NIST Site Search
Google
Web NIST.org
NIST.gov
Product Research

Advertise on this site
Headlines

»Mac OS X ARDAgent Local Privilege Escalation
ARDAgent in Apple Mac OS X 10.5 and 10.4 allows local users to gain privileges via an osascript tell ...
»Creative Software AutoUpdate Engine ActiveX stack buffer overflow
The Creative Software AutoUpdate Engine ActiveX control is a component that provides automatic updat ...
»Internet Connection Sharing DoS
A denial of service vulnerability exists within the Internet Connection Sharing service in Microsoft ...
»RPC Memory Exhaustion
The three referenced exploits take advantage of an inherent problem in RPC, in which an attacker get ...


Date published: Thu, 28 Aug 2008 02:05:00 PST
Details

»Report: Lab certifying voting equipment failed to meet requirements
The National Voluntary Laboratory Accreditation Program has accused SysTest Labs of not meeting the ...
»Scott Vanstone | Cryptography thrown an elliptic curve
GCN Interview: One of the inventors of elliptic curve cryptography talks about ECC’s emerging r ...
»Cybereye | The threats ahead
Infrastructure networking technology figures to be the hot topic during the next year when it comes ...
»Cyber chief argues for new approaches
STRATCOM commander proposes switch to white listing, more sensors and greater training and accountab ...
»NETCOM commander weighs in on security
Brig. Gen. Susan Lawrence, speaking at the 2008 LandWarNet Conference, said that data and network se ...
»Army cyber ops faces forensic backlog
Col. Barry Hensley spoke at the 2008 LandWarNet Conference, regarding the challenge of conducting fo ...
»NIST releases draft revision of guidelines for authorizing operation IT systems
Publication is part of an interagency project to harmonize C&A process across civilian, military ...
»Layer 3 support for PDAs
Array Networks offers Layer 3 VPN support for Windows Mobile devices and other PDAs.


Date published: Tue, 26 Aug 2008 20:39:27 GMT
Details

»SSH Key-based Attacks
»Microsoft Revised Security Bulletin MS08-051
»Red Hat Releases OpenSSH Security Update
»Malware Circulating via Russia/Georgia Conflict Spam Messages
»Opera Releases Version 9.52
»Webex Meeting Manager ActiveX Control Vulnerability
»Joomla! Password Reset Vulnerability
»Apple MobileMe Phishing Scam
»Microsoft Releases August Security Bulletin
»Microsoft Releases Advanced Notification for August Security Bulletin


Date published: not known
Details

»News: Online intruders hit Red Hat, Fedora Project
Online intruders hit Red Hat, Fedora Project
»News: Researchers race to zero in record time
Researchers race to zero in record time
»News: Gov't charges alleged TJX credit-card thieves
Gov't charges alleged TJX credit-card thieves

>> Advertisement <<
Can y ...
»News: Poisoned DNS servers pop up as ISPs patch
Poisoned DNS servers pop up as ISPs patch
»Brief: Denial, hype cloud report of Best Western breach
Denial, hype cloud report of Best Western breach


Date published: not known
Details

»Timing Precision
If you’ve been watching the Olympics you might have see the pretty amazingly close call betwee ...
»MySQL Truncation Etc…
Stefan Esser has a really good article about how MySQL and SQL truncate columns which can lead to se ...
»HTML 5.0
On good authority I was told to take a good hard look at the newly proposed HTML 5.0 spec that’ ...
»MSN IP Search
I’ve been meaning to write something about this for a while now, and a number of people have k ...
»Firefox Security Model Growth
Okay, I can bet I’m going to get a lot of flack for this post, so before I start, this is only ...
»History Hack Male vs. Female and Beyond
Strangely enough there’s been a ton of things happening in the CSS history hacking world latel ...
»Private Investigator or Forensics Expert
What do I have in common with Magnum PI? What does id have in common with Dog the Bounty Hunter? W ...
»WebAppSec Survey Time Plus A Fast Approaching DefCon and Blackhat
Yup, it’s about that time again. Jeremiah has put up yet another webappsec professional surve ...
»Redirection Report
Brian Krebs had an interesting report over at the Washington Post that cited a report from Indiana.e ...
»Dialogs Of Doom
So maluc and I went down the rabbit hole (again) looking for ways to screen scrape across domains us ...


