Powered by Deep Web Technologies
Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


1

T-597: WordPress Multiple Security Vulnerabilities | Department...  

Office of Energy Efficiency and Renewable Energy (EERE) Indexed Site

7: WordPress Multiple Security Vulnerabilities T-597: WordPress Multiple Security Vulnerabilities April 7, 2011 - 5:42am Addthis PROBLEM: WordPress is prone to multiple security...

2

V-119: IBM Security AppScan Enterprise Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

9: IBM Security AppScan Enterprise Multiple Vulnerabilities 9: IBM Security AppScan Enterprise Multiple Vulnerabilities V-119: IBM Security AppScan Enterprise Multiple Vulnerabilities March 26, 2013 - 12:56am Addthis PROBLEM: IBM Security AppScan Enterprise Multiple Vulnerabilities PLATFORM: IBM Rational AppScan 5.x IBM Rational AppScan 8.x ABSTRACT: IBM has acknowledged multiple vulnerabilities REFERENCE LINKS: IBM Reference #:1626264 Secunia Advisory SA52764 CVE-2008-4033 CVE-2012-4431 CVE-2012-5081 CVE-2013-0473 CVE-2013-0474 CVE-2013-0510 CVE-2013-0511 CVE-2013-0512 CVE-2013-0513 CVE-2013-0532 IMPACT ASSESSMENT: Medium DISCUSSION: 1) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. cause a DoS when a logged-in user visits a

3

T-551: Cisco Security Advisory: Multiple Cisco WebEx Player Vulnerabilities  

Energy.gov (U.S. Department of Energy (DOE))

Multiple buffer overflow vulnerabilities exist in the WRF and ARF players. The vulnerabilities may lead to a crash of the player application or, in some cases, remote code execution could occur.

4

T-674: Drupal Secure Password Hashes Module Security Bypass Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

74: Drupal Secure Password Hashes Module Security Bypass 74: Drupal Secure Password Hashes Module Security Bypass Vulnerability T-674: Drupal Secure Password Hashes Module Security Bypass Vulnerability July 22, 2011 - 3:00pm Addthis PROBLEM: Drupal Secure Password Hashes Module Security Bypass Vulnerability PLATFORM: Drupal Secure Password Hashes 6.X-1.0 Drupal Secure Password Hashes 5.X-1.4 ABSTRACT: The Secure Password Hashes module for Drupal is prone to a security-bypass vulnerability. reference LINKS: Drupal Homepage SA-CONTRIB-2011-026 - Secure Password Hashes (phpass) - Multiple Vulnerabilities IMPACT ASSESSMENT: Medium Discussion: This module uses the PHPass hashing library to try to store users hashed passwords securely. The module sets a fixed string for the 'pass' column in the {users} database column but does not replace the pass attribute of the account

5

V-001: Mozilla Security vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Mozilla Security vulnerabilities 1: Mozilla Security vulnerabilities V-001: Mozilla Security vulnerabilities October 12, 2012 - 6:00am Addthis PROBLEM: Mozilla Security vulnerabilities PLATFORM: Vulnerabilities are reported in Firefox and Thunderbird versions prior to 16.0.1 and SeaMonkey versions prior to 2.13.1. ABSTRACT: Mozilla Firefox / Thunderbird / SeaMonkey Multiple Vulnerabilities REFERENCE LINKS: Secunia Advisory SA50932 Mozilla Security Blog Mozilla Foundation Security Advisory 2012-88 Mozilla Foundation Security Advisory 2012-89 SecurityTracker Alert ID: 1027653 SecurityTracker Alert ID: 1027652 SecurityTracker Alert ID: 1027651 CVE-2012-4190 CVE-2012-4191 CVE-2012-4192 CVE-2012-4193 IMPACT ASSESSMENT: High DISCUSSION: 1) The protected "location" object is accessible by other domain objects,

6

V-094: IBM Multiple Products Multiple Vulnerabilities | Department of  

NLE Websites -- All DOE Office Websites (Extended Search)

94: IBM Multiple Products Multiple Vulnerabilities 94: IBM Multiple Products Multiple Vulnerabilities V-094: IBM Multiple Products Multiple Vulnerabilities February 19, 2013 - 1:41am Addthis PROBLEM: IBM Multiple Products Multiple Vulnerabilities PLATFORM: IBM Maximo Asset Management versions 7.5, 7.1, and 6.2 IBM Maximo Asset Management Essentials versions 7.5, 7.1, and 6.2 IBM SmartCloud Control Desk version 7.5 IBM Tivoli Asset Management for IT versions 7.2, 7.1, and 6.2 IBM Tivoli Change and Configuration Management Database versions 7.2 and 7.1 IBM Tivoli Service Request Manager versions 7.2, 7.1, and 6.2 ABSTRACT: A weakness and multiple vulnerabilities have been reported in multiple IBM products. REFERENCE LINKS: IBM Reference #:1625624 IBM Product Security Incident Response Blog Secunia Advisory SA52132

7

The Laws of Vulnerabilities: Which security vulnerabilities really matter?  

Science Journals Connector (OSTI)

New security vulnerabilities are discovered on a daily basis. With each new announcement, the same questions arise. How significant is this vulnerability? How prevalent? How easy is it to exploit? Due to a lack of global vulnerability data, answers are ...

Gerhard Eschelbeck

2005-01-01T23:59:59.000Z

8

V-126: Mozilla Firefox Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Mozilla Firefox Multiple Vulnerabilities 6: Mozilla Firefox Multiple Vulnerabilities V-126: Mozilla Firefox Multiple Vulnerabilities April 4, 2013 - 6:00am Addthis PROBLEM: Mozilla Firefox Multiple Vulnerabilities PLATFORM: The vulnerabilities are reported in versions prior to 20.0 ABSTRACT: Multiple vulnerabilities have been reported in Mozilla Firefox, which can be exploited by malicious, local users to gain escalated privileges and by malicious people to conduct spoofing and cross-site scripting attacks and compromise a user's system. REFERENCE LINKS: Secunia Advisory SA52770 Secunia Advisory SA52293 Mozilla Security Announcement mfsa2013-30 Mozilla Security Announcement mfsa2013-31 Mozilla Security Announcement mfsa2013-32 Mozilla Security Announcement mfsa2013-34 Mozilla Security Announcement mfsa2013-35

9

U-162: Drupal Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

162: Drupal Multiple Vulnerabilities 162: Drupal Multiple Vulnerabilities U-162: Drupal Multiple Vulnerabilities May 4, 2012 - 7:00am Addthis PROBLEM: Drupal Multiple Vulnerabilities PLATFORM: The vulnerabilities are reported in 7.x versions prior to 7.13. ABSTRACT: Several vulnerabilities were reported in Drupal: Denial of Service, Access bypass, and Unvalidated form redirect reference LINKS: Security Advisory: DRUPAL-SA-CORE-2012-002 Bugtraq ID: 53359 Secunia Advisory SA49012 CVE-2012-1588 CVE-2012-1589 CVE-2012-1590 CVE-2012-1591 CVE-2012-2153 MPACT ASSESSMENT: High Discussion: A weakness, a security issue, and multiple vulnerabilities have been reported in Drupal, which can be exploited by malicious users to disclose sensitive information, bypass certain security restrictions, and cause a DoS (Denial of Service).

10

U-013: HP Data Protector Multiple Unspecified Vulnerabilities | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: HP Data Protector Multiple Unspecified Vulnerabilities 3: HP Data Protector Multiple Unspecified Vulnerabilities U-013: HP Data Protector Multiple Unspecified Vulnerabilities October 18, 2011 - 9:00am Addthis PROBLEM: HP Data Protector Multiple Unspecified Vulnerabilities. PLATFORM: HP Data Protector Notebook Extension 6.20; HP Data Protector for Personal Computers 7.0 ABSTRACT: Multiple vulnerabilities were reported in HP Data Protector. A remote user can execute arbitrary code on the target system. reference LINKS: HP Security Document ID: c03054543 SecurityTracker Alert ID: 1026195 Secunia Advisory: SA46468 CVE-2011-3156 CVE-2011-3157 CVE-2011-3158 CVE-2011-3159 CVE-2011-3160 CVE-2011-3161 CVE-2011-3162 IMPACT ASSESSMENT: High Discussion: Potential security vulnerabilities has been identified with HP Data Protector Notebook Extension. These vulnerabilities could be remotely

11

U-162: Drupal Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

62: Drupal Multiple Vulnerabilities 62: Drupal Multiple Vulnerabilities U-162: Drupal Multiple Vulnerabilities May 4, 2012 - 7:00am Addthis PROBLEM: Drupal Multiple Vulnerabilities PLATFORM: The vulnerabilities are reported in 7.x versions prior to 7.13. ABSTRACT: Several vulnerabilities were reported in Drupal: Denial of Service, Access bypass, and Unvalidated form redirect reference LINKS: Security Advisory: DRUPAL-SA-CORE-2012-002 Bugtraq ID: 53359 Secunia Advisory SA49012 CVE-2012-1588 CVE-2012-1589 CVE-2012-1590 CVE-2012-1591 CVE-2012-2153 MPACT ASSESSMENT: High Discussion: A weakness, a security issue, and multiple vulnerabilities have been reported in Drupal, which can be exploited by malicious users to disclose sensitive information, bypass certain security restrictions, and cause a DoS (Denial of Service).

12

V-131: Adobe Shockwave Player Multiple Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Adobe Shockwave Player Multiple Vulnerabilities 1: Adobe Shockwave Player Multiple Vulnerabilities V-131: Adobe Shockwave Player Multiple Vulnerabilities April 11, 2013 - 6:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Adobe Shockwave Player PLATFORM: The vulnerabilities are reported in versions 12.0.0.112 and prior ABSTRACT: This update addresses vulnerabilities that could allow an attacker to run malicious code on the affected system REFERENCE LINKS: Secunia Advisory: SA52981 Adobe Security Bulletin CVE-2013-1383 CVE-2013-1384 CVE-2013-1385 CVE-2013-1386 IMPACT ASSESSMENT: High DISCUSSION: This update resolves : 1) A buffer overflow vulnerability that could lead to code execution 2) Memory corruption vulnerabilities that could lead to code execution 3) Memory leakage vulnerability that could be exploited to reduce the

13

T-576: Oracle Solaris Adobe Flash Player Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Oracle Solaris Adobe Flash Player Multiple Vulnerabilities 6: Oracle Solaris Adobe Flash Player Multiple Vulnerabilities T-576: Oracle Solaris Adobe Flash Player Multiple Vulnerabilities March 14, 2011 - 3:05pm Addthis PROBLEM: Oracle has acknowledged multiple vulnerabilities in Adobe Flash Player included in Solaris, which can be exploited by malicious people to compromise a user's system. PLATFORM: Sun Solaris 10 ABSTRACT: Oracle Solaris Adobe Flash Player Multiple Vulnerabilities. reference LINKS: Secunia Advisory: SA43747 Oracle Sun Advisory: CVE Multiple Vulnerabilities in Adobe Flash Player Secure List: SA43747 Oracle Sun Support Adobe Flash Player for Linux and Solaris IMPACT ASSESSMENT: High Discussion: Oracle has acknowledged multiple vulnerabilities in Solaris, which can be exploited by malicious people to disclose sensitive information, bypass

14

U-104: Adobe Flash Player Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Adobe Flash Player Multiple Vulnerabilities 4: Adobe Flash Player Multiple Vulnerabilities U-104: Adobe Flash Player Multiple Vulnerabilities February 16, 2012 - 6:30am Addthis PROBLEM: Adobe Flash Player Multiple Vulnerabilities PLATFORM: Adobe Flash Player versions 11.1.102.55 and prior for Windows, Macintosh, Linux, and Solaris Adobe Flash Player versions 11.1.112.61 and prior for Android 4.x Adobe Flash Player versions 11.1.111.5 and prior for Android 3.x and prior ABSTRACT: Multiple vulnerabilities have been reported in Adobe Flash Player, which can be exploited by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, and compromise a user's system. reference LINKS: Adobe Security Bulletin Secunia Advisory 48033 IMPACT ASSESSMENT: High Discussion: Multiple vulnerabilities have been reported in Adobe Flash Player, which

15

V-050: IBM InfoSphere Information Server Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: IBM InfoSphere Information Server Multiple Vulnerabilities 0: IBM InfoSphere Information Server Multiple Vulnerabilities V-050: IBM InfoSphere Information Server Multiple Vulnerabilities December 19, 2012 - 1:00am Addthis PROBLEM: IBM InfoSphere Information Server Multiple Vulnerabilities PLATFORM: The vulnerabilities are reported in versions prior to 9.1. ABSTRACT: Multiple vulnerabilities have been reported in IBM InfoSphere Information Server REFERENCE LINKS: Secunia Advisory SA51605 IBM Support home IBM InfoSphere Information Server, Version 9.1 fix list IMPACT ASSESSMENT: Medium DISCUSSION: Multiple vulnerabilities have been reported in IBM InfoSphere Information Server, where some have an unknown impact and others can be exploited by malicious users to bypass certain security restrictions. 1) An unspecified error exists in the InfoCenter component.

16

V-050: IBM InfoSphere Information Server Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: IBM InfoSphere Information Server Multiple Vulnerabilities 0: IBM InfoSphere Information Server Multiple Vulnerabilities V-050: IBM InfoSphere Information Server Multiple Vulnerabilities December 19, 2012 - 1:00am Addthis PROBLEM: IBM InfoSphere Information Server Multiple Vulnerabilities PLATFORM: The vulnerabilities are reported in versions prior to 9.1. ABSTRACT: Multiple vulnerabilities have been reported in IBM InfoSphere Information Server REFERENCE LINKS: Secunia Advisory SA51605 IBM Support home IBM InfoSphere Information Server, Version 9.1 fix list IMPACT ASSESSMENT: Medium DISCUSSION: Multiple vulnerabilities have been reported in IBM InfoSphere Information Server, where some have an unknown impact and others can be exploited by malicious users to bypass certain security restrictions. 1) An unspecified error exists in the InfoCenter component.

17

V-022: Attachmate Reflection Products Java Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Attachmate Reflection Products Java Multiple Vulnerabilities 2: Attachmate Reflection Products Java Multiple Vulnerabilities V-022: Attachmate Reflection Products Java Multiple Vulnerabilities November 13, 2012 - 1:00am Addthis PROBLEM: Attachmate Reflection Products Java Multiple Vulnerabilities PLATFORM: Reflection X 2011 Reflection Suite for X 2011 Reflection for Secure IT Server for Windows Reflection for Secure IT Client and Server for UNIX ABSTRACT: Security issues related to Reflection PKI Services Manager REFERENCE LINKS: PKI Services Manager Technical Note 2560 Secunia Advisory SA51256 CVE-2012-0551 CVE-2012-1711 CVE-2012-1713 CVE-2012-1716 CVE-2012-1717 CVE-2012-1718 CVE-2012-1719 CVE-2012-1720 CVE-2012-1721 CVE-2012-1722 CVE-2012-1723 CVE-2012-1724 CVE-2012-1725 CVE-2012-1726 IMPACT ASSESSMENT: High DISCUSSION: Attachmate has acknowledged multiple vulnerabilities in some Reflection

18

V-096: Mozilla Thunderbird / SeaMonkey Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Mozilla Thunderbird / SeaMonkey Multiple Vulnerabilities 6: Mozilla Thunderbird / SeaMonkey Multiple Vulnerabilities V-096: Mozilla Thunderbird / SeaMonkey Multiple Vulnerabilities February 21, 2013 - 6:00am Addthis PROBLEM: A weakness and multiple vulnerabilities have been reported in Mozilla Thunderbird and SeaMonkey PLATFORM: The vulnerabilities are reported in Thunderbird versions prior to 17.0.3 and SeaMonkey versions prior to 2.16. ABSTRACT: A weakness and multiple vulnerabilities have been reported in Mozilla Thunderbird and SeaMonkey, which can be exploited by malicious people to disclose potentially sensitive information, conduct spoofing attacks, bypass certain security restrictions, and compromise a user's system. REFERENCE LINKS: Secunia Advisory SA52280 Mozilla Security Advisory 2013-21 CVE-2013-0765 CVE-2013-0772

19

V-096: Mozilla Thunderbird / SeaMonkey Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Mozilla Thunderbird / SeaMonkey Multiple Vulnerabilities 6: Mozilla Thunderbird / SeaMonkey Multiple Vulnerabilities V-096: Mozilla Thunderbird / SeaMonkey Multiple Vulnerabilities February 21, 2013 - 6:00am Addthis PROBLEM: A weakness and multiple vulnerabilities have been reported in Mozilla Thunderbird and SeaMonkey PLATFORM: The vulnerabilities are reported in Thunderbird versions prior to 17.0.3 and SeaMonkey versions prior to 2.16. ABSTRACT: A weakness and multiple vulnerabilities have been reported in Mozilla Thunderbird and SeaMonkey, which can be exploited by malicious people to disclose potentially sensitive information, conduct spoofing attacks, bypass certain security restrictions, and compromise a user's system. REFERENCE LINKS: Secunia Advisory SA52280 Mozilla Security Advisory 2013-21 CVE-2013-0765 CVE-2013-0772

20

V-121: Google Chrome Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Google Chrome Multiple Vulnerabilities 1: Google Chrome Multiple Vulnerabilities V-121: Google Chrome Multiple Vulnerabilities March 28, 2013 - 12:29am Addthis PROBLEM: Google Chrome Multiple Vulnerabilities PLATFORM: versions prior to 26.0.1410.43. ABSTRACT: Multiple vulnerabilities have been reported in Google Chrome REFERENCE LINKS: Secunia Advisory SA52761 CVE-2013-0916 CVE-2013-0917 CVE-2013-0918 CVE-2013-0919 CVE-2013-0920 CVE-2013-0921 CVE-2013-0922 CVE-2013-0923 CVE-2013-0924 CVE-2013-0925 CVE-2013-0926 IMPACT ASSESSMENT: High DISCUSSION: Multiple vulnerabilities have been reported in Google Chrome, where one has an unknown impact and others can be exploited by malicious people to bypass certain security restrictions and compromise a user's system. IMPACT: 1) A use-after-free error exists in Web Audio.

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


21

T-540: Sybase EAServer Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

40: Sybase EAServer Multiple Vulnerabilities 40: Sybase EAServer Multiple Vulnerabilities T-540: Sybase EAServer Multiple Vulnerabilities January 24, 2011 - 6:16am Addthis PROBLEM: Sybase EAServer Multiple Vulnerabilities PLATFORM: Sybase EAServer versions 6.3 and prior ABSTRACT: Sybase EAServer is prone to a security-bypass vulnerability and a directory-traversal vulnerability. Attackers may exploit these issues to execute arbitrary code within the context of the application or to disclose sensitive information. Sybase EAServer versions 6.3 and prior are affected. reference LINKS: Bugtraq ID: 45809 SyBase Advisory IMPACT ASSESSMENT: Medium Discussion: Remote exploitation of a design vulnerability in Sybase EAServer could allow an attacker to install arbitrary web services, this condition can result in arbitrary code execution allowing attacker to gain control over

22

U-100: Google Chrome Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Google Chrome Multiple Vulnerabilities 0: Google Chrome Multiple Vulnerabilities U-100: Google Chrome Multiple Vulnerabilities February 10, 2012 - 7:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Google Chrome, where some have an unknown impact and others can be exploited by malicious people to bypass certain security restrictions, manipulate certain data, and compromise a user's system. PLATFORM: Google Chrome 16.x ABSTRACT: A remote user can create a specially crafted content that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user. Reference LINKS: Google Announcements and Release Channel Secunia Advisory SA47938 Security Tracker ID 1026654 IMPACT ASSESSMENT: High Discussion: Multiple vulnerabilities have been reported in Google Chrome, where some

23

V-097: Google Chrome Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Google Chrome Multiple Vulnerabilities 7: Google Chrome Multiple Vulnerabilities V-097: Google Chrome Multiple Vulnerabilities February 22, 2013 - 6:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Google Chrome PLATFORM: The vulnerabilities are reported in versions prior to Google Chrome 24.x ABSTRACT: Multiple vulnerabilities have been reported in Google Chrome, where some have an unknown impact and others can be exploited by malicious people to bypass certain security restrictions and compromise a user's system. REFERENCE LINKS: Secunia Advisory SA52320 Chrome Stable Channel Update CVE-2013-0879 CVE-2013-0880 CVE-2013-0881 CVE-2013-0882 CVE-2013-0883 CVE-2013-0884 CVE-2013-0885 CVE-2013-0886 CVE-2013-0887 CVE-2013-0888 CVE-2013-0889 CVE-2013-0890 CVE-2013-0891 CVE-2013-0892 CVE-2013-0893

24

Common Cyber Security Vulnerabilities Observed in Control System...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Common Cyber Security Vulnerabilities Observed in Control System Assessments by the INL NSTB Program Common Cyber Security Vulnerabilities Observed in Control System Assessments by...

25

U-191: Oracle Java Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

91: Oracle Java Multiple Vulnerabilities 91: Oracle Java Multiple Vulnerabilities U-191: Oracle Java Multiple Vulnerabilities June 14, 2012 - 7:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Oracle Java, which can be exploited by malicious local users PLATFORM: Oracle Java JDK 1.7.x / 7.x Oracle Java JRE 1.7.x / 7.x Sun Java JDK 1.5.x Sun Java JDK 1.6.x / 6.x Sun Java JRE 1.4.x Sun Java JRE 1.5.x / 5.x Sun Java JRE 1.6.x / 6.x Sun Java SDK 1.4.x ABSTRACT: The Critical Patch Update for Java SE also includes non-security fixes. Critical Patch Updates are cumulative and each advisory describes only the security fixes added since the previous Critical Patch Update. Thus, prior Critical Patch Update Advisories should be reviewed for information regarding earlier accumulated security fixes.

26

U-198: IBM Lotus Expeditor Multiple Vulnerabilities  

Energy.gov (U.S. Department of Energy (DOE))

The vulnerabilities can be exploited by malicious people to conduct cross-site scripting attacks, disclose potentially sensitive information, bypass certain security restrictions, and compromise a user's system..

