

Google has released Chrome 5.0.375.55 for Linux, Mac, and Windows to address multiple vulnerabilities. These vulnerabilities may allow an attacker to bypass security restrictions, execute script in an unsafe context, or mislead users. US-CERT encourages users and administrators to review the Goog...

USR5463 802.11g Wireless Router Cross Site Scripting

alert1' document.forms0.submit...

XSS bug in US Robotics firmware USR5463-v0_06.bin

Hi! This bug was finded in the USR5463 802.11g Wireless Router. !-- Author: SH4V BUG: permanent XSS Firmware: USR5463-v001.bin - USR5463-v006.bin Router: USR5463 802.11g Wireless Router Company: US Robotics Just change http://192.168.2.1/ by your current gateway. -- form...

U.S.Robotics USR5463 0.06 Firmware - 'setup_ddns.exe' HTML Injection

source: https://www.securityfocus.com/bid/40292/info U.S.Robotics USR5463 firmware is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowin...

Apple Releases Updates for Java Mac OS X 10.5 and 10.6

Apple has released Java for Mac OS X 10.5 Update 7 and Java for Mac OS X 10.6 Update 2 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition. US-CERT encourages users and administrators to review Apple...

Default Applications

Under the Programs tab, you can specify your default applications for viewing web sites, email messages, HTML editing and various other network related tasks. You can also disable Internet Explorer from asking you if you would like it to be your default web browser here. See more information on...

International Domain Names and Embedded Sounds

Internationalized Domain Names IDN can be abused to allow spoofing of web page addresses. This can allow phishing attacks to be more convincing. To protect against IDN spoofing in Internet Explorer, enable the Always show encoded addresses option. This will cause IDN addresses to be displayed in ...

Privacy — Handling Cookies

US-CERT recommends that you select the Advanced button and select Override automatic cookie handling. Then select Prompt for both first and third-party cookies. This will prompt you each time a site tries to place a cookie on your machine. If the number of cookie prompts is too excessive, the...

Trusted Sites Zone

The Trusted sites zone is a security zone for sites that you think are safe to visit. You believe that the site is designed with security in mind and that it can be trusted not to contain malicious content. To add or remove sites from this zone, you can click the Sites button. This will open a...

How to Configure Internet Explorer to Stay Secure Online

With assistance from the United States Computer Emergency Response Team US-CERT, this slideshow will walk you through the steps to configure Microsoft’s Internet Explorer to limit the damage from hacker attacks. Keep in mind that, in some cases, these recommended settings may interfere with norma...

Cisco Releases Updates for PGW Softswitch

Cisco has released updates to address multiple vulnerabilities in Cisco PGW Softswitch. These vulnerabilities may allow an attacker to cause a denial-of-service condition. US-CERT encourages users and administrators to review Cisco security advisory cisco-sa-20100512-pgw and apply any necessary...