Date published: not known
Details

»Powering Down?
»'YouTubing' Training Games
»U.S. Losing E-Gov Race
»Meyerrose to Leave ODNI
»Can You Trust Your Database?
»Internet Search: When More is Less?
»Malicious Thumb Drives in Justice
»Time for a Handheld Project Post Mortem
»Hot Insider Entries
»GSA becomes first civilian agency to implement IPv6
»Speculation: Meyerrose to Leave ODNI
»Paperless government? Only sometimes.
»Army CIO predicts two years of uncertainty in IT program funding
»British hacker’s extradition to U.S. held up
»The New Dynamics of Cyber War


Date published: not known
Details

»S-371: CupsSYS Vulnerabilities
Several remote vulnerabilities have been discovered in the Common Unix Printing System (CUPS). The ...
»S-370: Afuse Vulnerability
It was discovered that afuse, an automounting file system in user-space, did not properly escape met ...
»S-369: BlackBerry Attachment Service PDF Distiller Vulnerability
The PDF Distiller service that is provided with BlackBerry Enterprise Server contains a vulnerabilit ...
»S-368: RealNetworks Vulnerabilities
RealPlayer contains a buffer overflow vulnerability that may allow an attacker to execute code on a ...
»S-367: Oracle Weblogic Apache Connector Vulnerability
An exploit has been public which may impact the availability, confidentiality or integrity of WebLog ...
»S-366: Gaim Vulnerability
It was discovered that Gaim, an multi-protocol instant messaging client, was vulnerable to several i ...
»S-365: Ruby 1.8 Vulnerabilities
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lea ...
»S-364: ClamAV Vulnerabilities
A vulnerability in the ClamAV anti-virus toolkit's parsing of Petite-packed Win32 executables. The w ...
»S-363: libexslt Vulnerability
It was discovered that a buffer overflow in the RC4 functions of libexslt may lead to the execution ...
»S-362: OpenSC
It was discovered that OpenSC, a library and utilities to handle smart cards, would initialise smart ...
»S-361: Oracle Critical Patch Update - July 2008
Oracle has released a critical patch update for multiple security vulnerabilities. The risk is MEDI ...
»CIACTech08-003: Understanding Cross-Site Scripting (XSS)
Cross-Site Scripting has become an increasingly prevalent attack vector that can be leveraged to per ...
»CIACTech08-002: Understanding Windows Hash Dumpers and Crackers
Windows hash dumping tools are often spotlighted as hacker tools that can somehow magically extract ...
»CIACTech08-001: Understanding PHP Exploits
Many websites use the PHP programming language to build web pages on the fly from individual files a ...
»CIACTech07-001: MOICE - Microsoft Office Isolated Conversion Environment
A common cyber attack is to send a user an Office document (Word, Excel, PowerPoint) containing mal ...


Date published: not known
Details
Search NIST IT Security
Search For:   Enhanced Query Form
Search In:
 
Results 1 - 8 of 8 in Content
Lotus Notes vulnerable to MS Windows graphics rendering engine bug
IBM's Lotus Notes uses the same vulnerable shimgvw.dll graphics rendering engine file implicated in the Microsoft Security Advisory 912840 to view ima...
Posted on Monday 02 January 2006 - 22:00:00 in

XSS Hall of Shame
...ains below have all been identified as having XSS vulnerabilities. They are listed here as a public service to promote a prompt resolution to the prob...
Posted on Monday 15 January 2007 - 00:00:00 in

Microsoft’s Zero Day Event
... it involves Microsoft, and like many such recent vulnerabilities the problem is with Internet Explorer Microsoft’s Zero Day Event A Zero Day ...
Posted on Sunday 04 December 2005 - 23:33:18 in

Vulnerabilities
Vulnerabilities that have long lasting IT Security affects for a large number of systems.
Posted on Friday 20 January 2006 - 22:27:21 in

NIST SP 800-40 v2 Creating a Patch and Vulnerability Management Program
Patch and vulnerability management is a security practice designed to proactively prevent the exploitation of IT vulnerabilities that exist within an ...
Posted on Saturday 21 January 2006 - 22:00:00 in