27

V-180: IBM Application Manager For Smart Business Multiple Vulnerabilities  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

V-180: IBM Application Manager For Smart Business Multiple V-180: IBM Application Manager For Smart Business Multiple Vulnerabilities V-180: IBM Application Manager For Smart Business Multiple Vulnerabilities June 18, 2013 - 12:38am Addthis PROBLEM: IBM Application Manager For Smart Business Multiple Vulnerabilities PLATFORM: IBM Application Manager For Smart Business 1.x ABSTRACT: A security issue and multiple vulnerabilities have been reported in IBM Application Manager For Smart Business REFERENCE LINKS: Security Bulletin 1640752 Secunia Advisory SA53844 CVE-2012-1531 CVE-2012-1532 CVE-2012-1533 CVE-2012-2190 CVE-2012-2191 CVE-2012-2203 CVE-2012-3143 CVE-2012-3159 CVE-2012-3216 CVE-2012-4820 CVE-2012-4821 CVE-2012-4822 CVE-2012-4823 CVE-2012-5068 CVE-2012-5069 CVE-2012-5071 CVE-2012-5072 CVE-2012-5073 CVE-2012-5075 CVE-2012-5079

28

U-002:Adobe Photoshop Elements Multiple Memory Corruption Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

02:Adobe Photoshop Elements Multiple Memory Corruption 02:Adobe Photoshop Elements Multiple Memory Corruption Vulnerabilities U-002:Adobe Photoshop Elements Multiple Memory Corruption Vulnerabilities October 4, 2011 - 11:00am Addthis PROBLEM: Adobe Photoshop Elements Multiple Memory Corruption Vulnerabilities. PLATFORM: Adobe Photoshop Elements 8.0 and earlier versions for Windows. ABSTRACT: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system. reference LINKS: Adobe Advisory: APSA11-03 SecurityTracker Alert ID: 1026132 SecurityFocus: CVE-2011-2443 IMPACT ASSESSMENT: High Discussion: A vulnerability was reported in Adobe Photoshop Elements. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can create a specially crafted '.grd' or '.abr' file that,

29

V-187: Mozilla Firefox Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Mozilla Firefox Multiple Vulnerabilities 7: Mozilla Firefox Multiple Vulnerabilities V-187: Mozilla Firefox Multiple Vulnerabilities June 27, 2013 - 6:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Mozilla Firefox PLATFORM: Mozilla Firefox 21.x ABSTRACT: These vulnerabilities can be exploited by malicious people to conduct cross-site scripting and spoofing attacks, disclose potentially sensitive information, bypass certain security restrictions, and compromise a user's system. REFERENCE LINKS: Secunia Advisory SA53970 Secunia Advisory SA53953 Mozilla Advisory mfsa2013-49 Mozilla Advisory mfsa2013-50 Mozilla Advisory mfsa2013-51 Mozilla Advisory mfsa2013-53 Mozilla Advisory mfsa2013-55 Mozilla Advisory mfsa2013-56 Mozilla Advisory mfsa2013-59 CVE-2013-1682 CVE-2013-1683 CVE-2013-1684 CVE-2013-1685

30

U-173: Symantec Web Gateway Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Symantec Web Gateway Multiple Vulnerabilities 3: Symantec Web Gateway Multiple Vulnerabilities U-173: Symantec Web Gateway Multiple Vulnerabilities May 21, 2012 - 7:00am Addthis PROBLEM: Symantec Web Gateway Multiple Vulnerabilities PLATFORM: 5.0.x prior to 5.0.3 ABSTRACT: Several vulnerabilities were reported in Symantec Web Gateway. A remote user can include and execute arbitrary code on the target system. A remote user can conduct cross-site scripting attacks. A remote user can view/delete/upload files on the target system. Reference Links: SecurityTracker Alert ID: 1027078 CVE-2012-0296 CVE-2012-0297 CVE-2012-0298 CVE-2012-0299 IMPACT ASSESSMENT: Medium Discussion: The management interface does not properly authenticate remote users and does not properly validate user-supplied input. A remote user can cause arbitrary scripting code to be executed by the

31

V-083: Oracle Java Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Oracle Java Multiple Vulnerabilities 3: Oracle Java Multiple Vulnerabilities V-083: Oracle Java Multiple Vulnerabilities February 4, 2013 - 12:42am Addthis PROBLEM: Oracle Java Multiple Vulnerabilities PLATFORM: Oracle Java JDK 1.5.x / 5.x Oracle Java JDK 1.7.x / 7.x Oracle Java JRE 1.7.x / 7.x Oracle Java SDK 1.4.x / 4.x Sun Java JDK 1.4.x Sun Java JDK 1.6.x / 6.x Sun Java JRE 1.4.x / 4.x Sun Java JRE 1.5.x / 5.x Sun Java JRE 1.6.x / 6.x ABSTRACT: A Critical Patch Update is a collection of patches for multiple security vulnerabilities. The Critical Patch Update for Java SE also includes non-security fixes. Critical Patch Updates are cumulative and each advisory describes only the security fixes added since the previous Critical Patch Update and Security Alert. REFERENCE LINKS: Oracle Security Advisory February 2013

32

V-083: Oracle Java Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Oracle Java Multiple Vulnerabilities 3: Oracle Java Multiple Vulnerabilities V-083: Oracle Java Multiple Vulnerabilities February 4, 2013 - 12:42am Addthis PROBLEM: Oracle Java Multiple Vulnerabilities PLATFORM: Oracle Java JDK 1.5.x / 5.x Oracle Java JDK 1.7.x / 7.x Oracle Java JRE 1.7.x / 7.x Oracle Java SDK 1.4.x / 4.x Sun Java JDK 1.4.x Sun Java JDK 1.6.x / 6.x Sun Java JRE 1.4.x / 4.x Sun Java JRE 1.5.x / 5.x Sun Java JRE 1.6.x / 6.x ABSTRACT: A Critical Patch Update is a collection of patches for multiple security vulnerabilities. The Critical Patch Update for Java SE also includes non-security fixes. Critical Patch Updates are cumulative and each advisory describes only the security fixes added since the previous Critical Patch Update and Security Alert. REFERENCE LINKS: Oracle Security Advisory February 2013

33

V-161: IBM Maximo Asset Management Products Java Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

61: IBM Maximo Asset Management Products Java Multiple 61: IBM Maximo Asset Management Products Java Multiple Vulnerabilities V-161: IBM Maximo Asset Management Products Java Multiple Vulnerabilities May 22, 2013 - 12:46am Addthis PROBLEM: IBM Maximo Asset Management Products Java Multiple Vulnerabilities PLATFORM: IBM Maximo Asset Management 6.x IBM Maximo Asset Management 7.x IBM Maximo Asset Management Essentials 7.x ABSTRACT: Asset and Service Mgmt Products - Potential security exposure when using JavaTM based applications due to vulnerabilities in Java Software Developer Kits. REFERENCE LINKS: IBM Reference #:1638135 Secunia Advisory SA53451 CVE-2013-0401 CVE-2013-2433 CVE-2013-2434 CVE-2013-0402 CVE-2013-1488 CVE-2013-1491 CVE-2013-1518 CVE-2013-1537 CVE-2013-1540 CVE-2013-1557 CVE-2013-1558 CVE-2013-1561 CVE-2013-1563 CVE-2013-1564 CVE-2013-1569

34

V-161: IBM Maximo Asset Management Products Java Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: IBM Maximo Asset Management Products Java Multiple 1: IBM Maximo Asset Management Products Java Multiple Vulnerabilities V-161: IBM Maximo Asset Management Products Java Multiple Vulnerabilities May 22, 2013 - 12:46am Addthis PROBLEM: IBM Maximo Asset Management Products Java Multiple Vulnerabilities PLATFORM: IBM Maximo Asset Management 6.x IBM Maximo Asset Management 7.x IBM Maximo Asset Management Essentials 7.x ABSTRACT: Asset and Service Mgmt Products - Potential security exposure when using JavaTM based applications due to vulnerabilities in Java Software Developer Kits. REFERENCE LINKS: IBM Reference #:1638135 Secunia Advisory SA53451 CVE-2013-0401 CVE-2013-2433 CVE-2013-2434 CVE-2013-0402 CVE-2013-1488 CVE-2013-1491 CVE-2013-1518 CVE-2013-1537 CVE-2013-1540 CVE-2013-1557 CVE-2013-1558 CVE-2013-1561 CVE-2013-1563 CVE-2013-1564 CVE-2013-1569

35

U-187: Adobe Flash Player Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Adobe Flash Player Multiple Vulnerabilities 7: Adobe Flash Player Multiple Vulnerabilities U-187: Adobe Flash Player Multiple Vulnerabilities June 11, 2012 - 7:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Adobe Flash Player PLATFORM: Adobe Flash Player 11.2.202.235 and earlier for Windows, Macintosh and Linux Adobe Flash Player 11.1.115.8 and earlier for Android 4.x Adobe Flash Player 11.1.111.9 and earlier for Android 3.x and 2.x Adobe AIR 3.2.0.2070 and earlier for Windows, Macintosh and Android ABSTRACT: Adobe released security updates for Adobe Flash Player 11.2.202.235 and earlier versions for Windows, Macintosh and Linux, Adobe Flash Player 11.1.115.8 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.9 and earlier versions for Android 3.x and 2.x. These updates

36

T-566: Citrix Secure Gateway Unspecified Vulnerability | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Citrix Secure Gateway Unspecified Vulnerability 6: Citrix Secure Gateway Unspecified Vulnerability T-566: Citrix Secure Gateway Unspecified Vulnerability February 28, 2011 - 11:22pm Addthis PROBLEM: Citrix Secure Gateway Unspecified Vulnerability. PLATFORM: Citrix Secure Gateway version 3.1.4 ABSTRACT: A vulnerability has been reported in Citrix Secure Gateway, which can be exploited by malicious people to compromise a vulnerable system. reference LINKS: Citrix ID:CTX128168 Secunia Advisory SA43497 Citrix Support IMPACT ASSESSMENT: High Discussion: This vulnerability only affects Secure Gateway version 3.1.4. Secure Gateway version 3.2.0 is not affected by this vulnerability, but Citrix recommends that customers currently using this version upgrade their deployments to version 3.2.1 in line with the guidance provided in

37

T-551: Cisco Security Advisory: Multiple Cisco WebEx Player Vulnerabil...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

51: Cisco Security Advisory: Multiple Cisco WebEx Player Vulnerabilities T-551: Cisco Security Advisory: Multiple Cisco WebEx Player Vulnerabilities February 7, 2011 - 7:56am...

38

T-629: Avaya WinPDM Multiple Buffer Overflow Vulnerabilities | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

9: Avaya WinPDM Multiple Buffer Overflow Vulnerabilities 9: Avaya WinPDM Multiple Buffer Overflow Vulnerabilities T-629: Avaya WinPDM Multiple Buffer Overflow Vulnerabilities May 24, 2011 - 3:35pm Addthis PROBLEM: Avaya WinPDM Multiple Buffer Overflow Vulnerabilities. PLATFORM: Avaya versions prior to 3.8.5 (confirmed in 3.8.2) ABSTRACT: Vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user. refrence LINKS: Avaya Security Advisory: ASA-2011-143 Secunia Advisory: SA44062 Securelist ID: SA44062 Vulnerability Report: Avaya WinPDM 3.x IMPACT ASSESSMENT: High Discussion: Multiple vulnerabilities in Avaya WinPDM, which can be exploited by malicious people to compromise a vulnerable system. 1) A boundary error in the Unite Host Router service (UniteHostRouter.exe)

39

T-629: Avaya WinPDM Multiple Buffer Overflow Vulnerabilities | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

29: Avaya WinPDM Multiple Buffer Overflow Vulnerabilities 29: Avaya WinPDM Multiple Buffer Overflow Vulnerabilities T-629: Avaya WinPDM Multiple Buffer Overflow Vulnerabilities May 24, 2011 - 3:35pm Addthis PROBLEM: Avaya WinPDM Multiple Buffer Overflow Vulnerabilities. PLATFORM: Avaya versions prior to 3.8.5 (confirmed in 3.8.2) ABSTRACT: Vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user. refrence LINKS: Avaya Security Advisory: ASA-2011-143 Secunia Advisory: SA44062 Securelist ID: SA44062 Vulnerability Report: Avaya WinPDM 3.x IMPACT ASSESSMENT: High Discussion: Multiple vulnerabilities in Avaya WinPDM, which can be exploited by malicious people to compromise a vulnerable system. 1) A boundary error in the Unite Host Router service (UniteHostRouter.exe)

40

Mitigations for Security Vulnerabilities Found in Control System Networks |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Mitigations for Security Vulnerabilities Found in Control System Mitigations for Security Vulnerabilities Found in Control System Networks Mitigations for Security Vulnerabilities Found in Control System Networks Industry is aware of the need for Control System (CS) security, but in on-site assessments, Idaho National Laboratory (INL) has observed that security procedures and devices are not consistently and effectively implemented. The Department of Homeland Security (DHS), National Cyber Security Division (NCSD), established the Control Systems Security Center (CSSC) at INL to help industry and government improve the security of the CSs used in the nation's critical infrastructures. One of the main CSSC objectives is to identify control system vulnerabilities and develop effective mitigations for them. This paper discusses common problems and vulnerabilities seen in

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


41

V-005: ModSecurity Multipart Message Parsing Security Bypass Vulnerability  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: ModSecurity Multipart Message Parsing Security Bypass 5: ModSecurity Multipart Message Parsing Security Bypass Vulnerability V-005: ModSecurity Multipart Message Parsing Security Bypass Vulnerability October 18, 2012 - 6:00am Addthis PROBLEM: ModSecurity Multipart Message Parsing Security Bypass Vulnerability PLATFORM: Modsecurity Versions prior to 2.70 ABSTRACT: SEC Consult has reported a vulnerability in ModSecurity, which can be exploited by malicious people to bypass certain security restrictions REFERENCE LINKS: SEC Consult Secunia Advisory SA49853 IMPACT ASSESSMENT: Medium DISCUSSION: The vulnerability is caused due to an error when parsing multipart requests and can be exploited to bypass certain filtering rules. IMPACT: Remote Security Bypass SOLUTION: Update to version 2.70. Addthis Related Articles V-017: Apache Tomcat Security Bypass and Denial of Service Vulnerabilities

42

V-106: Citrix Access Gateway Unspecified Security Bypass Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Citrix Access Gateway Unspecified Security Bypass 6: Citrix Access Gateway Unspecified Security Bypass Vulnerability V-106: Citrix Access Gateway Unspecified Security Bypass Vulnerability March 7, 2013 - 6:00am Addthis PROBLEM: A vulnerability has been reported in Citrix Access Gateway PLATFORM: Standard Edition 5.0.x prior to 5.0.4.223524. Versions 4.5.x and 4.6.x are not affected by this vulnerability ABSTRACT: A vulnerability has been reported in Citrix Access Gateway, which can be exploited by malicious people to bypass certain security restrictions. REFERENCE LINKS: Secunia Advisory SA52479 Security Tracker Alert ID 1028255 com/id/1028255 CVE-2013-2263 Citrix Knowledge Center IMPACT ASSESSMENT: High DISCUSSION: The vulnerability could allow an unauthenticated user to gain access to network resources. IMPACT:

43

V-041: Red Hat CloudForms Multiple Vulnerabilities | Department...  

Energy Savers (EERE)

V-041: Red Hat CloudForms Multiple Vulnerabilities V-041: Red Hat CloudForms Multiple Vulnerabilities December 6, 2012 - 4:01am Addthis PROBLEM: Red Hat CloudForms Multiple...

44

U-224: ISC DHCP Multiple Denial of Service Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: ISC DHCP Multiple Denial of Service Vulnerabilities 4: ISC DHCP Multiple Denial of Service Vulnerabilities U-224: ISC DHCP Multiple Denial of Service Vulnerabilities July 31, 2012 - 7:00am Addthis PROBLEM: ISC DHCP Multiple Denial of Service Vulnerabilities PLATFORM: ISC DHCP before versions DHCP 4.1-ESV-R6 or DHCP 4.2.4-P1 ABSTRACT: ISC DHCP is prone to multiple denial-of-service vulnerabilities. reference LINKS: BIND and DHCP Security Updates Released Bugtraq ID: 54665 Secunia Advisory SA50018 CVE-2012-3571 CVE-2012-3570 CVE-2012-3954 IMPACT ASSESSMENT: Medium Discussion: Multiple vulnerabilities have been reported in ISC DHCP, which can be exploited by malicious people to cause a DoS (Denial of Service). 1) An error when handling client identifiers can be exploited to trigger an endless loop and prevent the server from processing further client requests

45

U-022: Apple QuickTime Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Apple QuickTime Multiple Vulnerabilities 2: Apple QuickTime Multiple Vulnerabilities U-022: Apple QuickTime Multiple Vulnerabilities October 28, 2011 - 8:15am Addthis PROBLEM: Apple QuickTime Multiple Vulnerabilities. PLATFORM: Apple QuickTime prior to 7.7.1 ABSTRACT: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system. reference LINKS: Apple Product Security Article: HT5016 Secunia Advisory SA46618 SecurityTracker Alert ID: 1026251 CVE-2011-3218, CVE-2011-3219, CVE-2011-3220 CVE-2011-3221, CVE-2011-3222, CVE-2011-3223 CVE-2011-3228, CVE-2011-3247, CVE-2011-3248 CVE-2011-3249, CVE-2011-3250, CVE-2011-3251 IMPACT ASSESSMENT: High Discussion: Multiple vulnerabilities have been reported in Apple Quicktime, which can be exploited by malicious people to compromise a user's system.

46

U-197: Cisco Adaptive Security Appliances Denial of Service Vulnerability |  

NLE Websites -- All DOE Office Websites (Extended Search)

97: Cisco Adaptive Security Appliances Denial of Service 97: Cisco Adaptive Security Appliances Denial of Service Vulnerability U-197: Cisco Adaptive Security Appliances Denial of Service Vulnerability June 22, 2012 - 7:00am Addthis PROBLEM: A vulnerability has been reported in Cisco Adaptive Security Appliances (ASA), which can be exploited by malicious people to cause a DoS (Denial of Service). PLATFORM: Cisco Adaptive Security Appliance (ASA) 8.x Cisco ASA 5500 Series Adaptive Security Appliances ABSTRACT: The vulnerability is caused due to an unspecified error when handling IPv6 transit traffic and can be exploited to cause a reload of the affected device. reference LINKS: Vendor Advisory Secunia ID 49647 CVE-2012-3058 IMPACT ASSESSMENT: High Discussion: Cisco ASA 5500 Series Adaptive Security Appliances (Cisco ASA) and Cisco

47

V-211: IBM iNotes Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

211: IBM iNotes Multiple Vulnerabilities 211: IBM iNotes Multiple Vulnerabilities V-211: IBM iNotes Multiple Vulnerabilities August 5, 2013 - 6:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in IBM Lotus iNotes PLATFORM: IBM iNotes 9.x ABSTRACT: IBM iNotes has two cross-site scripting vulnerabilities and an ActiveX Integer overflow vulnerability REFERENCE LINKS: Secunia Advisory SA54436 IBM Security Bulletin 1645503 CVE-2013-3027 CVE-2013-3032 CVE-2013-3990 IMPACT ASSESSMENT: High DISCUSSION: 1) Certain input related to MIME mail is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 2) An integer overflow error within the DWA9W ActiveX control can be exploited to execute arbitrary code.

48

The Journal of Physical Security - Vulnerability Assessment Team - Argonne  

NLE Websites -- All DOE Office Websites (Extended Search)

Current Projects > The Journal of Physical Current Projects > The Journal of Physical Security VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms

49

Cyber Security Vulnerability Impact on I&C Reliability  

SciTech Connect

We present a discussion of the cyber security vulnerability impact on instrument and control reliability. In the discussion we demonstrate the likely vector of attack and vulnerabilities associated with commodity hardware, protocols and communication media. The current fleet of nuclear power plants in the United States utilizes aging analog instrument and control systems which are more frequently suffering from obsolescence and failure. The commodity equipment available now and in the near future incorporates features from information technology systems which compound cyber vulnerabilities.

Hadley, Mark D.; McBride, Justin B.

2006-11-01T23:59:59.000Z

50

V-237: TYPO3 Security Bypass Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

V-237: TYPO3 Security Bypass Vulnerabilities V-237: TYPO3 Security Bypass Vulnerabilities V-237: TYPO3 Security Bypass Vulnerabilities September 9, 2013 - 6:00am Addthis PROBLEM: Some vulnerabilities have been reported in TYPO3 PLATFORM: TYPO3 6.x ABSTRACT: TYPO3 comes with the possibility to restrict editors to certain file actions (copy, delete, move etc.) and to restrict these actions to be performed in certain locations REFERENCE LINKS: Secunia Advisory SA54717 Security Focus ID 62257 IMPACT ASSESSMENT: Medium DISCUSSION: 1) Some errors when handling file actions can be exploited to bypass file action permission restrictions and e.g. create or read arbitrary files within or outside the webroot. 2) An error when validating file names within the file renaming functionality can be exploited to bypass the denied file extensions check

51

V-191: Apple Mac OS X Multiple Vulnerabilities | Department of Energy  

NLE Websites -- All DOE Office Websites (Extended Search)

1: Apple Mac OS X Multiple Vulnerabilities 1: Apple Mac OS X Multiple Vulnerabilities V-191: Apple Mac OS X Multiple Vulnerabilities July 3, 2013 - 6:00am Addthis PROBLEM: Apple has issued a security update for Mac OS X PLATFORM: Apple Macintosh OS X ABSTRACT: The vulnerabilities are caused due to a bundled version of QuickTime REFERENCE LINKS: Secunia Advisory SA54049 APPLE-SA-2013-07-02-1 Security Update 2013-003 CVE-2013-1018 CVE-2013-1019 CVE-2013-1022 IMPACT ASSESSMENT: High DISCUSSION: A boundary error when parsing compressed data within H.264 encoded movie files can be exploited to cause a buffer overflow A boundary error when handling the Sorenson Video 3 "mdat" section within a MOV file can be exploited to cause a buffer overflow A boundary error when handling "mvhd" atoms can be exploited to cause a

52

V-191: Apple Mac OS X Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Apple Mac OS X Multiple Vulnerabilities 1: Apple Mac OS X Multiple Vulnerabilities V-191: Apple Mac OS X Multiple Vulnerabilities July 3, 2013 - 6:00am Addthis PROBLEM: Apple has issued a security update for Mac OS X PLATFORM: Apple Macintosh OS X ABSTRACT: The vulnerabilities are caused due to a bundled version of QuickTime REFERENCE LINKS: Secunia Advisory SA54049 APPLE-SA-2013-07-02-1 Security Update 2013-003 CVE-2013-1018 CVE-2013-1019 CVE-2013-1022 IMPACT ASSESSMENT: High DISCUSSION: A boundary error when parsing compressed data within H.264 encoded movie files can be exploited to cause a buffer overflow A boundary error when handling the Sorenson Video 3 "mdat" section within a MOV file can be exploited to cause a buffer overflow A boundary error when handling "mvhd" atoms can be exploited to cause a

53

Climate Change: Conflict, Security and Vulnerability Professor of Climate Change  

E-Print Network (OSTI)

Climate Change: Conflict, Security and Vulnerability Mike Hulme Professor of Climate Change Science, Society and Sustainability Group School of Environmental Sciences Rethinking Climate Change, Conflict security" "increase risk of conflicts among and within nations" #12;· from `climatic change' to `climate-change

Hulme, Mike

54

U-249: Google Chrome Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

49: Google Chrome Multiple Vulnerabilities 49: Google Chrome Multiple Vulnerabilities U-249: Google Chrome Multiple Vulnerabilities August 31, 2012 - 6:00am Addthis PROBLEM: Google Chrome Multiple Vulnerabilities PLATFORM: Google Chrome 21.x ABSTRACT: Multiple vulnerabilities have been reported in Google Chrome. reference LINKS: Secunia Advisory SA50447 Stable Channel Update CVE-2012-2865 CVE-2012-2866 CVE-2012-2867 CVE-2012-2868 CVE-2012-2869 CVE-2012-2870 CVE-2012-2871 CVE-2012-2872 IMPACT ASSESSMENT: High Discussion: Multiple vulnerabilities have been reported in Google Chrome, where some have an unknown impact and others can be exploited by malicious people to conduct cross-site scripting attacks and compromise a user's system. 1) An out-of-bounds read error exists when handling line breaks. 2) A bad cast error exists within run-ins.

