The frequency and intensity of cyber-threats has increased exponentially and as IT security experts predict, they will only continue to increase. Hence, be it businesses or end users, all need to increase cyber vigilance and share threat information in order to detect and stay secured from these breaches.
The US-CERT Cyber Security Bulletin provides a summary of latest vulnerabilities that have been recorded by its research department for the week of March 02, 2015. The National Institute of Standards and Technology (NIST) has found vulnerabilities that can make a system prone to malware attacks and unauthorized access.
Common vulnerabilities and their impact recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week are:
- Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character. Find out other vulnerable versions from here: https://1.usa.gov/18mWXtB.
- The Auditing service in SAP BussinessObjects Edge 4.0 allows remote attackers to obtains sensitive information by reading an audit event, aka SAP Note 2011395. Find out other vulnerable versions from here: https://1.usa.gov/1E4WNQF.
- An unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users. Find out other vulnerable versions from here: https://1.usa.gov/1GqtaeY.
- SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php. Find out other vulnerable versions from here: https://1.usa.gov/1C4aXET.
- The IBM Notes Traveler Companion application 1.0 and 1.1 before 201411010515 for Window Phone, as distributed in IBM Notes Traveler 9.0.1, does not properly restrict the number of executions of the automatic configuration option, which makes it easier for remote attackers to capture credentials by conducting a phishing attack involving an encrypted e-mail message. Find out other vulnerable versions from here: https://1.usa.gov/1D46JPa.
- Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or the itemid parameter in the (3) wonderplugin_audio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php. Find out other vulnerable versions from here: https://1.usa.gov/1AhBFEo.
- Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) paged, or (3) s parameter in the wp-media-cleaner page to wp-admin/upload.php. Find out other vulnerable versions from here: https://1.usa.gov/1F9Yv7E.
- SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Find out other vulnerable versions from here: https://1.usa.gov/1KV0xNN.
- Open redirect vulnerability in the Services single sign-on server helper (services_sso_server_helper) module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters. Find out other vulnerable versions from here: https://1.usa.gov/1HA96Ij.
- Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the “FREAK” issue. Find out other vulnerable versions from here: https://1.usa.gov/1MsjDrJ.
- KENT-WEB Clip Board before 4.1 allows remote attackers to delete arbitrary files via unspecified vectors. Find out other vulnerable versions from here: https://1.usa.gov/1Fa0cBP.
There are many such vulnerable software ranked in the division of high, medium, and low severities. To know more about these vulnerable software and the affected versions, please read the US-CERT Cyber Security Bulletin from here: https://1.usa.gov/1MsjR26.