Non-Encrypted Hall of Shame
...ed is meaningless, without encryption the data is vulnerable. August 5, 2006 – Denver Business Journal Matrix Bancorp Inc. – Two laptops...
Posted on Wednesday 10 October 2007 - 19:55:58 in

NIST SP 800-48 Wireless Network Security
...acks on other networks. Specific threats and vulnerabilities to wireless networks and handheld devices include the following: *All the vuln...
Posted on Tuesday 17 January 2006 - 22:00:00 in

"Drop My Rights" - method to reduce harm while web surfing
...here, though. The past six months have seen major vulnerabilities in Firefox too, and its adoption has slowed. Some people are beginning to question t...
Posted on Sunday 04 December 2005 - 23:50:12 in

Results 1 - 1 of 1 in Links
Vulnerabiity Alerts | Secunia.com
Perhaps the best source of information on current vulnerabilities. They've also been spot on many times on their risk ratings.
http://secunia.com/advisories/

Results 1 - 10 of 146 in News
Month of PHP Bugs part 2 – Bug Opens Thousands more Servers to XSS Vulnerabilities
...info, cross, site, scripting, xss, google, inurl, vulnerabilities, http, headers, ha, ckers, org, recon, mysql, regression, Stefan, Esser@@@ To ...
Posted on Tuesday 06 March 2007 - 15:54:53

Firefox 3.0 Vulnerabilities, 2.0.x Also Vulnerable
... firewalls are likely to soon detect and stop any exploits. The Neohapsis Full-Disclosure security mailing list is reporting a separate FF3 vulne...
Posted on Saturday 21 June 2008 - 10:27:49

Highly Critical and Extremely Critical Vulnerabilities in Lotus Notes and Apple Quicktime
...me, lotus 123, extremely critical, vulnerability, vulnerabilities, viewer, worksheet, ibm, secunia, frsirt, rtsp, buffer overflow, content-type, explo...
Posted on Thursday 29 November 2007 - 04:35:47

Zero-Day MS Office Exploit in the wild, Excel files currently being used.
...y, cve, 2007, 0671, excel, code, windows, server, vulnerabilities, nist, security, bulletin, patch, sans, org, vu, 166700@@@ From the Microsoft ...
Posted on Sunday 04 February 2007 - 21:53:09

Critical Vulnerabilities in Adobe Reader and MS Word
Adobe Reader and Microsoft Word have announced critical vulnerabilities that can lead to allow execution of arbitrary executable code. // @@@micr...
Posted on Thursday 07 December 2006 - 14:48:20

Google Search Appliance Vulnerable to Cross-Site Scripting (XSS)
...ode, vulnerable, phishing, phish, ha, ckers, org, vulnerabilities, nist, box, security, gov, cuna, mutual, fda, us, cert, bulletin, patch, advisory, p...
Posted on Sunday 26 November 2006 - 20:07:29

Yet another PowerPoint 0day Exploit (9-27-06)
... office, 0day, zero, day, exploit, code, windows, vulnerabilities, nist, security, mcafee, bulletin, patch, microsoft, blog, advisory, 2000, xp, 2003,...
Posted on Thursday 28 September 2006 - 03:50:10

More OS X Vulnerabilities and Exploits
Several new Mac OS X vulnerabilities are being reported. Some have PoC exploit code available on the web. The vulnerabilities include Denial of Servi...
Posted on Saturday 22 April 2006 - 10:24:19

0day PowerPoint Exploit Released
..., point, exploit, MS, microsoft, office, windows, vulnerabilities, nist, security, bulletin, patch, advisory, excel, IDS, IPS, hacked@@@ Last mo...
Posted on Friday 14 July 2006 - 04:11:50

Cross-Site Scripting (XSS) - The Internet is Definitely a More Dangerous Place
..., scripting, exploit, code, security, javascript, vulnerabilities, vulnerable, server, exploited, reflected, hackers, forms, fix, programming, jeremia...
Posted on Monday 09 October 2006 - 15:35:01

Go to page       >>  
Results 1 - 9 of 9 in Forum
As part of thread: WMF---Still vulnerable?
The Microsoft patch for the WMF vulnerability has now been out there for more than 10 days. However, we believe that most of the vulnerable Windows ma...
Posted by Meehowski on Monday 16 January 2006 - 14:33:48