55

V-105: Google Chrome Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Google Chrome Multiple Vulnerabilities 5: Google Chrome Multiple Vulnerabilities V-105: Google Chrome Multiple Vulnerabilities March 6, 2013 - 12:09am Addthis PROBLEM: Google Chrome Multiple Vulnerabilities PLATFORM: Google Chrome prior to 25.0.1364.152. ABSTRACT: Multiple vulnerabilities have been reported in Google Chrome REFERENCE LINKS: Stable Channel Update Secunia Advisory SA52454 CVE-2013-0902 CVE-2013-0903 CVE-2013-0904 CVE-2013-0905 CVE-2013-0906 CVE-2013-0907 CVE-2013-0908 CVE-2013-0909 CVE-2013-0910 CVE-2013-0911 IMPACT ASSESSMENT: High DISCUSSION: Multiple vulnerabilities in Google Chrome may have an unknown impact and others can be exploited by malicious people to compromise a user's system. 1) A use-after-free error exists in frame loader. 2) A use-after-free error exists in browser navigation handling.

56

V-090: Adobe Flash Player / AIR Multiple Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Adobe Flash Player / AIR Multiple Vulnerabilities 0: Adobe Flash Player / AIR Multiple Vulnerabilities V-090: Adobe Flash Player / AIR Multiple Vulnerabilities February 13, 2013 - 12:14am Addthis PROBLEM: Adobe Flash Player / AIR Multiple Vulnerabilities PLATFORM: Adobe Flash Player versions 11.5.502.149 and prior for Windows and Macintosh Adobe Flash Player versions 11.2.202.262 and prior for Linux Adobe Flash Player versions 11.1.115.37 and prior for Android 4.x Adobe Flash Player versions 11.1.111.32 and prior for Android 3.x and 2.x Adobe AIR versions 3.5.0.1060 and prior Adobe AIR versions 3.5.0.1060 SDK and prior ABSTRACT: Multiple vulnerabilities have been reported in Adobe Flash Player and AIR. REFERENCE LINKS: Vulnerability identifier: APSB13-05 Secunia Advisory SA52166 CVE-2013-0637 CVE-2013-0638 CVE-2013-0639

57

V-059: MoinMoin Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

9: MoinMoin Multiple Vulnerabilities 9: MoinMoin Multiple Vulnerabilities V-059: MoinMoin Multiple Vulnerabilities January 1, 2013 - 5:57am Addthis PROBLEM: MoinMoin Multiple Vulnerabilities PLATFORM: Version(s): MoinMoin 1.x ABSTRACT: Multiple vulnerabilities have been reported in MoinMoin, which can be exploited by malicious users to conduct script insertion attacks and compromise a vulnerable system and by malicious people to manipulate certain data. REFERENCE LINKS: Secunia Advisory SA51663 CVE-2012-6080 CVE-2012-6081 CVE-2012-6082 IMPACT ASSESSMENT: High DISCUSSION: 1) Certain input when handling the AttachFile action is not properly verified before being used to write files. This can be exploited to overwrite arbitrary files via directory traversal sequences. 2) The application allows the upload of files with arbitrary extensions to

58

U-066: Mozilla Firefox / Thunderbird Multiple Vulnerabilities | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Mozilla Firefox / Thunderbird Multiple Vulnerabilities 6: Mozilla Firefox / Thunderbird Multiple Vulnerabilities U-066: Mozilla Firefox / Thunderbird Multiple Vulnerabilities December 22, 2011 - 6:30am Addthis PROBLEM: Mozilla Firefox / Thunderbird Multiple Vulnerabilities . PLATFORM: Mozilla Firefox 8.x and Mozilla Thunderbird 8.x ABSTRACT: Multiple vulnerabilities have been reported in Mozilla Firefox and Thunderbird. reference LINKS: Advisory 2011-53 Advisory 2011-54 Advisory 2011-55 Advisory 2011-56 Advisory 2011-57 Advisory 2011-58 Secunia Advisory: SA47302 IMPACT ASSESSMENT: High Discussion: Vulnerabilities have been reported in Mozilla Firefox and Thunderbird, where one has an unknown impact and others can be exploited by malicious people to disclose sensitive information and compromise a user's system. 1) Some unspecified errors can be exploited to corrupt memory. No further

59

V-224: Google Chrome Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Google Chrome Multiple Vulnerabilities 4: Google Chrome Multiple Vulnerabilities V-224: Google Chrome Multiple Vulnerabilities August 22, 2013 - 1:05am Addthis PROBLEM: Multiple vulnerabilities have been reported in Google Chrome, where some have an unknown impact and others can be exploited by malicious, local users to disclose potentially sensitive information and by malicious people to compromise a user's system. PLATFORM: Google Chrome 28.x ABSTRACT: The vulnerabilities are reported in versions prior to 29.0.1547.57 REFERENCE LINKS: Secunia Advisory ID: 1028921 CVE-2013-2887 CVE-2013-2900 CVE-2013-2901 CVE-2013-2902 CVE-2013-2903 CVE-2013-2904 CVE-2013-2905 IMPACT ASSESSMENT: High DISCUSSION: Multiple vulnerabilities have been reported in Google Chrome, where some have an unknown impact and others can be exploited by malicious, local users to disclose

60

T-542: SAP Crystal Reports Server Multiple Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: SAP Crystal Reports Server Multiple Vulnerabilities 2: SAP Crystal Reports Server Multiple Vulnerabilities T-542: SAP Crystal Reports Server Multiple Vulnerabilities January 25, 2011 - 2:30pm Addthis PROBLEM: SAP Crystal Reports Server Multiple Vulnerabilities. PLATFORM: Crystal Reports Server 2008 ABSTRACT: Multiple vulnerabilities in SAP Crystal Reports Server 2008, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to conduct cross-site scripting attacks, manipulate certain data, and compromise a user's system. reference LINKS: Secunia Advisory SA43060 Vulnerability Report: Crystal Reports Server 2008 IMPACT ASSESSMENT: High Discussion: 1) Input passed to the "actId" parameter in InfoViewApp/jsp/common/actionNav.jsp, "backUrl" parameter in

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


61

V-092: Pidgin Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Pidgin Multiple Vulnerabilities 2: Pidgin Multiple Vulnerabilities V-092: Pidgin Multiple Vulnerabilities February 15, 2013 - 6:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Pidgin PLATFORM: Vulnerabilities are reported in version 2.10.6. Prior versions may also be affected. ABSTRACT: Multiple vulnerabilities have been reported in Pidgin, which can be exploited by malicious people to manipulate certain data, cause a DoS (Denial of Service), and compromise a user's system. REFERENCE LINKS: Secunia Advisory SA52178 Pidgin CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 IMPACT ASSESSMENT: High DISCUSSION: 1) An error within the MXit protocol plugin when saving images can be exploited to overwrite certain files. 2) A boundary error within the "mxit_cb_http_read()" function

62

V-214: Mozilla Firefox Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Mozilla Firefox Multiple Vulnerabilities 4: Mozilla Firefox Multiple Vulnerabilities V-214: Mozilla Firefox Multiple Vulnerabilities August 8, 2013 - 2:16am Addthis PROBLEM: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 23.0 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. PLATFORM: Mozilla Firefox 22.x ABSTRACT: The vulnerabilities are reported in versions prior to 23.0. REFERENCE LINKS: Secunia Advisory SA54418 CVE-2013-1701 CVE-2013-1702 CVE-2013-1704 CVE-2013-1705 CVE-2013-1706 CVE-2013-1707 CVE-2013-1709 CVE-2013-1710 CVE-2013-1711 CVE-2013-1713 CVE-2013-1714 CVE-2013-1717 IMPACT ASSESSMENT: High DISCUSSION: Multiple vulnerabilities have been reported in Mozilla Firefox, which can

63

T-542: SAP Crystal Reports Server Multiple Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: SAP Crystal Reports Server Multiple Vulnerabilities 2: SAP Crystal Reports Server Multiple Vulnerabilities T-542: SAP Crystal Reports Server Multiple Vulnerabilities January 25, 2011 - 2:30pm Addthis PROBLEM: SAP Crystal Reports Server Multiple Vulnerabilities. PLATFORM: Crystal Reports Server 2008 ABSTRACT: Multiple vulnerabilities in SAP Crystal Reports Server 2008, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to conduct cross-site scripting attacks, manipulate certain data, and compromise a user's system. reference LINKS: Secunia Advisory SA43060 Vulnerability Report: Crystal Reports Server 2008 IMPACT ASSESSMENT: High Discussion: 1) Input passed to the "actId" parameter in InfoViewApp/jsp/common/actionNav.jsp, "backUrl" parameter in

64

V-059: MoinMoin Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

9: MoinMoin Multiple Vulnerabilities 9: MoinMoin Multiple Vulnerabilities V-059: MoinMoin Multiple Vulnerabilities January 1, 2013 - 5:57am Addthis PROBLEM: MoinMoin Multiple Vulnerabilities PLATFORM: Version(s): MoinMoin 1.x ABSTRACT: Multiple vulnerabilities have been reported in MoinMoin, which can be exploited by malicious users to conduct script insertion attacks and compromise a vulnerable system and by malicious people to manipulate certain data. REFERENCE LINKS: Secunia Advisory SA51663 CVE-2012-6080 CVE-2012-6081 CVE-2012-6082 IMPACT ASSESSMENT: High DISCUSSION: 1) Certain input when handling the AttachFile action is not properly verified before being used to write files. This can be exploited to overwrite arbitrary files via directory traversal sequences. 2) The application allows the upload of files with arbitrary extensions to

65

V-081: Wireshark Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Wireshark Multiple Vulnerabilities 1: Wireshark Multiple Vulnerabilities V-081: Wireshark Multiple Vulnerabilities January 31, 2013 - 12:21am Addthis PROBLEM: Wireshark Multiple Vulnerabilities PLATFORM: The vulnerabilities are reported in versions prior to 1.8.5 and 1.6.13. ABSTRACT: Multiple vulnerabilities have been reported in Wireshark REFERENCE LINKS: Wireshark 1.8.5 Release Notes Secunia Advisory SA51968 IMPACT ASSESSMENT: High DISCUSSION: 1) Errors in the Bluetooth HCI, CSN.1, DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols, MPLS, R3, RTPS, SDP, and SIP dissectors can be exploited to trigger infinite loops and consume CPU resources via specially crafted packets. 2) An error in the CLNP dissector when processing certain packets can be exploited to cause a crash via a specially crafted packet.

66

V-081: Wireshark Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Wireshark Multiple Vulnerabilities 1: Wireshark Multiple Vulnerabilities V-081: Wireshark Multiple Vulnerabilities January 31, 2013 - 12:21am Addthis PROBLEM: Wireshark Multiple Vulnerabilities PLATFORM: The vulnerabilities are reported in versions prior to 1.8.5 and 1.6.13. ABSTRACT: Multiple vulnerabilities have been reported in Wireshark REFERENCE LINKS: Wireshark 1.8.5 Release Notes Secunia Advisory SA51968 IMPACT ASSESSMENT: High DISCUSSION: 1) Errors in the Bluetooth HCI, CSN.1, DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols, MPLS, R3, RTPS, SDP, and SIP dissectors can be exploited to trigger infinite loops and consume CPU resources via specially crafted packets. 2) An error in the CLNP dissector when processing certain packets can be exploited to cause a crash via a specially crafted packet.

67

V-092: Pidgin Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Pidgin Multiple Vulnerabilities 2: Pidgin Multiple Vulnerabilities V-092: Pidgin Multiple Vulnerabilities February 15, 2013 - 6:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Pidgin PLATFORM: Vulnerabilities are reported in version 2.10.6. Prior versions may also be affected. ABSTRACT: Multiple vulnerabilities have been reported in Pidgin, which can be exploited by malicious people to manipulate certain data, cause a DoS (Denial of Service), and compromise a user's system. REFERENCE LINKS: Secunia Advisory SA52178 Pidgin CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 IMPACT ASSESSMENT: High DISCUSSION: 1) An error within the MXit protocol plugin when saving images can be exploited to overwrite certain files. 2) A boundary error within the "mxit_cb_http_read()" function

68

U-202: Apple QuickTime Multiple Stack Overflow Vulnerabilities | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

202: Apple QuickTime Multiple Stack Overflow Vulnerabilities 202: Apple QuickTime Multiple Stack Overflow Vulnerabilities U-202: Apple QuickTime Multiple Stack Overflow Vulnerabilities June 29, 2012 - 7:00am Addthis PROBLEM: Apple QuickTime is prone to multiple stack-based buffer-overflow vulnerabilities. PLATFORM: Version(s): prior to 7.7.2 ABSTRACT: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. Reference links: Vendor Advisory Security Focus ID 53571 CVE-2012-0663 IMPACT ASSESSMENT: Medium Discussion: These issues arise when the application handles specially crafted files. Successful exploits may allow attackers to execute arbitrary code in the context of the currently logged-in user; failed exploit attempts will cause denial-of-service conditions.Versions prior to

69

U-202: Apple QuickTime Multiple Stack Overflow Vulnerabilities | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Apple QuickTime Multiple Stack Overflow Vulnerabilities 2: Apple QuickTime Multiple Stack Overflow Vulnerabilities U-202: Apple QuickTime Multiple Stack Overflow Vulnerabilities June 29, 2012 - 7:00am Addthis PROBLEM: Apple QuickTime is prone to multiple stack-based buffer-overflow vulnerabilities. PLATFORM: Version(s): prior to 7.7.2 ABSTRACT: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. Reference links: Vendor Advisory Security Focus ID 53571 CVE-2012-0663 IMPACT ASSESSMENT: Medium Discussion: These issues arise when the application handles specially crafted files. Successful exploits may allow attackers to execute arbitrary code in the context of the currently logged-in user; failed exploit attempts will cause denial-of-service conditions.Versions prior to

70

V-208: Google Chrome Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: Google Chrome Multiple Vulnerabilities 8: Google Chrome Multiple Vulnerabilities V-208: Google Chrome Multiple Vulnerabilities August 1, 2013 - 2:32am Addthis PROBLEM: Multiple unspecified vulnerabilities in Google Chrome before 28.0.1500.95 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. PLATFORM: Google Chrome 28.x ABSTRACT: Some vulnerabilities have been reported in Google Chrome which allows attackers to access and compromise a user's system. REFERENCE LINKS: Secunia Advisory SA54325 CVE-2013-2881 CVE-2013-2882 CVE-2013-2883 CVE-2013-2884 CVE-2013-2885 CVE-2013-2886 IMPACT ASSESSMENT: High DISCUSSION: Several vulnerabilities have been reported in Google Chrome, where some have an unknown impact and others can be exploited by malicious people to

71

U-179: IBM Java 7 Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

9: IBM Java 7 Multiple Vulnerabilities 9: IBM Java 7 Multiple Vulnerabilities U-179: IBM Java 7 Multiple Vulnerabilities May 30, 2012 - 7:00am Addthis PROBLEM: IBM has acknowledged multiple vulnerabilities in IBM Java PLATFORM: IBM Java 7.x ABSTRACT: Vulnerabilities can be exploited by malicious users to disclose certain information and by malicious people to disclose potentially sensitive information, hijack a user's session, conduct DNS cache poisoning attacks, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system. Reference Links: Secunia Advisory 49333 CVE-2011-3389 Vendor Advisory IMPACT ASSESSMENT: High Discussion: IBM released a patch to address vulerabilities in IBM Java 7. IBM 7 SR1 is available for download. Impact: Hijacking Manipulation of data Exposure of sensitive information

72

V-152: Cisco Unified Customer Voice Portal (CVP) Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Cisco Unified Customer Voice Portal (CVP) Multiple 2: Cisco Unified Customer Voice Portal (CVP) Multiple Vulnerabilities V-152: Cisco Unified Customer Voice Portal (CVP) Multiple Vulnerabilities May 9, 2013 - 6:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Cisco Unified Customer Voice Portal (CVP) PLATFORM: The vulnerabilities are reported in versions prior to 9.0.1 ES 11 ABSTRACT: Various components of Cisco Unified CVP are affected. These vulnerabilities can be exploited independently; however, more than one vulnerability could be exploited on the same device. REFERENCE LINKS: Secunia Advisory SA53306 Cisco Advisory ID cisco-sa-20130508-cvp Cisco Applied Mitigation Bulletin CVE-2013-1220 CVE-2013-1221 CVE-2013-1222 CVE-2013-1223 CVE-2013-1224 CVE-2013-1225 IMPACT ASSESSMENT: Medium DISCUSSION:

73

U-179: IBM Java 7 Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

9: IBM Java 7 Multiple Vulnerabilities 9: IBM Java 7 Multiple Vulnerabilities U-179: IBM Java 7 Multiple Vulnerabilities May 30, 2012 - 7:00am Addthis PROBLEM: IBM has acknowledged multiple vulnerabilities in IBM Java PLATFORM: IBM Java 7.x ABSTRACT: Vulnerabilities can be exploited by malicious users to disclose certain information and by malicious people to disclose potentially sensitive information, hijack a user's session, conduct DNS cache poisoning attacks, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system. Reference Links: Secunia Advisory 49333 CVE-2011-3389 Vendor Advisory IMPACT ASSESSMENT: High Discussion: IBM released a patch to address vulerabilities in IBM Java 7. IBM 7 SR1 is available for download. Impact: Hijacking Manipulation of data Exposure of sensitive information

74

V-111: Multiple vulnerabilities have been reported in Puppet | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Multiple vulnerabilities have been reported in Puppet 1: Multiple vulnerabilities have been reported in Puppet V-111: Multiple vulnerabilities have been reported in Puppet March 14, 2013 - 12:12am Addthis PROBLEM: Multiple vulnerabilities have been reported in Puppet PLATFORM: Puppet 2.x Puppet 3.x Puppet Enterprise 1.x Puppet Enterprise 2.x ABSTRACT: Puppet Multiple Vulnerabilities REFERENCE LINKS: Puppet Blog Secunia Advisory SA52596 CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2274 CVE-2013-2275 IMPACT ASSESSMENT: High DISCUSSION: 1) An unspecified error exists when invoking the "template" or "inline_template" functions while responding to a catalog request and can be exploited to execute arbitrary code via a specially crafted catalog request. 2) An input validation error exists in the application and can be exploited

75

V-118: IBM Lotus Domino Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: IBM Lotus Domino Multiple Vulnerabilities 8: IBM Lotus Domino Multiple Vulnerabilities V-118: IBM Lotus Domino Multiple Vulnerabilities March 25, 2013 - 12:40am Addthis PROBLEM: IBM Lotus Domino Multiple Vulnerabilities PLATFORM: IBM Domino 8.x ABSTRACT: Multiple vulnerabilities have been reported in IBM Lotus Domino REFERENCE LINKS: IBM Reference #:1627597 Secunia Advisory SA52753 CVE-2012-6277 CVE-2013-0486 CVE-2013-0487 IMPACT ASSESSMENT: High DISCUSSION: 1) An unspecified error can be exploited to disclose time-limited authentication credentials via the Domino Java Console and subsequently gain otherwise restricted access. Successful exploitation may require certain knowledge of Domino server configuration. 2) An unspecified error in the HTTP server component can be exploited to cause a memory leak and subsequently crash the server.

76

V-178: IBM Data Studio Web Console Java Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: IBM Data Studio Web Console Java Multiple Vulnerabilities 8: IBM Data Studio Web Console Java Multiple Vulnerabilities V-178: IBM Data Studio Web Console Java Multiple Vulnerabilities June 14, 2013 - 6:00am Addthis PROBLEM: IBM has acknowledged a weakness and two vulnerabilities in IBM Data Studio PLATFORM: IBM Data Studio 3.x ABSTRACT: IBM Data Studio Web Console uses the IBM Java Runtime Environment (JRE) and might be affected by vulnerabilities in the IBM JRE REFERENCE LINKS: Secunia Advisory SA53778 IBM Flash Alert 1640533 CVE-2013-0169 CVE-2013-0440 CVE-2013-0443 IMPACT ASSESSMENT: High DISCUSSION: An unspecified vulnerability within the JSSE component could allow: 1) A remote attacker to cause a denial of service 2) To statistically observe the time necessary to generate/receive error messages and deduce the plaintext after a relatively small number of

77

V-158: BlackBerry Tablet OS Flash Player Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: BlackBerry Tablet OS Flash Player Multiple Vulnerabilities 8: BlackBerry Tablet OS Flash Player Multiple Vulnerabilities V-158: BlackBerry Tablet OS Flash Player Multiple Vulnerabilities May 17, 2013 - 6:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in BlackBerry Tablet OS PLATFORM: BlackBerry Tablet OS 2.x ABSTRACT: Multiple vulnerabilities have been reported in BlackBerry Tablet OS, which can be exploited by malicious people to bypass certain security restrictions and compromise a user's system. REFERENCE LINKS: Secunia Advisory SA53453 Blackberry Security Advisory KB34161 CVE-2012-5248 CVE-2012-5249 CVE-2012-5250 CVE-2012-5251 CVE-2012-5252 CVE-2012-5253 CVE-2012-5254 CVE-2012-5255 CVE-2012-5256 CVE-2012-5257 CVE-2012-5258 CVE-2012-5259 CVE-2012-5260 CVE-2012-5261 CVE-2012-5262 CVE-2012-5263 CVE-2012-5264 CVE-2012-5265

78

U-234: Oracle MySQL User Login Security Bypass Vulnerability | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

234: Oracle MySQL User Login Security Bypass Vulnerability 234: Oracle MySQL User Login Security Bypass Vulnerability U-234: Oracle MySQL User Login Security Bypass Vulnerability August 14, 2012 - 7:00am Addthis PROBLEM: Oracle MySQL User Login Security Bypass Vulnerability PLATFORM: Version(s): prior to 5.1.63 and 5.5.25 are vulnerable. ABSTRACT: Oracle MySQL is prone to a security bypass vulnerability Attackers can exploit this issue to bypass certain security restrictions. REFERENCE LINKS: http://www.securityfocus.com/bid/53911/discuss CVE-2012-2122 IMPACT ASSESSMENT: Medium Discussion: Security researchers have released details about a vulnerability in the MySQL server that could allow potential attackers to access MySQL databases without inputting proper authentication credentials.The vulnerability is identified as CVE-2012-2122 and was addressed in MySQL 5.1.63 and 5.5.25 in

79

V-051: Oracle Solaris Java Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Oracle Solaris Java Multiple Vulnerabilities 1: Oracle Solaris Java Multiple Vulnerabilities V-051: Oracle Solaris Java Multiple Vulnerabilities December 20, 2012 - 12:15am Addthis PROBLEM: Oracle Solaris Java Multiple Vulnerabilities PLATFORM: Oracle Solaris 11.x ABSTRACT: Oracle has acknowledged multiple vulnerabilities in Java included in Solaris REFERENCE LINKS: Secunia Advisory: SA51618 Secunia Advisory: SA50949 Third Party Vulnerability Resolution Blog in Java 7U9 Third Party Vulnerability Resolution Blog in Java 6U37 CVE-2012-1531 CVE-2012-1532 CVE-2012-1533 CVE-2012-3143 CVE-2012-3159 CVE-2012-3216 CVE-2012-4416 CVE-2012-5067 CVE-2012-5068 CVE-2012-5069 CVE-2012-5070 CVE-2012-5071 CVE-2012-5072 CVE-2012-5073 CVE-2012-5074 CVE-2012-5075 CVE-2012-5076 CVE-2012-5077 CVE-2012-5079 CVE-2012-5081 CVE-2012-5083 CVE-2012-5084

80

T-697: Google Chrome Prior to 13.0.782.107 Multiple Security  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

97: Google Chrome Prior to 13.0.782.107 Multiple Security 97: Google Chrome Prior to 13.0.782.107 Multiple Security Vulnerabilities T-697: Google Chrome Prior to 13.0.782.107 Multiple Security Vulnerabilities August 19, 2011 - 3:02pm Addthis PROBLEM: Attackers can exploit these issues to execute arbitrary code in the context of the browser or cause denial-of-service conditions; other attacks may also be possible. PLATFORM: Cross Platform: Google Chrome Prior to 13.0.782.107: Versions and Vulnerabilities (Details) ABSTRACT: Attackers can exploit these issues to execute arbitrary code in the context of the browser or cause denial-of-service conditions; other attacks may also be possible. The Chromium Projects Security Overview. reference LINKS: SecurityFocus: Google Chrome Prior to 13.0.782.107 Multiple Security Vulnerabilities

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


81

U-035: Adobe Flash Player Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

35: Adobe Flash Player Multiple Vulnerabilities 35: Adobe Flash Player Multiple Vulnerabilities U-035: Adobe Flash Player Multiple Vulnerabilities November 14, 2011 - 10:15am Addthis PROBLEM: Adobe Flash Player Multiple Vulnerabilities. PLATFORM: Adobe Flash Player 11.0.1.152 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems Adobe Flash Player 11.0.1.153 and earlier versions for Android Adobe AIR 3.0 and earlier versions for Windows, Macintosh, and Android ABSTRACT: Adobe recommends users of Adobe Flash Player 11.0.1.152 and earlier versions for Windows, Macintosh, Linux and Solaris update to Adobe Flash Player 11.1.102.55. Users of Adobe Flash Player 11.0.1.153 and earlier versions for Android should update to Adobe Flash Player 11.1.102.59 for Android. Users of Adobe AIR 3.0 for Windows, Macintosh, and Android should

82

V-080: Apple iOS Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Apple iOS Multiple Vulnerabilities 0: Apple iOS Multiple Vulnerabilities V-080: Apple iOS Multiple Vulnerabilities January 30, 2013 - 12:56am Addthis PROBLEM: Apple iOS Multiple Vulnerabilities PLATFORM: Apple iOS 6.x for iPhone 3GS and later Apple iOS for iPad 6.x Apple iOS for iPod touch 6.x ABSTRACT: Two security issues and multiple vulnerabilities have been reported in Apple iOS REFERENCE LINKS: Article: HT5642 APPLE-SA-2013-01-28-1 iOS 6.1 Software Update Secunia Advisory SA52002 CVE-2011-3058 CVE-2012-2619 CVE-2012-2824 CVE-2012-2857 CVE-2012-2889 CVE-2012-3606 CVE-2012-3607 CVE-2012-3621 CVE-2012-3632 CVE-2012-3687 CVE-2012-3701 CVE-2013-0948 CVE-2013-0949 CVE-2013-0950 CVE-2013-0951 CVE-2013-0952 CVE-2013-0953 CVE-2013-0954 CVE-2013-0955 CVE-2013-0956 CVE-2013-0958 CVE-2013-0959 CVE-2013-0962 CVE-2013-0963 CVE-2013-0964

83

ISS-011, Vulnerability Assessment Standard 1/3 UCIT INFORMATION SECURITY STANDARDS  

E-Print Network (OSTI)

ISS-011, Vulnerability Assessment Standard 1/3 UCIT INFORMATION SECURITY STANDARDS Vulnerability Assessment Standard Rationale 1 To enable timely identification and mitigation of vulnerabilities and security flaws affecting computing devices within UofC's computing environment. Scope 2 2.1 This standard

Habib, Ayman

84

V-107: Wireshark Multiple Denial of Service Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Wireshark Multiple Denial of Service Vulnerabilities 7: Wireshark Multiple Denial of Service Vulnerabilities V-107: Wireshark Multiple Denial of Service Vulnerabilities March 8, 2013 - 6:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Wireshark PLATFORM: Wireshark 1.6.x and 1.8.x ABSTRACT: Multiple vulnerabilities have been reported in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service). REFERENCE LINKS: Secunia Advisory SA52471 Wireshark Release Notes 1.8.6 Wireshark Release Notes 1.6.1.4 CVE-2013-2475 CVE-2013-2476 CVE-2013-2477 CVE-2013-2478 CVE-2013-2479 CVE-2013-2480 CVE-2013-2481 CVE-2013-2482 CVE-2013-2483 CVE-2013-2484 CVE-2013-2485 CVE-2013-2486 CVE-2013-2487 CVE-2013-2488 IMPACT ASSESSMENT: Medium DISCUSSION: 1) An error in the TCP dissector when processing certain packets can be

85

V-107: Wireshark Multiple Denial of Service Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Wireshark Multiple Denial of Service Vulnerabilities 7: Wireshark Multiple Denial of Service Vulnerabilities V-107: Wireshark Multiple Denial of Service Vulnerabilities March 8, 2013 - 6:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Wireshark PLATFORM: Wireshark 1.6.x and 1.8.x ABSTRACT: Multiple vulnerabilities have been reported in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service). REFERENCE LINKS: Secunia Advisory SA52471 Wireshark Release Notes 1.8.6 Wireshark Release Notes 1.6.1.4 CVE-2013-2475 CVE-2013-2476 CVE-2013-2477 CVE-2013-2478 CVE-2013-2479 CVE-2013-2480 CVE-2013-2481 CVE-2013-2482 CVE-2013-2483 CVE-2013-2484 CVE-2013-2485 CVE-2013-2486 CVE-2013-2487 CVE-2013-2488 IMPACT ASSESSMENT: Medium DISCUSSION: 1) An error in the TCP dissector when processing certain packets can be

86

T-657: Drupal Prepopulate - Multiple vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Drupal Prepopulate - Multiple vulnerabilities 7: Drupal Prepopulate - Multiple vulnerabilities T-657: Drupal Prepopulate - Multiple vulnerabilities June 29, 2011 - 3:34pm Addthis PROBLEM: Prepopulate module enables pre-populating forms in Drupal using the $_REQUEST vairable. PLATFORM: Prepopulate module for Drupal 6.x versions prior to 6.x-2.2 ABSTRACT: The module does not adequately validate user input leading to an cross-site scripting (XSS) possibility in certain circumstances. reference LINKS: Advisory ID: DRUPAL-SA-CONTRIB-2011-023 Prepopulate module Prepopulate 6.x-2.2 Update IMPACT ASSESSMENT: High Discussion: The Prepopulate module enables pre-populating forms in Drupal using the $_REQUEST vairable. The module does not adequately validate user input leading to an cross-site scripting (XSS) possibility in certain circumstances. Users privileged to

87

V-197: Adobe ColdFusion 10 WebSockets Security Bypass Vulnerability |  

NLE Websites -- All DOE Office Websites (Extended Search)

7: Adobe ColdFusion 10 WebSockets Security Bypass Vulnerability 7: Adobe ColdFusion 10 WebSockets Security Bypass Vulnerability V-197: Adobe ColdFusion 10 WebSockets Security Bypass Vulnerability July 11, 2013 - 6:00am Addthis PROBLEM: A vulnerability has been reported in Adobe ColdFusion PLATFORM: The vulnerability is reported in version 10 for Windows, Macintosh, and Linux ABSTRACT: The vulnerability is caused due to an unspecified error and can be exploited to invoke public methods on ColdFusion Components (CFC) using WebSockets REFERENCE LINKS: Secunia Advisory SA54024 Adobe Security Bulletin APSB13-19 Stackoverflow.com CVE-2013-3350 IMPACT ASSESSMENT: High DISCUSSION: The hotfix resolves a vulnerability that could permit an attacker to invoke public methods on ColdFusion Components (CFC) using WebSockets IMPACT: Security Bypass

88

V-216: Drupal Monster Menus Module Security Bypass and Script...  

Office of Environmental Management (EM)

Module Security Bypass and Denial of Service Vulnerability U-162: Drupal Multiple Vulnerabilities V-052: Drupal Core Access Bypass and Arbitrary PHP Code Execution Vulnerabilities...

89

T-626: Xen Multiple Buffer Overflow and Integer Overflow Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Xen Multiple Buffer Overflow and Integer Overflow 6: Xen Multiple Buffer Overflow and Integer Overflow Vulnerabilities T-626: Xen Multiple Buffer Overflow and Integer Overflow Vulnerabilities May 19, 2011 - 3:05pm Addthis PROBLEM: Xen Multiple Buffer Overflow and Integer Overflow Vulnerabilities PLATFORM: XenSource Xen 3.3.1, XenSource Xen 3.3, XenSource Xen 3.2, XenSource Xen 3.1.2, XenSource Xen 3.1.1, XenSource Xen 3.0.3, XenSource Xen 4.0, XenSource Xen 3.0, RedHat Enterprise Linux Virtualization 5 server, RedHat Enterprise Linux Desktop Multi OS 5 client ,RedHat Enterprise Linux 5 server, Red Hat Fedora 15 ,and Red Hat Enterprise Linux Desktop 5 client ABSTRACT: It was found that the xc_try_bzip2_decode() and xc_try_lzma_decode() decode routines did not correctly check for a possible buffer size overflow in the

90

V-017: Apache Tomcat Security Bypass and Denial of Service Vulnerabilities  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Apache Tomcat Security Bypass and Denial of Service 7: Apache Tomcat Security Bypass and Denial of Service Vulnerabilities V-017: Apache Tomcat Security Bypass and Denial of Service Vulnerabilities November 6, 2012 - 6:00am Addthis PROBLEM: Apache Tomcat Security Bypass and Denial of Service Vulnerabilities PLATFORM: Apache Tomcat 5.x Apache Tomcat 6.x Apache Tomcat 7.x ABSTRACT: Two vulnerabilities were reported in Apache Tomcat REFERENCE LINKS: Apache.org Apache Tomcat Denial of Service Apache Tomcat DIGEST authentication weaknesses Secunia Advisory SA51138 CVE-2012-2733 CVE-2012-3439 IMPACT ASSESSMENT: Medium DISCUSSION: A weakness and a vulnerability have been reported in Apache Tomcat, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service). 1) An error within the "parseHeaders()" function

91

U-042: Mac RealPlayer Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

42: Mac RealPlayer Multiple Vulnerabilities 42: Mac RealPlayer Multiple Vulnerabilities U-042: Mac RealPlayer Multiple Vulnerabilities November 21, 2011 - 9:15am Addthis PROBLEM: Mac RealPlayer Multiple Vulnerabilities. PLATFORM: Versions 12.0.0.1701 and prior. ABSTRACT: Multiple vulnerabilities have been reported in Mac RealPlayer, which can be exploited by malicious people to compromise a user's system. reference LINKS: Secunia Advisory: SA46963 Secunia Vulnerability Report: Mac RealPlayer 12.x Secunia Advisory: SA46954 IMPACT ASSESSMENT: High Discussion: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system. Successful exploitation of the vulnerabilities may allow execution of arbitrary code. The vulnerabilities are reported in the versions 14.0.7 and prior.

92

U-042: Mac RealPlayer Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Mac RealPlayer Multiple Vulnerabilities 2: Mac RealPlayer Multiple Vulnerabilities U-042: Mac RealPlayer Multiple Vulnerabilities November 21, 2011 - 9:15am Addthis PROBLEM: Mac RealPlayer Multiple Vulnerabilities. PLATFORM: Versions 12.0.0.1701 and prior. ABSTRACT: Multiple vulnerabilities have been reported in Mac RealPlayer, which can be exploited by malicious people to compromise a user's system. reference LINKS: Secunia Advisory: SA46963 Secunia Vulnerability Report: Mac RealPlayer 12.x Secunia Advisory: SA46954 IMPACT ASSESSMENT: High Discussion: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system. Successful exploitation of the vulnerabilities may allow execution of arbitrary code. The vulnerabilities are reported in the versions 14.0.7 and prior.

93

A Busy Year Securing Vulnerable Nuclear Material and Making the World Safer  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

A Busy Year Securing Vulnerable Nuclear Material and Making the A Busy Year Securing Vulnerable Nuclear Material and Making the World Safer A Busy Year Securing Vulnerable Nuclear Material and Making the World Safer January 7, 2011 - 6:22pm Addthis John Schueler John Schueler Former New Media Specialist, Office of Public Affairs This holiday season was certainly a busy one for the National Nuclear Security Administration (NNSA). While many Americans were off completing last minute Christmas shopping and spending time with loved ones, the team at NNSA was working around the clock to secure over 50 kilograms of highly enriched uranium from three sites in the Ukraine. As part of President Obama's ambitious plan to secure all vulnerable nuclear material around the world in four years, NNSA assisted in repatriating the dangerous

94

V-186: Drupal Login Security Module Security Bypass and Denial...  

Office of Energy Efficiency and Renewable Energy (EERE) Indexed Site

U-162: Drupal Multiple Vulnerabilities V-052: Drupal Core Access Bypass and Arbitrary PHP Code Execution Vulnerabilities V-216: Drupal Monster Menus Module Security Bypass and...

95

V-211: IBM iNotes Multiple Vulnerabilities  

Energy.gov (U.S. Department of Energy (DOE))

IBM iNotes has two cross-site scripting vulnerabilities and an ActiveX Integer overflow vulnerability

96

V-162: Apache Struts "ParameterInterceptor" Security Bypass Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Apache Struts "ParameterInterceptor" Security Bypass 2: Apache Struts "ParameterInterceptor" Security Bypass Vulnerability V-162: Apache Struts "ParameterInterceptor" Security Bypass Vulnerability May 23, 2013 - 6:00am Addthis PROBLEM: A vulnerability has been reported in Apache Struts PLATFORM: The vulnerability is reported in versions prior to 2.3.14.1 ABSTRACT: A vulnerability has been reported in Apache Struts, which can be exploited by malicious people to bypass certain security restrictions. REFERENCE LINKS: Secunia Advisory SA53495 Apache Struts Advisory S2-012 Apache Struts Advisory S2-013 CVE-2013-1965 CVE-2013-1966 IMPACT ASSESSMENT: High DISCUSSION: A request that included a specially crafted request parameter could be used to inject arbitrary OGNL code into the stack, afterward used as request

97

U-158: HP NonStop Server Java Multiple Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: HP NonStop Server Java Multiple Vulnerabilities 8: HP NonStop Server Java Multiple Vulnerabilities U-158: HP NonStop Server Java Multiple Vulnerabilities April 30, 2012 - 7:00am Addthis PROBLEM: HP NonStop Server Java Multiple Vulnerabilities PLATFORM: HP NonStop Server 6.x ABSTRACT: Multiple vulnerabilities have been reported in HP NonStop Server Reference links: Secunia Advisory SA48977 CVE-2011-3547 CVE-2011-3551 CVE-2011-3553 IMPACT ASSESSMENT: High Discussion: HP has acknowledged multiple vulnerabilities in HP NonStop Server, which can be exploited by malicious users to disclose sensitive information and by malicious people to disclose sensitive information, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system. Impact: Successful exploitation of this vulnerability may allow remote manipulation

98

U-188: MySQL User Login Security Bypass and Unspecified Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: MySQL User Login Security Bypass and Unspecified 8: MySQL User Login Security Bypass and Unspecified Vulnerability U-188: MySQL User Login Security Bypass and Unspecified Vulnerability June 12, 2012 - 7:00am Addthis PROBLEM: A security issue and vulnerability have been reported in MySQL PLATFORM: MySQL 5.x ABSTRACT: An error when verifying authentication attempts can be exploited to bypass the authentication mechanism. Reference LINKS: Original Advisory CVE-2012-2122 Secunia Advisory 49409 IMPACT ASSESSMENT: High Discussion: Successful exploitation of this vulnerability requires MySQL to be built on a system with a library that allows "memcmp()" to return a value outside of the -128 through 127 range (e.g. sse-optimized glibc). NOTE: Vendor binaries are reportedly not affected. The security issue is reported in versions prior to 5.1.63 and 5.5.25.

99

T-543: Wireshark 0.8.20 through 1.2.8 Multiple Vulnerabilities | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Wireshark 0.8.20 through 1.2.8 Multiple Vulnerabilities 3: Wireshark 0.8.20 through 1.2.8 Multiple Vulnerabilities T-543: Wireshark 0.8.20 through 1.2.8 Multiple Vulnerabilities January 26, 2011 - 7:35am Addthis PROBLEM: Wireshark is prone to multiple denial-of-service and buffer-overflow vulnerabilities. PLATFORM: Wireshark 0.8.20 through 1.2.8. ABSTRACT: Wireshark is prone to multiple denial-of-service and buffer-overflow vulnerabilities. Exploiting these issues may allow attackers to crash the application and deny service to legitimate users. Attackers may also execute arbitrary code in the context of vulnerable users running the application. reference LINKS: Securityfocus IMPACT ASSESSMENT: Medium Discussion: Wireshark is prone to multiple denial-of-service and buffer-overflow vulnerabilities.Exploiting these issues may allow attackers to crash the

100

V-070: Apache CouchDB Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Apache CouchDB Multiple Vulnerabilities 0: Apache CouchDB Multiple Vulnerabilities V-070: Apache CouchDB Multiple Vulnerabilities January 16, 2013 - 1:00am Addthis PROBLEM: Apache CouchDB Multiple Vulnerabilities PLATFORM: The vulnerabilities are reported in versions prior to 1.0.4, 1.1.2, and 1.2.1. ABSTRACT: Multiple vulnerabilities have been reported in Apache CouchDB REFERENCE LINKS: Secunia Advisory SA51765 Seclists.org/fulldisclosure/2013/Jan/80 Seclists.org/fulldisclosure/2013/Jan/81 Seclists.org/fulldisclosure/2013/Jan/82 CVE-2012-5641 CVE-2012-5649 CVE-2012-5650 IMPACT ASSESSMENT: Medium DISCUSSION: Multiple vulnerabilities have been reported in Apache CouchDB, which can be exploited by malicious people to conduct cross-site scripting attacks and disclose potentially sensitive information. 1) Input passed via the query parameters to browser-based test suite is not

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


101

U-117: Potential security vulnerability has been identified with certain HP  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Potential security vulnerability has been identified with 7: Potential security vulnerability has been identified with certain HP printers and HP digital senders U-117: Potential security vulnerability has been identified with certain HP printers and HP digital senders March 5, 2012 - 7:00am Addthis PROBLEM: The vulnerability could be exploited remotely to install unauthorized printer firmware. PLATFORM: Select HP printers and Digital Senders ABSTRACT: Remote attackers could execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update. reference LINKS: Vendor Advisory CVE-2011-4161 Previous JC3 Advisory Bulletin IMPACT ASSESSMENT: High Discussion: The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CPxxxx;

102

UEA Water Security Research Centre Climate Change and Variability Adaptation and Vulnerability  

E-Print Network (OSTI)

UEA Water Security Research Centre Climate Change and Variability · Adaptation and Vulnerability · Transboundary Cooperation ­ Conflict · Irrigation Performance and Policy · River Basin Management · Water Allocation · Hydropolitics www.uea.ac.uk/watersecurity #12;The UEA Water Security Research Centre applies

Everest, Graham R

103

U-228: BlackBerry Tablet OS Flash Player Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: BlackBerry Tablet OS Flash Player Multiple Vulnerabilities 8: BlackBerry Tablet OS Flash Player Multiple Vulnerabilities U-228: BlackBerry Tablet OS Flash Player Multiple Vulnerabilities August 6, 2012 - 7:00am Addthis PROBLEM: BlackBerry Tablet OS Flash Player Multiple Vulnerabilities PLATFORM: Adobe Flash Player versions included with BlackBerry PlayBook tablet software versions 2.0.1.358 and earlier. ABSTRACT: Vulnerabilities in Adobe Flash Player version included with the BlackBerry PlayBook tablet software reference LINKS: BlackBerry Article ID: KB31675 Secunia Advisory SA50164 CVE-2012-0752 CVE-2012-0753 CVE-2012-0754 CVE-2012-0755 CVE-2012-0756 CVE-2012-0767 CVE-2012-0768 CVE-2012-0769 CVE-2012-0773 CVE-2012-0779 IMPACT ASSESSMENT: High Discussion: Multiple vulnerabilities have been reported in BlackBerry Tablet OS, which

104

U-186: IBM WebSphere Sensor Events Multiple Vulnerabilities  

Energy.gov (U.S. Department of Energy (DOE))

Some vulnerabilities have unknown impacts and others can be exploited by malicious people to conduct cross-site scripting attacks.