As part of thread: Microsoft's 0day "window()" Arbitrary Code Execution Vulnerability
... it involves Microsoft, and like many such recent vulnerabilities the problem is with Internet Explorer Microsoft’s Zero Day Event A Zero ...
Posted by NIST.org on Tuesday 06 December 2005 - 16:18:17

As part of thread: Adding application POA&M Vulnerabilities?
One thing I'm still trying to figure out is how we're doing our POA&M's? We're GSS and host a ton of applications, all of which have their ...
Posted by Mathurin on Tuesday 10 April 2007 - 16:39:54

As part of thread: The Twenty Most Critical Internet Security Vulnerabilities (Updated) ~ The Experts Consensus
http://www.sans.org/top20/
Posted by Meehowski on Wednesday 25 January 2006 - 13:26:58

As part of thread: Encryption Solutions - Whole Disk
... it. Besides being more work it also is much more vulnerable. Unencrypting inevitably leaves unencrypted remnants behind, either in deleted file space...
Posted by NIST.org on Monday 12 June 2006 - 20:23:32

As part of thread: WMF---Still vulnerable?
Steve Gibson at GRC.COM is reporting that he now believes that no Windows 9x computer is vulnerable to having this WMF vulnerability exploited. ...
Posted by Meehowski on Monday 23 January 2006 - 02:35:01

As part of thread: WMF---Still vulnerable?
Steve Gibson at GRC.COM is reporting that he now believes that no Windows 9x computer is vulnerable to having this WMF vulnerability exploited. ...
Posted by NIST.org on Saturday 21 January 2006 - 18:03:31

As part of thread: Microsoft's 0day "window()" Arbitrary Code Execution Vulnerability
Marco, I wish I knew. The reports I've received indicate that Lotus Notes uses the vulnerable shimgwv.dll file to get image information, but not to ...
Posted by NIST.org on Wednesday 04 January 2006 - 17:07:31

As part of thread: Microsoft's 0day "window()" Arbitrary Code Execution Vulnerability
...LN is able to show the WMF image also without the vulnerable DLL. The question is : Is Lotus Notes using the vulnerable DLL in a way that can t...
Posted by VALVAGIO on Wednesday 04 January 2006 - 11:15:03

Results 1 - 9 of 9 in Comments
Posted in reply to news item: $8,000 bounty for Vista and IE7 Vulnerabilities, plus bonuses.
...ctions are complete." But apparently there is a bidding war starting over Vista and IE7 zeroday exploits. < edited 1168991550 >
Posted by NIST.org on Tuesday 16 January 2007 - 15:57:11

Posted in reply to item: Lotus Notes vulnerable to MS Windows graphics rendering engine bug
...hich the exploit code tries to invoke. YMMV - but my 6.5.3 is not vulnerable !! Hope IBM will soon verify/deny this vulnerability!
Posted by deros68 on Thursday 05 January 2006 - 10:27:06

Posted in reply to news item: Extremely Critical New zero-day Windows vulnerability being exploited.
...gs such as canceling print jobs, etc. The current exploits are using the Escape() WMF routine but experts say other routines could also be vulnerable....
Posted by NIST.org on Monday 02 January 2006 - 16:40:15

Posted in reply to news item: RealVNC 4 Exploit Bypasses Authentication - Update: Fix Available
Having grabbed a copy of this exploit for internal testing I was amazed to see how easy it was to take complete control of the target system. If you ...
Posted by minshaw on Tuesday 23 May 2006 - 02:17:14

Posted in reply to news item: Spyware Makers Targeting Enterprises Users
...s attempted to hijack the computers of more than 70 named individuals at the UK Parliament using the recent WMF Exploit. < edited 1138256123 >
Posted by NIST.org on Wednesday 25 January 2006 - 23:14:44

Posted in reply to item: Lotus Notes vulnerable to MS Windows graphics rendering engine bug
Hi John I have performed another test. 1) I have disabled using regsvr32 the vulnerable dll %windir%system32shimgvw.dllshimgvw.dll 2) u...
Posted by VALVAGIO on Thursday 05 January 2006 - 04:15:26

Posted in reply to item: Lotus Notes vulnerable to MS Windows graphics rendering engine bug
... is able to show the WMF image also "without" the vulnerable DLL. The question is : Is Lotus Notes using the vulnerable DLL in a way that can t...
Posted by VALVAGIO on Thursday 05 January 2006 - 02:15:01