105

U-214: HP Network Node Manager Java JDK / JRE Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

U-214: HP Network Node Manager Java JDK / JRE Multiple U-214: HP Network Node Manager Java JDK / JRE Multiple Vulnerabilities U-214: HP Network Node Manager Java JDK / JRE Multiple Vulnerabilities July 17, 2012 - 7:00am Addthis PROBLEM: HP Network Node Manager Java JDK / JRE Multiple Vulnerabilities PLATFORM: The vulnerabilities are reported in version 9.0x running on HP-UX, Linux, Solaris, and Windows. ABSTRACT: Vulnerabilities could be remotely exploited resulting in unauthorized information disclosure, modification, Denial of Service (DoS). reference LINKS: HP Support document ID: c03405642 Secunia Advisory SA49966 IMPACT ASSESSMENT: High Discussion: HP has acknowledged some vulnerabilities in HP Network Node Manager, which can be exploited by malicious, local users to disclose potentially sensitive information and by malicious people to disclose potentially

106

U-214: HP Network Node Manager Java JDK / JRE Multiple Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: HP Network Node Manager Java JDK / JRE Multiple 4: HP Network Node Manager Java JDK / JRE Multiple Vulnerabilities U-214: HP Network Node Manager Java JDK / JRE Multiple Vulnerabilities July 17, 2012 - 7:00am Addthis PROBLEM: HP Network Node Manager Java JDK / JRE Multiple Vulnerabilities PLATFORM: The vulnerabilities are reported in version 9.0x running on HP-UX, Linux, Solaris, and Windows. ABSTRACT: Vulnerabilities could be remotely exploited resulting in unauthorized information disclosure, modification, Denial of Service (DoS). reference LINKS: HP Support document ID: c03405642 Secunia Advisory SA49966 IMPACT ASSESSMENT: High Discussion: HP has acknowledged some vulnerabilities in HP Network Node Manager, which can be exploited by malicious, local users to disclose potentially sensitive information and by malicious people to disclose potentially

107

Using vulnerability assessments to design facility safeguards and security systems  

SciTech Connect

The Weapons Complex Reconfiguration (WCR) Program is meant to prepare the Department of Energy (DOE) weapons complex to meet the needs of the next century through construction of now facilities or upgrades-in-place at existing facilities. This paper describes how a vulnerability (VA) was used to identify potential S&S features for the conceptual design for a plutonium storage facility as part of the WCR Program. We distinguish those features of the design that need to be investigated at the conceptual stage from those that can be evaluated later. We also examined what protection features may allow reduced S&S operating costs, with the main focus on protective force costs. While some of these concepts hold the promise for significantly reducing life-cycle protective force costs, their use depends on resolving long-standing tradeoffs between S&S and safety, which are discussed in the study.

Snell, M.; Jaeger, C.

1994-08-01T23:59:59.000Z

108

CRITICAL INFRASTRUCTURE PROTECTION Multiple Efforts to Secure Control  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

CRITICAL INFRASTRUCTURE PROTECTION Multiple Efforts to Secure CRITICAL INFRASTRUCTURE PROTECTION Multiple Efforts to Secure Control Systems Are Under Way, but Challenges Remain CRITICAL INFRASTRUCTURE PROTECTION Multiple Efforts to Secure Control Systems Are Under Way, but Challenges Remain GAO is making recommendations to the Department of Homeland Security (DHS) to develop a strategy for coordinating control systems security efforts and to enhance information sharing with relevant stakeholders. DHS officials did not agree or disagree with GAO's recommendations, but stated that they would take them under advisement. CRITICAL INFRASTRUCTURE PROTECTION Multiple Efforts to Secure Control Systems Are Under Way, but Challenges Remain More Documents & Publications GAO Challenges and Efforts to Secure Control Systems (March 2004)

109

U-171: DeltaV Products Multiple Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

71: DeltaV Products Multiple Vulnerabilities 71: DeltaV Products Multiple Vulnerabilities U-171: DeltaV Products Multiple Vulnerabilities May 17, 2012 - 7:00am Addthis PROBLEM: DeltaV Products Multiple Vulnerabilities PLATFORM: DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and 11.3.1 DeltaV ProEssentials Scientific Graph version 5.0.0.6 ABSTRACT: Multiple vulnerabilities have been reported in DeltaV products, which can be exploited by malicious people to conduct cross-site scripting attacks, SQL injection attacks, cause a DoS (Denial of Service), and compromise a vulnerable system. Reference LINKS: Secunia Advisory SA49210 CVE-2012-1814 CVE-2012-1815 CVE-2012-1816 CVE-2012-1817 CVE-2012-1818 IMPACT ASSESSMENT: High Discussion: 1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and

110

Argonne's Vulnerability  

NLE Websites -- All DOE Office Websites (Extended Search)

finding finding and fixing security flaws Argonne's Vulnerability assessment Team VAT researchers spend their workdays devising and demonstrating ways to defeat a wide variety of security devices, systems, and programs, ranging from electronic voting machines and global positioning systems (GPS) to nuclear safeguards programs and biometrics-based access control. This involves analyzing the security features, reverse-engineering the technology or

111

Are markets for vulnerabilities effective?  

Science Journals Connector (OSTI)

Current reward structures in security vulnerability disclosure may be skewed toward benefitting nefarious usage of vulnerability information rather than responsible disclosure. Recently suggested market-based mechanisms offer incentives to responsible ... Keywords: information security, information technology policy, vulnerability disclosure

Sam Ransbotham; Sabyaschi Mitra; Jon Ramsey

2012-03-01T23:59:59.000Z

112

V-021: Cisco IronPort Web / Email Security Appliance Sophos Anti...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Cisco IronPort Web Email Security Appliance Sophos Anti-Virus Multiple Vulnerabilities V-021: Cisco IronPort Web Email Security Appliance Sophos Anti-Virus Multiple...

113

A Vulnerability Life Cycle-Based Security Modeling and Evaluation Approach  

Science Journals Connector (OSTI)

......the complexity of the models increases with the level of detail included...Artsiom Yautsiukhin (Eds.). Quality of Protection - Security Measurements...Stuart, E. (2006) Milk or Wine: Does Software Security Improve...Artsiom Yautsiukhin (Eds.). Quality of Protection - Security Measurements......

G. Vache Marconato; M. Kaniche; V. Nicomette

2013-04-01T23:59:59.000Z

114

NSTB Summarizes Vulnerable Areas  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

NSTB Summarizes Vulnerable Areas NSTB Summarizes Vulnerable Areas Commonly Found in Energy Control Systems Experts at the National SCADA Test Bed (NSTB) discovered some common areas of vulnerability in the energy control systems assessed between late 2004 and early 2006. These vulnerabilities ranged from conventional IT security issues to specific weaknesses in control system protocols. The paper "Lessons Learned from Cyber Security Assessments of SCADA and Energy Management Systems" describes the vulnerabilities and recommended strategies for mitigating them. It should be of use to asset owners and operators, control system vendors, system integrators, and third-party vendors interested in enhancing the security characteristics of current and future products.

115

Philosophy on Vulnerability Assessments  

NLE Websites -- All DOE Office Websites (Extended Search)

capabilities/vat/assess/ capabilities/vat/assess/ ARGONNE NATIONAL LABORATORY, Nuclear Engineering Division, 9700 South Cass Ave., Argonne, IL Philosophy on Vulnerability Assessments Argonne Vulnerability Assessment Team Roger G. Johnston, Ph.D., CPP , 630-252-6168 1. There are a number of conventional tools for finding security vulnerabilities. These include security surveys, risk management, design basis threat, CARVER Method, Delphi Method, software vulnerability assessment tools, infrastructure modeling, etc. 2. These tools have some value, and indeed we have used them all. 3. Experience has shown, however, that these methods do not usually result in dramatic improvements to security, nor do they reliably predict catastrophic security incidents that

116

V-021: Cisco IronPort Web / Email Security Appliance Sophos Anti-Virus  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

21: Cisco IronPort Web / Email Security Appliance Sophos 21: Cisco IronPort Web / Email Security Appliance Sophos Anti-Virus Multiple Vulnerabilities V-021: Cisco IronPort Web / Email Security Appliance Sophos Anti-Virus Multiple Vulnerabilities November 12, 2012 - 6:00am Addthis PROBLEM: Cisco IronPort Web / Email Security Appliance Sophos Anti-Virus Multiple Vulnerabilities PLATFORM: Cisco IronPort Email Security Appliances (C-Series and X-Series) running Sophos Engine versions 3.2.07.352_4.80 and prior. Cisco IronPort Web Security Appliances (S-Series) running Sophos Engine versions 3.2.07.352_4.80 and prior. ABSTRACT: Cisco Ironport Appliances Sophos Anti-Virus Vulnerabilities. REFERENCE LINKS: Cisco Security Advisory ID: cisco-sa-20121108-sophos Secunia Advisory SA51197 IMPACT ASSESSMENT: High DISCUSSION: Cisco has acknowledged some vulnerabilities in Cisco IronPort Web Security

117

V-021: Cisco IronPort Web / Email Security Appliance Sophos Anti-Virus  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Cisco IronPort Web / Email Security Appliance Sophos 1: Cisco IronPort Web / Email Security Appliance Sophos Anti-Virus Multiple Vulnerabilities V-021: Cisco IronPort Web / Email Security Appliance Sophos Anti-Virus Multiple Vulnerabilities November 12, 2012 - 6:00am Addthis PROBLEM: Cisco IronPort Web / Email Security Appliance Sophos Anti-Virus Multiple Vulnerabilities PLATFORM: Cisco IronPort Email Security Appliances (C-Series and X-Series) running Sophos Engine versions 3.2.07.352_4.80 and prior. Cisco IronPort Web Security Appliances (S-Series) running Sophos Engine versions 3.2.07.352_4.80 and prior. ABSTRACT: Cisco Ironport Appliances Sophos Anti-Virus Vulnerabilities. REFERENCE LINKS: Cisco Security Advisory ID: cisco-sa-20121108-sophos Secunia Advisory SA51197 IMPACT ASSESSMENT: High DISCUSSION: Cisco has acknowledged some vulnerabilities in Cisco IronPort Web Security

118

V-028: Splunk Multiple Cross-Site Scripting and Denial of Service  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: Splunk Multiple Cross-Site Scripting and Denial of Service 8: Splunk Multiple Cross-Site Scripting and Denial of Service Vulnerabilities V-028: Splunk Multiple Cross-Site Scripting and Denial of Service Vulnerabilities November 20, 2012 - 2:00am Addthis PROBLEM: Splunk Multiple Cross-Site Scripting and Denial of Service Vulnerabilities PLATFORM: Splunk versions 4.3.5 and 5.0 ABSTRACT: Splunk is prone to multiple vulnerabilities REFERENCE LINKS: SecurityTracker Alert ID: 1027785 SecurityTracker Alert ID: 1027784 Bugtraq ID: 56581 Secunia Advisory SA51337 Secunia Advisory SA51351 Splunk Vulnerability Descriptions IMPACT ASSESSMENT: Medium DISCUSSION: Splunk is prone to multiple cross-site scripting vulnerabilities and a denial-of-service vulnerability because it fails to properly handle user-supplied input. An attacker may leverage these issues to cause denial-of-service conditions

119

V-132: IBM Tivoli System Automation Application Manager Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: IBM Tivoli System Automation Application Manager Multiple 2: IBM Tivoli System Automation Application Manager Multiple Vulnerabilities V-132: IBM Tivoli System Automation Application Manager Multiple Vulnerabilities April 12, 2013 - 6:00am Addthis PROBLEM: IBM has acknowledged multiple vulnerabilities in IBM Tivoli System Automation Application Manager PLATFORM: The vulnerabilities are reported in IBM Tivoli System Automation Application Manager versions 3.1, 3.2, 3.2.1, and 3.2.2 ABSTRACT: Multiple security vulnerabilities exist in the IBM Java Runtime Environment component of IBM Tivoli System Automation Application Manager which may affect the product REFERENCE LINKS: Secunia Advisory: SA53006 IBM Security Bulletin 21633991 IBM Security Bulletin 21633992 CVE-2011-3563 CVE-2012-0497 CVE-2012-0498 CVE-2012-0499 CVE-2012-0501

120

V-132: IBM Tivoli System Automation Application Manager Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: IBM Tivoli System Automation Application Manager Multiple 2: IBM Tivoli System Automation Application Manager Multiple Vulnerabilities V-132: IBM Tivoli System Automation Application Manager Multiple Vulnerabilities April 12, 2013 - 6:00am Addthis PROBLEM: IBM has acknowledged multiple vulnerabilities in IBM Tivoli System Automation Application Manager PLATFORM: The vulnerabilities are reported in IBM Tivoli System Automation Application Manager versions 3.1, 3.2, 3.2.1, and 3.2.2 ABSTRACT: Multiple security vulnerabilities exist in the IBM Java Runtime Environment component of IBM Tivoli System Automation Application Manager which may affect the product REFERENCE LINKS: Secunia Advisory: SA53006 IBM Security Bulletin 21633991 IBM Security Bulletin 21633992 CVE-2011-3563 CVE-2012-0497 CVE-2012-0498 CVE-2012-0499 CVE-2012-0501

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


121

U-200: Red Hat Directory Server Information Disclosure Security...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Passwords to Remote Authenticated and Local Users V-041: Red Hat CloudForms Multiple Vulnerabilities T-712: Red Hat Enterprise MRG Grid 2.0 security, bug fix and enhancement update...

122

Multiple Tenure/Tenure-Track Faculty Positions Software Engineering Focus: CyberSecurity and Big Data  

E-Print Network (OSTI)

Multiple Tenure/Tenure-Track Faculty Positions Software Engineering Focus: CyberSecurity and Big to cybersecurity and big data. Outstanding candidates from all areas of software engineering and computer science

Carver, Jeffrey C.

123

Vulnerability Assessment Team (VAT) - Nuclear Engineering Division  

NLE Websites -- All DOE Office Websites (Extended Search)

Vulnerability Assessment Team Vulnerability Assessment Team VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms

124

V-122: IBM Tivoli Application Dependency Discovery Manager Java Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: IBM Tivoli Application Dependency Discovery Manager Java 2: IBM Tivoli Application Dependency Discovery Manager Java Multiple Vulnerabilities V-122: IBM Tivoli Application Dependency Discovery Manager Java Multiple Vulnerabilities March 29, 2013 - 6:00am Addthis PROBLEM: IBM has acknowledged multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager PLATFORM: The vulnerabilities are reported in version 7.2.0.0 through 7.2.1.3 ABSTRACT: Multiple security vulnerabilities exist in the Java Runtime Environments (JREs) that can affect the security of IBM Tivoli Application Dependency Discovery Manager. REFERENCE LINKS: Secunia Advisory SA52829 IBM Security Bulletin 1631786 CVE-2012-1531 CVE-2012-3143 CVE-2012-3216 CVE-2012-4820 CVE-2012-4822 CVE-2012-5069 CVE-2012-5071 CVE-2012-5073 CVE-2012-5075 CVE-2012-5079

125

V-122: IBM Tivoli Application Dependency Discovery Manager Java Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: IBM Tivoli Application Dependency Discovery Manager Java 2: IBM Tivoli Application Dependency Discovery Manager Java Multiple Vulnerabilities V-122: IBM Tivoli Application Dependency Discovery Manager Java Multiple Vulnerabilities March 29, 2013 - 6:00am Addthis PROBLEM: IBM has acknowledged multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager PLATFORM: The vulnerabilities are reported in version 7.2.0.0 through 7.2.1.3 ABSTRACT: Multiple security vulnerabilities exist in the Java Runtime Environments (JREs) that can affect the security of IBM Tivoli Application Dependency Discovery Manager. REFERENCE LINKS: Secunia Advisory SA52829 IBM Security Bulletin 1631786 CVE-2012-1531 CVE-2012-3143 CVE-2012-3216 CVE-2012-4820 CVE-2012-4822 CVE-2012-5069 CVE-2012-5071 CVE-2012-5073 CVE-2012-5075 CVE-2012-5079

126

V-125: Cisco Connected Grid Network Management System Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Cisco Connected Grid Network Management System Multiple 5: Cisco Connected Grid Network Management System Multiple Vulnerabilities V-125: Cisco Connected Grid Network Management System Multiple Vulnerabilities April 3, 2013 - 1:44am Addthis PROBLEM: Cisco Connected Grid Network Management System Multiple Vulnerabilities PLATFORM: Cisco Connected Grid Network Management System 2.x ABSTRACT: Some vulnerabilities have been reported in Cisco Connected Grid Network Management System. REFERENCE LINKS: Cisco Security Notice CVE-2013-1163 Cisco Security Notice CVE-2013-1171 Secunia Advisory SA52834 SecurityTracker Alert ID: 1028374 SecurityTracker Alert ID: 1028373 CVE-2013-1163 CVE-2013-1171 IMPACT ASSESSMENT: Medium DISCUSSION: 1) Certain input related to the element list component is not properly sanitised before being returned to the user. This can be exploited to

127

V-125: Cisco Connected Grid Network Management System Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Cisco Connected Grid Network Management System Multiple 5: Cisco Connected Grid Network Management System Multiple Vulnerabilities V-125: Cisco Connected Grid Network Management System Multiple Vulnerabilities April 3, 2013 - 1:44am Addthis PROBLEM: Cisco Connected Grid Network Management System Multiple Vulnerabilities PLATFORM: Cisco Connected Grid Network Management System 2.x ABSTRACT: Some vulnerabilities have been reported in Cisco Connected Grid Network Management System. REFERENCE LINKS: Cisco Security Notice CVE-2013-1163 Cisco Security Notice CVE-2013-1171 Secunia Advisory SA52834 SecurityTracker Alert ID: 1028374 SecurityTracker Alert ID: 1028373 CVE-2013-1163 CVE-2013-1171 IMPACT ASSESSMENT: Medium DISCUSSION: 1) Certain input related to the element list component is not properly sanitised before being returned to the user. This can be exploited to

128

Public views on multiple dimensions of security : nuclear waepons, terrorism, energy, and the environment : 2007.  

SciTech Connect

We analyze and compare findings from identical national surveys of the US general public on nuclear security and terrorism administered by telephone and Internet in mid-2007. Key areas of investigation include assessments of threats to US security; valuations of US nuclear weapons and nuclear deterrence; perspectives on nuclear proliferation, including the specific cases of North Korea and Iran; and support for investments in nuclear weapons capabilities. Our analysis of public views on terrorism include assessments of the current threat, progress in the struggle against terrorism, preferences for responding to terrorist attacks at different levels of assumed casualties, and support for domestic policies intended to reduce the threat of terrorism. Also we report findings from an Internet survey conducted in mid 2007 that investigates public views of US energy security, to include: energy supplies and reliability; energy vulnerabilities and threats, and relationships among security, costs, energy dependence, alternative sources, and research and investment priorities. We analyze public assessments of nuclear energy risks and benefits, nuclear materials management issues, and preferences for the future of nuclear energy in the US. Additionally, we investigate environmental issues as they relate to energy security, to include expected implications of global climate change, and relationships among environmental issues and potential policy options.

Herron, Kerry Gale (University of Oklahoma, Norman, OK); Jenkins-Smith, Hank C. (University of Oklahoma, Norman, OK)

2008-01-01T23:59:59.000Z

129

T-560: Cisco Security Advisory: Management Center for Cisco Security...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Advisory: Management Center for Cisco Security Agent Remote Code Execution Vulnerability T-560: Cisco Security Advisory: Management Center for Cisco Security Agent Remote Code...

130

Security  

Energy.gov (U.S. Department of Energy (DOE))

Security refers to the security of the stream of principal and interest repayments and what happens in the event that a secured loan defaults.

131

Useful Resources- Vulnerability Assessment Team - Nuclear Engineering  

NLE Websites -- All DOE Office Websites (Extended Search)

Selected Publications Selected Publications VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms Argonne's VAT (brochure)

132

Definitions, Seals - Vulnerability Assessment Team - Nuclear Engineering  

NLE Websites -- All DOE Office Websites (Extended Search)

Definitions Definitions VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms Argonne's VAT (brochure)

133

Safety - Vulnerability Assessment Team - Nuclear Engineering Division  

NLE Websites -- All DOE Office Websites (Extended Search)

Safety Safety VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms Argonne's VAT (brochure)

134

T-614: Cisco Unified Communications Manager Database Security...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Cisco Unified Communications Manager Database Security Vulnerability T-614: Cisco Unified Communications Manager Database Security Vulnerability May 3, 2011 - 7:37am Addthis...

135

Sandia National Laboratories: National Security Missions: Internationa...  

NLE Websites -- All DOE Office Websites (Extended Search)

Global Security casks We reduce proliferation and terrorism threats to U.S. national security through global technical engagement. Enhance security of vulnerable nuclear weapons...

136

T-694: IBM Tivoli Federated Identity Manager Products Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: IBM Tivoli Federated Identity Manager Products Multiple 4: IBM Tivoli Federated Identity Manager Products Multiple Vulnerabilities T-694: IBM Tivoli Federated Identity Manager Products Multiple Vulnerabilities August 16, 2011 - 3:30pm Addthis PROBLEM: Multiple vulnerabilities have been reported in IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway, where some have an unknown impact while one can be exploited by malicious people to cause a DoS (Denial of Service). PLATFORM: IBM Tivoli Federated Identity Manager 6.x, IBM Tivoli Federated Identity Manager Business Gateway 6.x ABSTRACT: This Security Alert addresses a serious security issue CVE-2010-4476 (Java Runtime Environment hangs when converting "2.2250738585072012e-308" to a binary floating-point number). This vulnerability might cause the Java

137

T-694: IBM Tivoli Federated Identity Manager Products Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

94: IBM Tivoli Federated Identity Manager Products Multiple 94: IBM Tivoli Federated Identity Manager Products Multiple Vulnerabilities T-694: IBM Tivoli Federated Identity Manager Products Multiple Vulnerabilities August 16, 2011 - 3:30pm Addthis PROBLEM: Multiple vulnerabilities have been reported in IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway, where some have an unknown impact while one can be exploited by malicious people to cause a DoS (Denial of Service). PLATFORM: IBM Tivoli Federated Identity Manager 6.x, IBM Tivoli Federated Identity Manager Business Gateway 6.x ABSTRACT: This Security Alert addresses a serious security issue CVE-2010-4476 (Java Runtime Environment hangs when converting "2.2250738585072012e-308" to a binary floating-point number). This vulnerability might cause the Java

138

T-536: Cisco ASA Multiple Flaws Let Remote Users Deny Service and Bypass  

NLE Websites -- All DOE Office Websites (Extended Search)

36: Cisco ASA Multiple Flaws Let Remote Users Deny Service and 36: Cisco ASA Multiple Flaws Let Remote Users Deny Service and Bypass Security Controls T-536: Cisco ASA Multiple Flaws Let Remote Users Deny Service and Bypass Security Controls January 18, 2011 - 2:30pm Addthis PROBLEM: Cisco ASA Multiple Flaws Let Remote Users Deny Service and Bypass Security Controls. PLATFORM: Cisco 5500 Series Adaptive Security Appliances (ASA) ABSTRACT: Cisco ASA 5500 Series Adaptive Security Appliances are affected by multiple vulnerabilities. Affected versions of Cisco ASA Software vary depending on the specific vulnerability. Cisco ASA 5500 Series Adaptive Security Appliances may experience a TCP connection exhaustion condition (no new TCP connections are accepted) that can be triggered through the receipt of specific TCP segments during the

139

V-200: Apache Struts DefaultActionMapper Redirection and OGNL Security  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Apache Struts DefaultActionMapper Redirection and OGNL 0: Apache Struts DefaultActionMapper Redirection and OGNL Security Bypass Vulnerabilities V-200: Apache Struts DefaultActionMapper Redirection and OGNL Security Bypass Vulnerabilities July 18, 2013 - 6:00am Addthis PROBLEM: Two weaknesses and multiple vulnerabilities have been reported in Apache Struts PLATFORM: Apache Struts 2.x ABSTRACT: The vulnerabilities can be exploited by malicious people to conduct spoofing attacks and bypass certain security restrictions REFERENCE LINKS: Secunia Advisory SA54118 Apache Security Bulletin S2-16 Apache Security Bulletin S2-17 CVE-2013-2248 CVE-2013-2251 IMPACT ASSESSMENT: High DISCUSSION: 1) Input passed via the "redirect:" and "redirectAction:" prefixing parameters is not properly verified in the DefaultActionMapper class

140

Chemical-Terrorism Vulnerability Information Guidance Document January 7, 2011  

E-Print Network (OSTI)

.215; Not currently applicable (2) Site Security Plans under §27.225; Not currently applicable (3) Documents relating to the Department's review and approval of Security Vulnerability Assessments and Site Security Plans, including

Pawlowski, Wojtek

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


141

Intrusion Detecting Using Secure Signatures - Energy Innovation...  

NLE Websites -- All DOE Office Websites (Extended Search)

notice, patches, or a description of how to detect the security vulnerability, that may grant computer crackers information on the dangerous vulnerability. (DOE Case S-119,457)....

142

Energy vulnerability relationships  

SciTech Connect

The US consumption of crude oil resources has been a steadily growing indicator of the vitality and strength of the US economy. At the same time import diversity has also been a rapidly developing dimension of the import picture. In the early 1970`s, embargoes of crude oil from Organization of Producing and Exporting Countries (OPEC) created economic and political havoc due to a significant lack of diversity and a unique set of economic, political and domestic regulatory circumstances. The continued rise of imports has again led to concerns over the security of our crude oil resource but threats to this system must be considered in light of the diversity and current setting of imported oil. This report develops several important issues concerning vulnerability to the disruption of oil imports: (1) The Middle East is not the major supplier of oil to the United States, (2) The US is not vulnerable to having its entire import stream disrupted, (3) Even in stable countries, there exist vulnerabilities to disruption of the export stream of oil, (4) Vulnerability reduction requires a focus on international solutions, and (5) DOE program and policy development must reflect the requirements of the diverse supply. Does this increasing proportion of imported oil create a {open_quotes}dependence{close_quotes}? Does this increasing proportion of imported oil present a vulnerability to {open_quotes}price shocks{close_quotes} and the tremendous dislocations experienced during the 1970`s? Finally, what is the vulnerability of supply disruptions from the current sources of imported oil? If oil is considered to be a finite, rapidly depleting resource, then the answers to these questions must be {open_quotes}yes.{close_quotes} However, if the supply of oil is expanding, and not limited, then dependence is relative to regional supply sources.

Shaw, B.R.; Boesen, J.L.

1998-02-01T23:59:59.000Z

143

V-205: IBM Tivoli System Automation for Multiplatforms Java Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

V-205: IBM Tivoli System Automation for Multiplatforms Java V-205: IBM Tivoli System Automation for Multiplatforms Java Multiple Vulnerabilities V-205: IBM Tivoli System Automation for Multiplatforms Java Multiple Vulnerabilities July 29, 2013 - 4:20am Addthis PROBLEM: IBM has acknowledged a weakness and multiple vulnerabilities in IBM Tivoli System Automation for Multiplatforms, which can be exploited by malicious, local users to disclose certain sensitive information and gain escalated privileges and by malicious people to disclose certain sensitive information, manipulate certain data, bypass certain security restrictions, cause a DoS (Denial of Service), and compromise a vulnerable system. PLATFORM: The weakness and the vulnerabilities are reported in versions 3.1 through 3.2.2 running on AIX, Linux, Solaris, and Windows.

144

V-230: IBM TRIRIGA Application Platform Multiple Cross-Site Scripting  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: IBM TRIRIGA Application Platform Multiple Cross-Site 0: IBM TRIRIGA Application Platform Multiple Cross-Site Scripting Vulnerabilities V-230: IBM TRIRIGA Application Platform Multiple Cross-Site Scripting Vulnerabilities August 29, 2013 - 4:10am Addthis PROBLEM: Multiple vulnerabilities have been reported in IBM TRIRIGA Application Platform, which can be exploited by malicious people to conduct cross-site scripting attacks. PLATFORM: IBM TRIRIGA Application Platform 2.x ABSTRACT: The vulnerabilities are reported in versions 2.1, 2.5, 2.6, and 2.7. REFERENCE LINKS: Secunia Advisory SA54641 CVE-2013-4003 IBM Security Bulletin IMPACT ASSESSMENT: Low DISCUSSION: Multiple vulnerabilities have been reported in IBM TRIRIGA Application Platform, which can be exploited by malicious people to conduct cross-site scripting attacks.

145

T-527: OpenSC Smart Card Serial Number Multiple Buffer Overflow  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: OpenSC Smart Card Serial Number Multiple Buffer Overflow 7: OpenSC Smart Card Serial Number Multiple Buffer Overflow Vulnerabilities T-527: OpenSC Smart Card Serial Number Multiple Buffer Overflow Vulnerabilities January 4, 2011 - 5:52pm Addthis PROBLEM: OpenSC Smart Card Serial Number Multiple Buffer Overflow Vulnerabilities PLATFORM: Vulnerable Platform: OpenSC 0.11.13 ABSTRACT: OpenSC is prone to multiple buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied input. Attackers may leverage these issues to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions. reference LINKS: SecurityFocus - OpenSC Smart Card Serial CVE-2010-4523 OpenSC: Three stack-based buffer overflows CVE-2010-4523 - Three stack-based buffer overflows

146

V-135: Cisco ASA Multiple Bugs Let Remote Users Deny Service | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Cisco ASA Multiple Bugs Let Remote Users Deny Service 5: Cisco ASA Multiple Bugs Let Remote Users Deny Service V-135: Cisco ASA Multiple Bugs Let Remote Users Deny Service April 16, 2013 - 12:21am Addthis PROBLEM: Cisco ASA Multiple Bugs Let Remote Users Deny Service PLATFORM: Cisco ASA Software for Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, and Cisco ASA 1000V Cloud Firewall are affected by multiple vulnerabilities. Affected versions of Cisco ASA Software will vary depending on the specific vulnerability. ABSTRACT: Several vulnerabilities were reported in Cisco ASA. REFERENCE LINKS: Cisco Security Advisory Secunia Advisory SA52989 SecurityTracker Alert ID: 1028415 CVE-2013-1149 CVE-2013-1150 CVE-2013-1151 CVE-2013-1152

147

GAO-07-1036, CRITICAL INFRASTRUCTURE PROTECTION: Multiple Efforts to Secure Control Systems Are Under Way, but Challenges Remain  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Congressional Requesters Congressional Requesters CRITICAL INFRASTRUCTURE PROTECTION Multiple Efforts to Secure Control Systems Are Under Way, but Challenges Remain September 2007 GAO-07-1036 What GAO Found United States Government Accountability Office Why GAO Did This Study Highlights Accountability Integrity Reliability September 2007 CRITICAL INFRASTRUCTURE PROTECTION Multiple Efforts to Secure Control Systems Are Under Way, but Challenges Remain Highlights of GAO-07-1036, a report to congressional requesters Control systems-computer-based systems that monitor and control sensitive processes and physical functions-perform vital functions in many of our nation's critical infrastructures, including electric power, oil and gas, water treatment, and chemical production. The disruption of

148

U-106: Citrix XenServer Multiple Flaws in Web Self Service Have Unspecified  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Citrix XenServer Multiple Flaws in Web Self Service Have 6: Citrix XenServer Multiple Flaws in Web Self Service Have Unspecified Impact U-106: Citrix XenServer Multiple Flaws in Web Self Service Have Unspecified Impact February 17, 2012 - 8:30am Addthis PROBLEM: Multiple vulnerabilities were reported in Citrix XenServer Web Self Service. PLATFORM: Version(s): 5.5, 5.6 SP2, 6.0; Web Self Service prior to 1.1.1 ABSTRACT: A number of security vulnerabilities have been identified in the management web interface of Citrix XenServer Web Self Service. reference LINKS: Citrix Support Center SecurityTracker Alert ID:1026695 IMPACT ASSESSMENT: Medium Discussion: Customers who have installed XenServer but have not additionally downloaded and installed the optional Web Self Service component are not affected by these vulnerabilities. These vulnerabilities affect all currently supported

149

T-560: Cisco Security Advisory: Management Center for Cisco Security Agent  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Cisco Security Advisory: Management Center for Cisco 0: Cisco Security Advisory: Management Center for Cisco Security Agent Remote Code Execution Vulnerability T-560: Cisco Security Advisory: Management Center for Cisco Security Agent Remote Code Execution Vulnerability February 18, 2011 - 7:00am Addthis PROBLEM: Cisco Security Advisory: Management Center for Cisco Security Agent Remote Code Execution Vulnerability. PLATFORM: Cisco Security Agent software releases 5.1, 5.2, and 6.0 are affected by this vulnerability. Note: Only the Management Center for Cisco Security Agent is affected by this vulnerability. Cisco Security Agent installations on end-point workstations or servers are not affected by this vulnerability. ABSTRACT: The Management Center for Cisco Security Agent is affected by a vulnerability that may allow an unauthenticated attacker to perform remote

150

V-020: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

20: Apple QuickTime Multiple Flaws Let Remote Users Execute 20: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary Code V-020: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary Code November 9, 2012 - 6:00am Addthis PROBLEM: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Versions prior to QuickTime 7.7.3 are vulnerable on Windows 7, Vista and XP. ABSTRACT: Multiple vulnerabilities were reported in Apple QuickTime. REFERENCE LINKS: Apple Security Article: HT5581 SecurityTracker Alert ID: 1027737 Bugtraq ID: 56438 Secunia Advisory SA51226 CVE-2011-1374 CVE-2012-3751 CVE-2012-3752 CVE-2012-3753 CVE-2012-3754 CVE-2012-3755 CVE-2012-3756 CVE-2012-3757 CVE-2012-3758 IMPACT ASSESSMENT: High DISCUSSION: Multiple vulnerabilities have been reported in Apple QuickTime, which can

151

A Method for Estimating the Financial Impact of Cyber Information Security Breaches Utilizing the Common Vulnerability Scoring System and Annual Loss Expectancy  

E-Print Network (OSTI)

0.900 Functional (F) F 0.950 High (H) H 1.000 Remediation Level (T_RL) Official Fix (OF) OF 0.870 Temporary Fix (TF) TF 0.900 Workaround (W) W 0.950 Unavailable (U) U 1.000 Report Confidence (T_RC) Unconfirmed (UC) UC 0.900 Uncorroborated (UR) UR 0... is theoretical. Remediation Level (T_RL) Metric to describe the currently available mitigation options. Report Confidence (T_RC) Metric to describe the degree of confidence in the reported vulnerability. Often, vulnerabilities are announced sans...

Lindsey, Michael B.

2010-05-14T23:59:59.000Z

152

INFORMATION SECURITY University Policy No: IM7800  

E-Print Network (OSTI)

Page 1 INFORMATION SECURITY POLICY University Policy No: IM7800 Classification: Information to an Information Security Incident Procedures for Addressing Security Vulnerabilities of University Information Resources and Information Systems University Information Security Classification Procedures Procedures

Herwig, Falk

153

New Seals - Vulnerability Assessment Team - Nuclear Engineering Division  

NLE Websites -- All DOE Office Websites (Extended Search)

More Information More Information VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms Argonne's VAT (brochure)

154

Insanely Fast Microprocessor Shop - Vulnerability Assessment Team - Nuclear  

NLE Websites -- All DOE Office Websites (Extended Search)

Insanely Fast Microprocessor Shop Insanely Fast Microprocessor Shop VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms

155

About Seals - Vulnerability Assessment Team - Nuclear Engineering Division  

NLE Websites -- All DOE Office Websites (Extended Search)

Seals Seals VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms Argonne's VAT (brochure)

156

Findings and Lessons, Seals - Vulnerability Assessment Team - Nuclear  

NLE Websites -- All DOE Office Websites (Extended Search)

Findings and Lessons Learned Findings and Lessons Learned VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms

157

Current Projects: Product Authenticity Tags - Vulnerability Assessment Team  

NLE Websites -- All DOE Office Websites (Extended Search)

Product Authenticity Tags Product Authenticity Tags VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms Argonne's VAT (brochure)

158

Common Myths about Tamper Indicating Seals - Vulnerability Assessment Team  

NLE Websites -- All DOE Office Websites (Extended Search)

Common Myths about Tamper Common Myths about Tamper Indicating Seals VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned New Seals Types of Seals Seals References Selected VAT Papers Selected VAT Papers Selected Invited Talks Self-Assessment Survey Security Maxims Devil's Dictionary of Security Terms

159

V-192: Symantec Security Information Manager Input Validation Flaws Permit  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

92: Symantec Security Information Manager Input Validation Flaws 92: Symantec Security Information Manager Input Validation Flaws Permit Cross-Site Scripting, SQL Injection, and Information Disclosure Attacks V-192: Symantec Security Information Manager Input Validation Flaws Permit Cross-Site Scripting, SQL Injection, and Information Disclosure Attacks July 4, 2013 - 6:00am Addthis PROBLEM: Several vulnerabilities were reported in Symantec Security Information Manager PLATFORM: Symantec Security Information Manager Appliance Version 4.7.x and 4.8.0 ABSTRACT: Symantec was notified of multiple security issues impacting the SSIM management console REFERENCE LINKS: SecurityTracker Alert ID: 1028727 Symantec Security Advisory SYM13-006 CVE-2013-1613 CVE-2013-1614 CVE-2013-1615 IMPACT ASSESSMENT: Medium DISCUSSION: The console does not properly filter HTML code from user-supplied input

160

U-196: Cisco AnyConnect VPN Client Two Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Cisco AnyConnect VPN Client Two Vulnerabilities 6: Cisco AnyConnect VPN Client Two Vulnerabilities U-196: Cisco AnyConnect VPN Client Two Vulnerabilities June 21, 2012 - 7:00am Addthis PROBLEM: Two vulnerabilities have been reported in Cisco AnyConnect VPN Client, which can be exploited by malicious people to compromise a user's system. PLATFORM: Cisco AnyConnect VPN Client 2.x Cisco AnyConnect VPN Client 3.x ABSTRACT: The Cisco AnyConnect Secure Mobility Client is affected by the following vulnerabilities: Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerability Cisco AnyConnect Secure Mobility Client VPN Downloader Software Downgrade Vulnerability Cisco AnyConnect Secure Mobility Client and Cisco Secure Desktop HostScan Downloader Software Downgrade Vulnerability Cisco AnyConnect Secure Mobility Client 64-bit Java VPN Downloader

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


161

SP 800-40 Version 2.0. Creating a Patch and Vulnerability Management Program  

Science Journals Connector (OSTI)

This document provides guidance on creating a security patch and vulnerability management program and testing the effectiveness of that program. The primary audience is security managers who are responsible for designing and implementing the program. ... Keywords: Computer security, security patches, vulnerability management

Peter M. Mell; Tiffany Bergeron; David Henning

2005-11-01T23:59:59.000Z

162

Rapid Sampling from Sealed Containers - Vulnerability Assessment Team -  

NLE Websites -- All DOE Office Websites (Extended Search)

Nonproliferation and Nonproliferation and National Security > VAT > Current Projects > Rapid Sampling Tools > ... from Sealed Containers VAT Projects Introducing the VAT Adversarial Vulnerability Assessments Safety Tags & Product Counterfeiting Election Security Spoofing GPS Defeating Existing Tamper-Indicating Seals Specialty Field Tools & Sampling Tools Tamper & Intrusion Detection Rapid Sampling from Sealed Containers Demo video Insider Threat Mitigation Drug Testing Security Microprocessor Prototypes The Journal of Physical Security Vulnerability Assessments Vulnerability Assessments Insanely Fast µProcessor Shop Insanely Fast µProcessor Shop Seals About Seals Applications of Seals Common Myths about Tamper Indicating Seals Definitions Findings and Lessons Learned

163

Are Vulnerability Disclosure Deadlines Justified?  

SciTech Connect

Vulnerability research organizations Rapid7, Google Security team, and Zero Day Initiative recently imposed grace periods for public disclosure of vulnerabilities. The grace periods ranged from 45 to 182 days, after which disclosure might occur with or without an effective mitigation from the affected software vendor. At this time there is indirect evidence that the shorter grace periods of 45 and 60 days may not be practical. However, there is strong evidence that the recently announced Zero Day Initiative grace period of 182 days yields benefit in speeding up the patch creation process, and may be practical for many software products. Unfortunately, there is also evidence that the 182 day grace period results in more vulnerability announcements without an available patch.

Miles McQueen; Jason L. Wright; Lawrence Wellman

2011-09-01T23:59:59.000Z

164

T-674: Drupal Secure Password Hashes Module Security Bypass Vulnerabil...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

or later. Addthis Related Articles V-052: Drupal Core Access Bypass and Arbitrary PHP Code Execution Vulnerabilities V-216: Drupal Monster Menus Module Security Bypass and...

165

David Telles wins NNSA Security  

NLE Websites -- All DOE Office Websites (Extended Search)

who conduct vulnerability analyses, authored the LANL Site Safeguards and Security Plan, and administered the Lab's Performance Assurance Program. Under his leadership,...

166

V-203: HP LoadRunner Multiple Bugs Let Remote Users Deny Service and  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: HP LoadRunner Multiple Bugs Let Remote Users Deny Service 3: HP LoadRunner Multiple Bugs Let Remote Users Deny Service and Execute Arbitrary Code V-203: HP LoadRunner Multiple Bugs Let Remote Users Deny Service and Execute Arbitrary Code July 26, 2013 - 3:31am Addthis PROBLEM: A remote user can execute arbitrary code on the target system. A remote user can cause denial of service conditions. PLATFORM: HP LoadRunner prior to 11.52 ABSTRACT: Multiple vulnerabilities were reported in HP LoadRunner. REFERENCE LINKS: Security Tracker Alert ID: 1028833 CVE-2013-2368 CVE-2013-2369 CVE-2013-2370 CVE-2013-4797 CVE-2013-4798 CVE-2013-4799 CVE-2013-4800 CVE-2013-4801 IMPACT ASSESSMENT: Medium DISCUSSION: Potential security vulnerabilities have been identified with HP LoadRunner. The vulnerabilities could be remotely exploited to allow execution of code

167

T-694: IBM Tivoli Federated Identity Manager Products Multiple...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

T-694: IBM Tivoli Federated Identity Manager Products Multiple Vulnerabilities T-694: IBM Tivoli Federated Identity Manager Products Multiple Vulnerabilities August 16, 2011 -...

168

V-205: IBM Tivoli System Automation for Multiplatforms Java Multiple...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: IBM Tivoli System Automation for Multiplatforms Java Multiple Vulnerabilities V-205: IBM Tivoli System Automation for Multiplatforms Java Multiple Vulnerabilities July 29, 2013...

169

V-132: IBM Tivoli System Automation Application Manager Multiple...  

Energy Savers (EERE)

32: IBM Tivoli System Automation Application Manager Multiple Vulnerabilities V-132: IBM Tivoli System Automation Application Manager Multiple Vulnerabilities April 12, 2013 -...