Posted in reply to news item: Extremely Critical New zero-day Windows vulnerability being exploited.
From SANS.org "The main vector that the bad guys use to exploit this is still by posting it on web sites." I've been wondering about public forum / b...
Posted by NIST.org on Wednesday 04 January 2006 - 23:06:46

Posted in reply to news item: Extremely Critical New zero-day Windows vulnerability being exploited.
It turns out that Microsoft has had a fix ready for the WMF exploit since 12/28 and has been sitting on it testing it all this time. Steve Gibson at ...
Posted by NIST.org on Wednesday 04 January 2006 - 19:22:14

Results in Other Pages
No matches found
Results in Bugtracker2
No matches found
Translate to: French German Italian Spanish Portuguese GTM_LAN_DUTCH Russian Chinese Arabic Korean English
Download Firefox

NIST.org Recommends Firefox. It's free and more secure.
Google Ads




NIST Site Menu
·Home

Current Security News
 
SANS Internet Storm Center, InfoCON: green

» Infocon: green

» Active attacks using stolen SSH keys, (Tue, Aug 26th)

» Podcast Episode X Record Notice, (Tue, Aug 26th)

» The Latest in Crimeware, (Mon, Aug 25th)

» Thoughts on the Best Western Compromise, (Mon, Aug 25th)

» Warning, it's not from us., (Sun, Aug 24th)

» SQL injections - an update, (Sat, Aug 23rd)

» RedHat compromise sparks a Critical openssh security update, (Fri, Aug 22nd)

***
Dark Reading: Dark Reading News Analysis

» Report: Popular Web Attacks Go Stealth
[27 Aug 2008 03:45pm]

» Microsoft Offers Details on Privacy Features in IE8
[27 Aug 2008 02:46pm]

» The Seven Deadliest Social Networking Hacks
[26 Aug 2008 05:40pm]

» Best Western Denies Report of Massive Data Breach
[25 Aug 2008 02:55pm]

» Life Insurer Takes New Approach to Two-Factor Authentication
[22 Aug 2008 02:32pm]

» Survey: Mid-Sized Firms Shape Up for Security
[22 Aug 2008 07:55am]

***
CNET News.com - Security

» Rising fraud threats in virtual worlds
[27 Aug 2008 05:26pm]

» Security hole opens up password protected iPhones
[27 Aug 2008 03:15pm]

» IE 8 beta gives other browsers a run for their money
[27 Aug 2008 02:33pm]

» Become a remote spy with Swann's new wireless camera
[27 Aug 2008 01:41pm]

» Space: The final frontier for computer viruses
[27 Aug 2008 12:53pm]

» Google Earth shows cows point north
[27 Aug 2008 11:02am]

» Firefox extension protects against man-in-the-middle attacks
[26 Aug 2008 05:53pm]

» Amex, Royal Bank of Scotland, NatWest customer details sold on eBay
[26 Aug 2008 11:57am]

» Ubuntu issues security patch for kernel flaw
[26 Aug 2008 10:42am]

» IE 8 to include private browsing feature
[25 Aug 2008 04:39pm]

» Data on 84,000 U.K. prisoners is lost
[25 Aug 2008 08:08am]

» Google making SSL changes, other sites quiet
[22 Aug 2008 04:41pm]

» Red Hat, Fedora servers compromised
[22 Aug 2008 12:29pm]

» Phreaker calls buddies overseas on U.S. government dime
[22 Aug 2008 10:12am]

» Brazilian charged in U.S. in connection with operating botnet
[21 Aug 2008 06:09pm]

***
Computerworld Security News

» Terror threat system crippled by technical flaws, says Congress
[27 Aug 2008 07:00am]

» Malware infects space station laptops
[27 Aug 2008 07:00am]

» The key to data security: Separation of duties
[27 Aug 2008 07:00am]

» Apple forgets to fix iPhone passcode bug
[27 Aug 2008 07:00am]

» Judge lets privacy advocate keep Social Security numbers on Web site
[27 Aug 2008 07:00am]

» Qualified Security Assessors are not created equal
[27 Aug 2008 07:00am]

» More Security News...

***


More IT Security
News Feeds
NIST - Books You Need

NIST Bookstore