170

V-186: Drupal Login Security Module Security Bypass and Denial of Service  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Drupal Login Security Module Security Bypass and Denial of 6: Drupal Login Security Module Security Bypass and Denial of Service Vulnerability V-186: Drupal Login Security Module Security Bypass and Denial of Service Vulnerability June 26, 2013 - 1:28am Addthis PROBLEM: Drupal Login Security Module Security Bypass and Denial of Service Vulnerability PLATFORM: Login Security 6.x-1.x versions prior to 6.x-1.2. Login Security 7.x-1.x versions prior to 7.x-1.2. ABSTRACT: A security issue and a vulnerability have been reported in the Login Security module for Drupal REFERENCE LINKS: Advisory ID: DRUPAL-SA-CONTRIB-2013-053 Secunia Advisory SA53717 CVE-2013-2197 CVE-2013-2198 IMPACT ASSESSMENT: Medium DISCUSSION: 1) The security issue is caused due to an unspecified error and can be exploited to bypass the module features. Successful exploitation requires the "soft blocking" feature to be

171

Guide to Critical Infrastructure Protection Cyber Vulnerability Assessment  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Guide to Critical Infrastructure Protection Cyber Vulnerability Guide to Critical Infrastructure Protection Cyber Vulnerability Assessment Guide to Critical Infrastructure Protection Cyber Vulnerability Assessment This document describes a customized process for cyber vulnerability assessment in compliance with the Critical Infrastructure Protection standards adopted by the North American Electric Reliability Corporation in 2006. This guide covers the planning, execution, and reporting process. Guide to Critical Infrastructure Protection Cyber Vulnerability Assessment More Documents & Publications Wireless System Considerations When Implementing NERC Critical Infrastructure Protection Standards New No-Cost ANTFARM Tool Maps Control System Networks to Help Implement Cyber Security Standards "Cybersecurity for State Regulators" - NARUC Primer (June 2012)

172

Guide to Critical Infrastructure Protection Cyber Vulnerability Assessment  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Guide to Critical Infrastructure Protection Cyber Vulnerability Guide to Critical Infrastructure Protection Cyber Vulnerability Assessment Guide to Critical Infrastructure Protection Cyber Vulnerability Assessment This document describes a customized process for cyber vulnerability assessment in compliance with the Critical Infrastructure Protection standards adopted by the North American Electric Reliability Corporation in 2006. This guide covers the planning, execution, and reporting process. Guide to Critical Infrastructure Protection Cyber Vulnerability Assessment More Documents & Publications Wireless System Considerations When Implementing NERC Critical Infrastructure Protection Standards New No-Cost ANTFARM Tool Maps Control System Networks to Help Implement Cyber Security Standards "Cybersecurity for State Regulators" - NARUC Primer (June

173

V-234: EMC RSA Archer GRC Open Redirection Weakness and Security Bypass  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: EMC RSA Archer GRC Open Redirection Weakness and Security 4: EMC RSA Archer GRC Open Redirection Weakness and Security Bypass Security Issue V-234: EMC RSA Archer GRC Open Redirection Weakness and Security Bypass Security Issue September 4, 2013 - 6:00am Addthis PROBLEM: A weakness and a security issue have been reported in EMC RSA Archer GRC PLATFORM: EMC RSA Archer GRC 5.x ABSTRACT: This fixes multiple vulnerabilities, which can be exploited to bypass certain security restrictions and to conduct spoofing attacks REFERENCE LINKS: Secunia Advisory SA54717 SecurityTracker Alert ID 1028971 EMC Identifier: ESA-2013-057 CVE-2013-3276 CVE-2013-3277 IMPACT ASSESSMENT: Medium DISCUSSION: 1) The application does not properly restrict deactivated users. This can be exploited by deactivated users to login and gain access to otherwise

174

U-251: Bugzilla LDAP Injection and Information Disclosure Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Bugzilla LDAP Injection and Information Disclosure 1: Bugzilla LDAP Injection and Information Disclosure Vulnerabilities U-251: Bugzilla LDAP Injection and Information Disclosure Vulnerabilities September 5, 2012 - 6:00am Addthis PROBLEM: Bugzilla LDAP Injection and Information Disclosure Vulnerabilities PLATFORM: Bugzilla 2.x Bugzilla 3.x Bugzilla 4.x ABSTRACT: Bugzilla is prone to an LDAP-injection vulnerability and an information-disclosure vulnerability reference LINKS: Bugzilla Homepage Bugzilla Security Advisory Bugtraq ID: 55349 Secunia Advisory SA50433 CVE-2012-3981 CVE-2012-4747 IMPACT ASSESSMENT: Medium Discussion: A vulnerability and a security issue have been reported, which can be exploited by malicious people to disclose potentially sensitive information and manipulate certain data. 1) Input passed via the username is not properly escaped before being used

175

T-578: Vulnerability in MHTML Could Allow Information Disclosure |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: Vulnerability in MHTML Could Allow Information Disclosure 8: Vulnerability in MHTML Could Allow Information Disclosure T-578: Vulnerability in MHTML Could Allow Information Disclosure March 15, 2011 - 3:05pm Addthis PROBLEM: Microsoft Windows is prone to a vulnerability that may allow attackers to inject arbitrary script code into the current browser session. PLATFORM: Windows 2003 SP2, Vista SP2, 2008 SP2, XP SP3, 7; and prior service packs ABSTRACT: A vulnerability was reported in Microsoft MHTML. A remote user can conduct cross-site scripting attacks. reference LINKS: Microsoft Security Advisory (2501696) CVE-2011-0096 SecurityTracker Alert ID: 1025003 Bugtraq ID: 46055 IMPACT ASSESSMENT: Moderate Discussion: The vulnerability exists due to the way MHTML interprets MIME-formatted requests for content blocks within a document. It is possible under certain

176

V-123: VMware ESX / ESXi libxml2 Buffer Underflow Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: VMware ESX / ESXi libxml2 Buffer Underflow Vulnerability 3: VMware ESX / ESXi libxml2 Buffer Underflow Vulnerability V-123: VMware ESX / ESXi libxml2 Buffer Underflow Vulnerability April 1, 2013 - 1:26am Addthis PROBLEM: VMware ESX / ESXi libxml2 Buffer Underflow Vulnerability PLATFORM: VMware ESX Server 4.x VMware ESXi 4.x VMware ESXi 5.x ABSTRACT: A vulnerability has been reported in VMware ESX and ESXi REFERENCE LINKS: VMware ESXi security update Secunia Advisory SA52844 CVE-2012-5134 IMPACT ASSESSMENT: High DISCUSSION: The ESXi userworld libxml2 library has been updated to resolve a security issue IMPACT: VMware ESX and ESXi can be exploited by malicious people to compromise a vulnerable system SOLUTION: The vendor has issued a fix, VMware ESXi 5.0, Patch Release ESXi500-201303001 (2044373) Addthis Related Articles U-128: VMware ESX/ESXi Buffer Overflow and Null Pointer Dereference Lets

177

Attacking Systems ecurity vulnerabilities related to buffer overruns  

E-Print Network (OSTI)

Attacking Systems S ecurity vulnerabilities related to buffer overruns account for the largest exploits that take ad- vantage of the vulnerability to attack a system. The traditional approach and even security profession- als seemingly assume that all buffer overrun exploits operate in a similar

Sekar, R.

178

Automatic Discovery of API-Level Vulnerabilities Vinod Ganapathy  

E-Print Network (OSTI)

Automatic Discovery of API-Level Vulnerabilities Vinod Ganapathy , Sanjit A. Seshia , Somesh Jha-MADISON COMPUTER SCIENCES TECHNICAL REPORT: UW-CS-TR-1512, JULY 2004. Abstract A system is vulnerable to an API-level attack if its security can be compromised by invoking an allowed sequence of operations from its API. We

Ganapathy, Vinod

179

T-616: PHP Stream Component Remote Denial of Service Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: PHP Stream Component Remote Denial of Service Vulnerability 6: PHP Stream Component Remote Denial of Service Vulnerability T-616: PHP Stream Component Remote Denial of Service Vulnerability May 5, 2011 - 12:59am Addthis PROBLEM: PHP Stream Component Remote Denial of Service Vulnerability PLATFORM: Ubuntu Linux PHP MandrakeSoft Corporate Server MandrakeSoft Enterprise Server MandrakeSoft Linux Mandrake ABSTRACT: PHP is prone to a remote denial-of-service vulnerability because the proxy server fails to handle certain FTP requests. An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Versions prior to PHP 5.3.6 are vulnerable. reference LINKS: SecurityFocus IMPACT ASSESSMENT: Medium Discussion: PHP is prone to a remote denial-of-service vulnerability because the proxy server fails to handle certain FTP requests. An attacker can exploit this

180

T-564: Vulnerabilities in Citrix Licensing administration components |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Vulnerabilities in Citrix Licensing administration 4: Vulnerabilities in Citrix Licensing administration components T-564: Vulnerabilities in Citrix Licensing administration components February 24, 2011 - 7:00am Addthis PROBLEM: Vulnerabilities in Citrix Licensing administration components. PLATFORM: Citrix Licensing Administration Console, formerly known as the License Management Console. ABSTRACT: The vulnerabilities impact all current versions of the Citrix Licensing Administration Console, formerly known as the License Management Console. reference LINKS: Citrix ID:CTX128167 SecurityTracker Alert ID:1025123 Citrix Support IMPACT ASSESSMENT: Medium Discussion: Citrix has been made aware of a number of vulnerabilities in a third-party component that is used by the Citrix Licensing administration console. These vulnerabilities could potentially allow an unauthorized user to gain

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


181

T-574: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

74: Google Chrome Multiple Flaws Let Remote Users Execute 74: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code T-574: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code March 10, 2011 - 3:05pm Addthis PROBLEM: Multiple vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can bypass the pop-up blocker. PLATFORM: Google Chrome prior to 10.0.648.127 ABSTRACT: Multiple vulnerabilities have been reported in Google Chrome, where some have an unknown impact while others can be exploited by malicious people bypass certain security restrictions, disclose system information, and compromise a user's system. reference LINKS: Secunia Advisory: SA43683 Google Chrome Support Chrome Stable Release SecurityTracker Alert ID:1025181

182

NNSA: Securing Domestic Radioactive Material | National Nuclear...  

National Nuclear Security Administration (NNSA)

2011 In April 2009, President Obama outlined an ambitious agenda to secure vulnerable nuclear material around the world within four years, calling the danger of a terrorist...

183

GTRI: Removing Vulnerable Civilian Nuclear and Radiological Material |  

National Nuclear Security Administration (NNSA)

Removing Vulnerable Civilian Nuclear and Radiological Material | Removing Vulnerable Civilian Nuclear and Radiological Material | National Nuclear Security Administration Our Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response Recapitalizing Our Infrastructure Continuing Management Reform Countering Nuclear Terrorism About Us Our Programs Our History Who We Are Our Leadership Our Locations Budget Our Operations Media Room Congressional Testimony Fact Sheets Newsletters Press Releases Speeches Events Social Media Video Gallery Photo Gallery NNSA Archive Federal Employment Apply for Our Jobs Our Jobs Working at NNSA Blog Home > Media Room > Fact Sheets > GTRI: Removing Vulnerable Civilian Nuclear and Radiological Material Fact Sheet GTRI: Removing Vulnerable Civilian Nuclear and Radiological Material

184

GTRI: Removing Vulnerable Civilian Nuclear and Radiological Material |  

NLE Websites -- All DOE Office Websites (Extended Search)

Removing Vulnerable Civilian Nuclear and Radiological Material | Removing Vulnerable Civilian Nuclear and Radiological Material | National Nuclear Security Administration Our Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response Recapitalizing Our Infrastructure Continuing Management Reform Countering Nuclear Terrorism About Us Our Programs Our History Who We Are Our Leadership Our Locations Budget Our Operations Media Room Congressional Testimony Fact Sheets Newsletters Press Releases Speeches Events Social Media Video Gallery Photo Gallery NNSA Archive Federal Employment Apply for Our Jobs Our Jobs Working at NNSA Blog Home > Media Room > Fact Sheets > GTRI: Removing Vulnerable Civilian Nuclear and Radiological Material Fact Sheet GTRI: Removing Vulnerable Civilian Nuclear and Radiological Material

185

T-731:Symantec IM Manager Code Injection Vulnerability | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

T-731:Symantec IM Manager Code Injection Vulnerability T-731:Symantec IM Manager Code Injection Vulnerability T-731:Symantec IM Manager Code Injection Vulnerability September 30, 2011 - 8:30am Addthis PROBLEM: Symantec IM Manager Code Injection Vulnerability. PLATFORM: IM Manager versions prior to 8.4.18 are affected. ABSTRACT: Symantec IM Manager is prone to a vulnerability that will let attackers run arbitrary code. referecnce LINKS: Symantec Security Advisory SYM11-012 Symantec Security Updates Bugtraq ID: 49742 IMPACT ASSESSMENT: High Discussion: Symantec was notified of Cross-Site Scripting and Code injection/execution issues present in the Symantec IM Manager management console. The management console fails to properly filter/validate external inputs. Successful exploitation of SQL Injection or Remote Code execution might

186

Analyses Of Two End-User Software Vulnerability Exposure Metrics  

SciTech Connect

The risk due to software vulnerabilities will not be completely resolved in the near future. Instead, putting reliable vulnerability measures into the hands of end-users so that informed decisions can be made regarding the relative security exposure incurred by choosing one software package over another is of importance. To that end, we propose two new security metrics, average active vulnerabilities (AAV) and vulnerability free days (VFD). These metrics capture both the speed with which new vulnerabilities are reported to vendors and the rate at which software vendors fix them. We then examine how the metrics are computed using currently available datasets and demonstrate their estimation in a simulation experiment using four different browsers as a case study. Finally, we discuss how the metrics may be used by the various stakeholders of software and to software usage decisions.

Jason L. Wright; Miles McQueen; Lawrence Wellman

2012-08-01T23:59:59.000Z

187

T-528: Mozilla Firefox/Thunderbird/SeaMonkey Multiple HTML Injection...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

28: Mozilla FirefoxThunderbirdSeaMonkey Multiple HTML Injection Vulnerabilities T-528: Mozilla FirefoxThunderbirdSeaMonkey Multiple HTML Injection Vulnerabilities January 5,...

188

V-099: Honeywell Multiple Products ActiveX Control Remote Code...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

9: Honeywell Multiple Products ActiveX Control Remote Code Execution Vulnerability V-099: Honeywell Multiple Products ActiveX Control Remote Code Execution Vulnerability February...

189

V-037: Wireshark Multiple Bugs Let Remote Users Deny Service | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Wireshark Multiple Bugs Let Remote Users Deny Service 7: Wireshark Multiple Bugs Let Remote Users Deny Service V-037: Wireshark Multiple Bugs Let Remote Users Deny Service November 30, 2012 - 3:30am Addthis PROBLEM: Wireshark Multiple Bugs Let Remote Users Deny Service PLATFORM: Version(s): prior to 1.6.12, 1.8.4 ABSTRACT: Several vulnerabilities were reported in Wireshark. REFERENCE LINKS: Wireshark Security Advisories Secunia Advisory SA51422 Seclists SecurityTracker Alert ID: 1027822 CVE-2012-5592 CVE-2012-5593 CVE-2012-5594 CVE-2012-5595 CVE-2012-5596 CVE-2012-5597 CVE-2012-5598 CVE-2012-5599 CVE-2012-5600 CVE-2012-5601 CVE-2012-5602 IMPACT ASSESSMENT: Medium DISCUSSION: Several vulnerabilities were reported in Wireshark. A remote user can cause denial of service conditions. A user can obtain potentially sensitive information.

190

Sandia National Laboratories: Water Security Program  

NLE Websites -- All DOE Office Websites (Extended Search)

Program Water Security Program Water Security CustomersPartners Awards Key Publications Staff Biographies Water Security In many areas of the United States and multiple regions of...

191

U-122 Google Chrome Two Code Execution Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2 Google Chrome Two Code Execution Vulnerabilities 2 Google Chrome Two Code Execution Vulnerabilities U-122 Google Chrome Two Code Execution Vulnerabilities March 12, 2012 - 7:00am Addthis PROBLEM: Google Chrome Two Code Execution Vulnerabilities PLATFORM: Google Chrome 17.x ABSTRACT: Two vulnerabilities have been reported in Google Chrome, which can be exploited by malicious people to compromise a user's system. reference LINKS: Secunia Advisory SA48321 SecurityTracker Alert ID: 1026776 CVE-2011-3046 IMPACT ASSESSMENT: High Discussion: A vulnerability was reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can create specially crafted HTML that, when loaded by the target user, will trigger an unspecified flaw and execute arbitrary code (outside of the

192

V-062: Asterisk Two Denial of Service Vulnerabilities | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Asterisk Two Denial of Service Vulnerabilities 2: Asterisk Two Denial of Service Vulnerabilities V-062: Asterisk Two Denial of Service Vulnerabilities January 4, 2013 - 6:00am Addthis PROBLEM: Asterisk Two Denial of Service Vulnerabilities PLATFORM: The vulnerabilities are reported in versions 1.8.x, 10.x, and 11.x. ABSTRACT: Two vulnerabilities have been reported in Asterisk, which can be exploited by malicious users and malicious people to cause a DoS (Denial of Service). REFERENCE LINKS: Secunia Advisory SA51689 Asterisk Project Security Advisories CVE-2012-5976 CVE-2012-5977 IMPACT ASSESSMENT: Medium DISCUSSION: A remote user can send specially crafted data to consume excessive resources on the target system. Systems configured to allow anonymous calls are affected. A remote authenticated user can also exploit this via

193

U-246: Tigase XMPP Dialback Protection Bypass Vulnerability | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Tigase XMPP Dialback Protection Bypass Vulnerability 6: Tigase XMPP Dialback Protection Bypass Vulnerability U-246: Tigase XMPP Dialback Protection Bypass Vulnerability August 28, 2012 - 7:00am Addthis PROBLEM: Tigase XMPP Dialback Protection Bypass Vulnerability PLATFORM: Tigase 5.x ABSTRACT: A vulnerability has been reported in Tigase, which can be exploited by malicious people to bypass certain security restrictions. reference LINKS: XMPP Standards Foundation Secunia Advisory SA50362 tigase.org CVE-2012-4670 IMPACT ASSESSMENT: Medium Discussion: The vulnerability is caused due to an error within the XMPP protocol implementation, which does not properly verify the "Verify Response" and "Authorization Response" messages. This can be exploited to spoof a domain and bypass the Dialback protection.

194

T-730: Vulnerability in Citrix Provisioning Services could result in  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

730: Vulnerability in Citrix Provisioning Services could result 730: Vulnerability in Citrix Provisioning Services could result in Arbitrary Code Execution T-730: Vulnerability in Citrix Provisioning Services could result in Arbitrary Code Execution September 29, 2011 - 8:30am Addthis PROBLEM: Vulnerability in Citrix Provisioning Services could result in Arbitrary Code Execution. PLATFORM: This vulnerability is present in all supported versions of Citrix Provisioning Services up to and including version 5.6 Service Pack 1. ABSTRACT: Citrix Provisioning Services is prone to a remote code-execution vulnerability. Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the application. reference LINKS: Citrix Document ID: CTX130846 Security Focus: Bugtraq ID 49803 IMPACT ASSESSMENT:

195

V-074: IBM Informix Genero libpng Integer Overflow Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: IBM Informix Genero libpng Integer Overflow Vulnerability 4: IBM Informix Genero libpng Integer Overflow Vulnerability V-074: IBM Informix Genero libpng Integer Overflow Vulnerability January 22, 2013 - 12:11am Addthis PROBLEM: IBM Informix Genero libpng Integer Overflow Vulnerability PLATFORM: IBM Informix Genero releases prior to 2.41 - all platforms ABSTRACT: A vulnerability has been reported in libpng. REFERENCE LINKS: IBM Security Bulletin: 1620982 Secunia Advisory SA51905 Secunia Advisory SA48026 CVE-2011-3026 IMPACT ASSESSMENT: Medium DISCUSSION: The libpng library used by IBM Informix Genero contains an integer overflow vulnerability. If you use IBM Informix Genero to handle PNG (Portable Network Graphics) image files and an attacker causes your IBM Informix Genero program to open or display a malicious PNG file, your IBM Informix

196

Ecosystem Vulnerability Assessment - Patterns of Climate Change...  

Office of Energy Efficiency and Renewable Energy (EERE) Indexed Site

Ecosystem Vulnerability Assessment - Patterns of Climate Change Vulnerability in the Southwest Ecosystem Vulnerability Assessment - Patterns of Climate Change Vulnerability in the...

197

V-160: Wireshark Multiple Bugs Let Remote Users Deny Service | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

60: Wireshark Multiple Bugs Let Remote Users Deny Service 60: Wireshark Multiple Bugs Let Remote Users Deny Service V-160: Wireshark Multiple Bugs Let Remote Users Deny Service May 21, 2013 - 12:09am Addthis PROBLEM: Wireshark Multiple Bugs Let Remote Users Deny Service PLATFORM: Versions 1.8.0 to 1.8.6 ABSTRACT: Multiple vulnerabilities have been reported in Wireshark REFERENCE LINKS: Wireshark Docid: wnpa-sec-2013-23 Secunia Advisory SA53425 SecurityTracker Alert ID: 1028582 CVE-2013-2486 CVE-2013-2487 IMPACT ASSESSMENT: Medium DISCUSSION: Multiple vulnerabilities have been reported in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service). 1) An error in the RELOAD dissector (dissectors/packet-reload.c) can be exploited to trigger infinite loops and consume CPU resources via specially

198

National Security Information Systems (NSIS) -National Security Systems &  

NLE Websites -- All DOE Office Websites (Extended Search)

NSSA: National Security Information Systems NSSA: National Security Information Systems Nonproliferation & National Security (NPNS) Overview Technical Nonproliferation Policy Support Strategic Trade Control Review of export license applications Multilateral Export Control Arrangements Interdiction Engagement & Training INECP INSEP GIPP Safeguards Concepts and Approaches Human Capital Development Additional Protocol Technical Assistance National Security Systems & Assessments National Security Information Systems Vulnerability Assessment Team (VAT) Radiation Detection & Response (RDR) Contact NPNS Other Major Programs Work with Argonne Contact us For Employees Site Map Help Join us on Facebook Follow us on Twitter NE Division on Flickr Nonproliferation and National Security Program National Security Systems & Assessments

199

Framework for SCADA Security Policy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Framework for SCADA Security Policy Framework for SCADA Security Policy Dominique Kilman Jason Stamp dkilman@sandia.gov jestamp@sandia.gov Sandia National Laboratories Albuquerque, NM 87185-0785 Abstract - Modern automation systems used in infrastruc- ture (including Supervisory Control and Data Acquisition, or SCADA) have myriad security vulnerabilities. Many of these relate directly to inadequate security administration, which precludes truly effective and sustainable security. Adequate security management mandates a clear administrative struc- ture and enforcement hierarchy. The security policy is the root document, with sections covering purpose, scope, posi- tions, responsibilities, references, revision history, enforce- ment, and exceptions for various subjects relevant for system

200

T-654: Apple QuickTime Multiple Bugs Let Remote Users Execute Arbitrary |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Apple QuickTime Multiple Bugs Let Remote Users Execute 4: Apple QuickTime Multiple Bugs Let Remote Users Execute Arbitrary T-654: Apple QuickTime Multiple Bugs Let Remote Users Execute Arbitrary June 24, 2011 - 4:39am Addthis PROBLEM: A vulnerability was reported in QuickTime. A remote user can cause arbitrary code to be executed on the target user's system. PLATFORM: Version(s): prior to QuickTime 7.6.8 ABSTRACT: A remote user can create a specially crafted file that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user. reference LINKS: SecurityTracker Alert ID: 1025705 Apple Security Article: HT4339 Apple Security Article: HT4723 Apple Security Article: HT1222 CVE-2011-0213 Secunia Advisory: SA45054 IMPACT ASSESSMENT High Discussion:

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


201

Smart Grid Embedded Cyber Security: Ensuring Security While Promoting Interoperability  

E-Print Network (OSTI)

of Smart Grid devices ? Describe progress made in Smart Grid security ? Propose a more robust approach to SG security ? Describe needs for further research and development ESL-HH-10-08-09 Proceedings of the 17th Symposium for Improving Building Systems...? ? Advanced security methods ? Power analysis for key discovery ? Hardware attacks such as ?decapping? chips ? Developing vulnerability exploits ? Security analysis of smart grid systems & communications ? Reverse engineering ? Penetration testing ? Threat...

Ragsdale, G.

202

Cyber Security Evaluations - Reports  

NLE Websites -- All DOE Office Websites (Extended Search)

Cyber Security Reports Cyber Security Reports 2012 Review of the Classified Cyber Security Programs at the Lawrence Livermore National Laboratory, January 2012, (OUO) Independent Oversight Review of the Classified Cyber Security Programs at the Savannah River Site, March 2012, (OUO) Independent Oversight Review of the Unclassified and Classified Cyber Security Programs at the Office of Scientific and Technical Information, March 2012, (OUO) Independent Oversight 2011 Report on Security Vulnerabilities of National Laboratory Computers, April 13, 2012, (OUO) Technical Review of the Office of Health, Safety and Security Classified Local Area Network, May 2012, (OUO) 2011 (U) Unclassified Cyber Security Technical Review of the Bonneville Power Administration Transmission Services Control Center Network, (OUO), May 2011

203

V-182: Symantec Endpoint Protection Manager Buffer Overflow Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Symantec Endpoint Protection Manager Buffer Overflow 2: Symantec Endpoint Protection Manager Buffer Overflow Vulnerability V-182: Symantec Endpoint Protection Manager Buffer Overflow Vulnerability June 20, 2013 - 6:00am Addthis PROBLEM: A vulnerability has been reported in Symantec Endpoint Protection Manager PLATFORM: The vulnerability is reported in versions 12.1.x prior to 12.1 RU3 ABSTRACT: Symantec was notified of a pre-authentication buffer overflow found in the Symantec Endpoint Protection Manager (SEPM) and Symantec Endpoint Protection Center (SPC) REFERENCE LINKS: Secunia Advisory SA53864 SecurityTracker Alert ID: 1028683 Symantec Adivsory SYM13-005 CVE-2013-1612 IMPACT ASSESSMENT: Medium DISCUSSION: The vulnerability is caused due to a boundary error within secars.dll and can be exploited to cause a buffer overflow via the web-based management

204

V-182: Symantec Endpoint Protection Manager Buffer Overflow Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

82: Symantec Endpoint Protection Manager Buffer Overflow 82: Symantec Endpoint Protection Manager Buffer Overflow Vulnerability V-182: Symantec Endpoint Protection Manager Buffer Overflow Vulnerability June 20, 2013 - 6:00am Addthis PROBLEM: A vulnerability has been reported in Symantec Endpoint Protection Manager PLATFORM: The vulnerability is reported in versions 12.1.x prior to 12.1 RU3 ABSTRACT: Symantec was notified of a pre-authentication buffer overflow found in the Symantec Endpoint Protection Manager (SEPM) and Symantec Endpoint Protection Center (SPC) REFERENCE LINKS: Secunia Advisory SA53864 SecurityTracker Alert ID: 1028683 Symantec Adivsory SYM13-005 CVE-2013-1612 IMPACT ASSESSMENT: Medium DISCUSSION: The vulnerability is caused due to a boundary error within secars.dll and can be exploited to cause a buffer overflow via the web-based management

205

U-174: Serendipity Unspecified SQL Injection Vulnerability | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Serendipity Unspecified SQL Injection Vulnerability 4: Serendipity Unspecified SQL Injection Vulnerability U-174: Serendipity Unspecified SQL Injection Vulnerability May 22, 2012 - 7:00am Addthis PROBLEM: Serendipity Unspecified SQL Injection Vulnerability PLATFORM: 1.6.1 and prior versions ABSTRACT: A vulnerability was reported in Serendipity. A remote user can inject SQL commands. Reference Links: SecurityTracker Alert ID: 1027079 Secunia Advisory SA49234 CVE-2012-2762 IMPACT ASSESSMENT: Medium Discussion: The 'include/functions_trackbacks.inc.php' script does not properly validate user-supplied input. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database. Impact: A remote user can execute SQL commands on the underlying database. Solution: The vendor has issued a fix (1.6.2).

206

Global Security | Y-12 National Security Complex  

NLE Websites -- All DOE Office Websites (Extended Search)

Security Security Global Security We train nuclear industry professionals, emergency responders and security forces from around the world to safeguard vulnerable materials. Nuclear nonproliferation - stopping the spread of nuclear materials - is a critical part of creating a safer world. Y-12 has been working in nonproliferation since the early 1990s in more than 25 countries. As the nation reduces the size of its arsenal, Y-12 will play a central role in decommissioning weapons systems and providing weapons material for peacetime uses. We are a leader across the National Nuclear Security Administration in implementing technology and current training to ensure materials are protected with the highest degree of confidence. We provide the expertise to secure highly enriched uranium - domestically

207

Office of Security Assistance  

NLE Websites -- All DOE Office Websites (Extended Search)

Security Security Home Sub Offices › Security Policy › Security Assistance › Departmental Personnel Security Mission & Functions › Security Policy › Security Assistance › Departmental Personnel Security Human Reliability Program (HRP) Guidance Documents Security Technology Information Archive (STIA) Related Links › DOE › DOE CIO › NNSA › DOE CFO › NTC › S&S PIR Contact Us HSS Logo Director's Perspective Welcome to the Office of Security Assistance Samuel N. Callahan, Director Mission and Functions The Office of Health, Safety, and Security (HSS) created the Office of Security Assistance Program to provide timely technical assistance and system support to field and Headquarters elements to enhance site security programs, upon request. The program is comprised of technologists and subject matter experts from all security disciplines including Program Management, Protection Program Operations, Information Security, Materials Control and Accountability, and Personnel Security. HSS is committed to building a security assistance program to serve the interests of the Department based upon the needs of our customers - with emphasis on customer-focus and meeting multi-disciplinary security needs. In Fiscal Year 2007, HSS performed extensive assistance activities at the request of DOE/NNSA program offices and field sites. The activities ranged from special and routine site survey assistance, physical and technical security inspections in support of the Office of Intelligence, Vulnerability Assessment and Design Basis Threat (DBT) implementation assistance, third-party, adversary support, and DBT implementation and planning validation activities associated with the Site Assistance Visits and Technology Assistance Visits. The security assistance provided to our customers included technical expertise tailored to augment site capabilities in critical fields.

208

Vulnerability Scanning Policy 1 Introduction  

E-Print Network (OSTI)

component of any computer security plan as it provides feedback on the effectiveness of security procedures

209

David Telles wins NNSA Security Professional of the Year award  

NLE Websites -- All DOE Office Websites (Extended Search)

who conduct vulnerability analyses, authored the LANL Site Safeguards and Security Plan, and administered the Lab's Performance Assurance Program. Under his leadership,...

210

Plutonium Vulnerability Management Plan  

SciTech Connect

This Plutonium Vulnerability Management Plan describes the Department of Energy`s response to the vulnerabilities identified in the Plutonium Working Group Report which are a result of the cessation of nuclear weapons production. The responses contained in this document are only part of an overall, coordinated approach designed to enable the Department to accelerate conversion of all nuclear materials, including plutonium, to forms suitable for safe, interim storage. The overall actions being taken are discussed in detail in the Department`s Implementation Plan in response to the Defense Nuclear Facilities Safety Board (DNFSB) Recommendation 94-1. This is included as Attachment B.

NONE

1995-03-01T23:59:59.000Z

211

T-594: IBM solidDB Password Hash Authentication Bypass Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

94: IBM solidDB Password Hash Authentication Bypass 94: IBM solidDB Password Hash Authentication Bypass Vulnerability T-594: IBM solidDB Password Hash Authentication Bypass Vulnerability April 4, 2011 - 6:08am Addthis PROBLEM: A vulnerability has been reported in IBM solidDB, which can be exploited by malicious people to bypass certain security restrictions. PLATFORM: IBM solidDB 4.x - IBM solidDB 6.x ABSTRACT: This vulnerability could allow remote attackers to execute arbitrary code on vulnerable installations of IBM solidDB. Authentication is not required to exploit this vulnerability. REFERENCE LINKS: IBM Security Alert Secunia Advisory: SA44030 ZDI Advisory: ZDI-11-115 IBM solidDB Support IMPACT ASSESSMENT: Medium Discussion: The specific flaw exists within the solid.exe process which listens by default on TCP ports 1315, 1964 and 2315. The authentication protocol

212

U-272: IBM WebSphere Commerce User Information Disclosure Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: IBM WebSphere Commerce User Information Disclosure 2: IBM WebSphere Commerce User Information Disclosure Vulnerability U-272: IBM WebSphere Commerce User Information Disclosure Vulnerability October 2, 2012 - 6:00am Addthis PROBLEM: IBM WebSphere Commerce User Information Disclosure Vulnerability PLATFORM: WebSphere Commerce Versions 6.0.0.0 to 6.0.0.11 WebSphere Commerce Versions 7.0.0.0 to 7.0.0.6 ABSTRACT: A vulnerability in WebSphere Commerce could allow disclosure of user personal data. reference LINKS: IBM Security Bulletin 1612484 X-Force Vulnerability Database (78867) Secunia Advisory SA50821 CVE-2012-4830 IMPACT ASSESSMENT: Medium Discussion: A remote unauthenticated attacker could exploit a security vulnerability in WebSphere Commerce to expose user personal data. The attack can be performed manually and the effort required is comparatively low.

213

Supercomputing and Energy in China: How Investment in HPC Affects Oil Security  

E-Print Network (OSTI)

in HPC Affects Oil Security Jordan WILSON Researcher, StudyChinas energy security challenge briefly, an oil deficit ofOil Weapon: Myth of Chinas Vulnerability, China Security,

WILSON, Jordan

2014-01-01T23:59:59.000Z

214

Evaluating the utilization of Twitter messages as a source of security alerts  

Science Journals Connector (OSTI)

The fast spread of computer security alerts, like vulnerabilities notifications, applications updates and threats of attacks, is essential to the implementation of efficient reactive measures against security incidents. This paper presents an empirical ... Keywords: information retrieval, microblogs, security

Rodrigo Campiolo; Luiz Arthur F. Santos; Daniel Macdo Batista; Marco Aurlio Gerosa

2013-03-01T23:59:59.000Z

215

U-213: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

U-213: Google Chrome Multiple Flaws Let Remote Users Execute U-213: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code U-213: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code July 16, 2012 - 7:00am Addthis PROBLEM: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Version(s): prior to 20.0.1132.57 ABSTRACT: Several vulnerabilities were reported in Google Chrome. reference LINKS: Stable Channel Update SecurityTracker Alert ID: 1027249 IMPACT ASSESSMENT: High Discussion: Several vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can create a specially crafted content that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user.

216

V-035: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Google Chrome Multiple Flaws Let Remote Users Execute 5: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code V-035: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code November 28, 2012 - 1:00am Addthis PROBLEM: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Version(s): prior to 23.0.1271.91 ABSTRACT: Several vulnerabilities were reported in Google Chrome. REFERENCE LINKS: Release updates from the Chrome team SecurityTracker Alert ID: 1027815 Secunia Advisory SA51437 CVE-2012-5130 CVE-2012-5131 CVE-2012-5132 CVE-2012-5133 CVE-2012-5134 CVE-2012-5135 CVE-2012-5136 IMPACT ASSESSMENT: High DISCUSSION: Several vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can create specially crafted content that, when loaded by the

217

V-035: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Google Chrome Multiple Flaws Let Remote Users Execute 5: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code V-035: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code November 28, 2012 - 1:00am Addthis PROBLEM: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Version(s): prior to 23.0.1271.91 ABSTRACT: Several vulnerabilities were reported in Google Chrome. REFERENCE LINKS: Release updates from the Chrome team SecurityTracker Alert ID: 1027815 Secunia Advisory SA51437 CVE-2012-5130 CVE-2012-5131 CVE-2012-5132 CVE-2012-5133 CVE-2012-5134 CVE-2012-5135 CVE-2012-5136 IMPACT ASSESSMENT: High DISCUSSION: Several vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can create specially crafted content that, when loaded by the

218

U-213: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Google Chrome Multiple Flaws Let Remote Users Execute 3: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code U-213: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code July 16, 2012 - 7:00am Addthis PROBLEM: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Version(s): prior to 20.0.1132.57 ABSTRACT: Several vulnerabilities were reported in Google Chrome. reference LINKS: Stable Channel Update SecurityTracker Alert ID: 1027249 IMPACT ASSESSMENT: High Discussion: Several vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can create a specially crafted content that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user.

219

T-527: OpenSC Smart Card Serial Number Multiple Buffer Overflow...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Pidgin 'mxitshowmessage()' Function Stack-Based Buffer Overflow Vulnerability U-202: Apple QuickTime Multiple Stack Overflow Vulnerabilities T-543: Wireshark 0.8.20 through...

220

T-683:Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

83:Google Chrome Multiple Flaws Let Remote Users Execute 83:Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code T-683:Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code August 3, 2011 - 3:45pm Addthis PROBLEM: Multiple vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. PLATFORM: Google Chrome prior to 13.0.782.107 ABSTRACT: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code. reference LINKS: Google Chrome advisory Update Chromium Security SecurityTracker Alert ID: 1025882 CVE-2011-2819 IMPACT ASSESSMENT: Medium Discussion: A remote user can create a specially crafted HTML that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user.

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


221

T-691: Adobe Flash Player Multiple Flaws Let Remote Users Execute Arbitrary  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Adobe Flash Player Multiple Flaws Let Remote Users Execute 1: Adobe Flash Player Multiple Flaws Let Remote Users Execute Arbitrary Code T-691: Adobe Flash Player Multiple Flaws Let Remote Users Execute Arbitrary Code August 11, 2011 - 3:00pm Addthis PROBLEM: Multiple vulnerabilities were reported in Adobe Flash Player. A remote user can cause arbitrary code to be executed on the target user's system. PLATFORM: Version(s): 10.3.181.36 and prior; 10.3.185.25 and prior for Android. ABSTRACT: Adobe Flash Player Multiple Flaws Let Remote Users Execute Arbitrary Code. reference LINKS: Security Bulletin: APSB11-21 SecurityTracker Alert ID: 1025907 CVE-2011-2425 IMPACT ASSESSMENT: High Discussion: A remote user can create specially crafted Flash content that, when loaded by the target user, will execute arbitrary code on the target system. The

222

Analysis of Security Messages Posted on Twitter  

Science Journals Connector (OSTI)

The fast spread of computer security alerts, like vulnerabilities notifications, applications updates and threats of attacks, is essential to efficient reactive measures against security incidents. This paper presents an empirical study that evaluates ... Keywords: information retrieval, social network analysis, microblogs, security

Luiz Arthur F. Santos; Rodrigo Campiolo; Marco Aurelio Gerosa; Daniel Macedo Batista

2012-10-01T23:59:59.000Z

223

T-547: Microsoft Windows Human Interface Device (HID) Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

547: Microsoft Windows Human Interface Device (HID) Vulnerability 547: Microsoft Windows Human Interface Device (HID) Vulnerability T-547: Microsoft Windows Human Interface Device (HID) Vulnerability February 1, 2011 - 3:20am Addthis PROBLEM Microsoft Windows Human Interface Device (HID) Vulnerability. PLATFORM: Microsoft 2003 SP2, Vista SP2, 2008 SP2, XP SP3, 7; and prior service packs ABSTRACT: Microsoft Windows does not properly warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a Smartphone that the user connected to the computer. reference LINKS: Security Lab: Reference CVE-2011-0638 CVE Details: Reference CVE-2011-0638 Mitre Reference: CVE-2011-0638

224

T-680:Samba SWAT 'user' Field Cross Site Scripting Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0:Samba SWAT 'user' Field Cross Site Scripting Vulnerability 0:Samba SWAT 'user' Field Cross Site Scripting Vulnerability T-680:Samba SWAT 'user' Field Cross Site Scripting Vulnerability August 1, 2011 - 2:10pm Addthis PROBLEM: Samba SWAT 'user' Field Cross Site Scripting Vulnerability PLATFORM: All Linux ABSTRACT: It was found that the 'Change Password' page / screen of the Samba Web Administration Tool did not properly sanitize content of the user-provided "user" field, prior printing it back to the page content. A remote attacker could provide a specially-crafted URL, which once visited by an authenticated Samba SWAT user could allow the attacker to conduct cross-site scripting attacks (execute arbitrary HTML or script code). reference LINKS: SecurityFocus - Bugtraq ID: 48901 Secunia CVE Reference: CVE-2011-2694

225

T-680:Samba SWAT 'user' Field Cross Site Scripting Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

80:Samba SWAT 'user' Field Cross Site Scripting Vulnerability 80:Samba SWAT 'user' Field Cross Site Scripting Vulnerability T-680:Samba SWAT 'user' Field Cross Site Scripting Vulnerability August 1, 2011 - 2:10pm Addthis PROBLEM: Samba SWAT 'user' Field Cross Site Scripting Vulnerability PLATFORM: All Linux ABSTRACT: It was found that the 'Change Password' page / screen of the Samba Web Administration Tool did not properly sanitize content of the user-provided "user" field, prior printing it back to the page content. A remote attacker could provide a specially-crafted URL, which once visited by an authenticated Samba SWAT user could allow the attacker to conduct cross-site scripting attacks (execute arbitrary HTML or script code). reference LINKS: SecurityFocus - Bugtraq ID: 48901 Secunia CVE Reference: CVE-2011-2694

226

U.S. Energy Sector Vulnerability Report | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

U.S. Energy Sector Vulnerability Report U.S. Energy Sector Vulnerability Report U.S. Energy Sector Vulnerability Report As part of the Administration's efforts to support national climate change adaptation planning through the Interagency Climate Change Adaptation Task Force and Strategic Sustainability Planning process -- and to advance the Energy Department's goal of promoting energy security -- the Department released the U.S. Energy Sector Vulnerability to Climate Change and Extreme Weather report. The report examines current and potential future impacts of climate change trends on the U.S. energy sector, including: Coastal energy infrastructure is at risk from sea level rise, increasing storm intensity and higher storm surge and flooding. Oil and gas production -- including refining, hydraulic fracturing

227

T-599: Microsoft April 2011 Security Bulletin Release | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

99: Microsoft April 2011 Security Bulletin Release 99: Microsoft April 2011 Security Bulletin Release T-599: Microsoft April 2011 Security Bulletin Release April 11, 2011 - 5:24am Addthis PROBLEM: Microsoft April 2011 Security Bulletin Release PLATFORM: Microsoft Windows, Microsoft Office, Microsoft Server Software, and Microsoft Developer Tools and Software ABSTRACT: Microsoft released 17 bulletins to address vulnerabilities involving Microsoft Office Suites and Software in Windows OS. This Microsoft Bulletin contains 9 Critical vulnerabilities which require a restart after the applied patch. reference LINKS: Microsoft Security Bulletin Advance Notification for April 2011 Microsoft Security April Affected Software TechNet Webcast: Information About Microsoft April Security Bulletins IMPACT ASSESSMENT: High Discussion:

228

U-093: Mozilla Firefox Multiple Flaws Permit Remote Code Execution,  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Mozilla Firefox Multiple Flaws Permit Remote Code Execution, 3: Mozilla Firefox Multiple Flaws Permit Remote Code Execution, Information Disclosure, and Cross-Site Scripting Attacks U-093: Mozilla Firefox Multiple Flaws Permit Remote Code Execution, Information Disclosure, and Cross-Site Scripting Attacks February 1, 2012 - 5:51am Addthis PROBLEM: Multiple vulnerabilities were reported in Mozilla Firefox. PLATFORM: Linux (Any), UNIX (Any), Windows (Any) Version(s): prior to 3.2.26; prior to 10.0 ABSTRACT: Mozilla Firefox Multiple Flaws Permit Remote Code Execution, Information Disclosure, and Cross-Site Scripting. reference LINKS: SecurityTracker Alert ID: 1026605 CVE-2011-3659, CVE-2012-0442 CVE-2012-0443, CVE-2012-0444 CVE-2012-0445, CVE-2012-0446 CVE-2012-0447, CVE-2012-0449 CVE-2012-0450 Vendor Site IMPACT ASSESSMENT:

229

Fact Sheet: Cyber Security Audit and Attack Detection Toolkit  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Audit and Audit and Attack Detection Toolkit Adding control system intelligence to widely deployed enterprise vulnerability scanners and security event managers While many energy utilities employ vulnerability scanners and security event managers (SEM) on their enterprise systems, these tools often lack the intelligence necessary to be effective in control systems. This two-year project aims to integrate control system intelligence into widely deployed vulnerability scanners and SEM, and to integrate security incident detection intelligence into control system historians. These upgrades will be provided at no or a low cost to control system asset owners. The popular Nessus Vulnerability Scanner supports an audit plug-in that gathers configuration information from

230

Energy Security Initiatives Update  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Make Energy A Consideration in All We DoTM Make Energy A Consideration in All We DoTM ENERGY SECURITY INITIATIVES UPDATE Ms Karen White AFFEC On behalf of Mr Mike Aimone 1 Make Energy A Consideration in All We DoTM 2 Energy Security Initiatives AFCESA ETL 09-10 -- Aurora Electrical System Vulnerability Assessment and Mitigation Actions FUPWG-EEI CA Net Zero Energy Initiative (Vandenberg AFB, CA) Energy Security Tiger Team Visit (Ft Bliss, TX) National Renewable Energy Lab (NREL) Net Zero Pilot at Marine Corps Air Station Miramar and Naval Base Ventura County (San Nicolas Island) Smart Grid Initiatives: Maxwell AFB AL, Army BAAs (3 each); Naval Base Ventura County (San Nicholas Island) National Defense University sponsored Electric Grid War Game (Jul) Task Force on Grid Vulnerability (Gaps/Seams in S&T ) initiative (Joint

231

V-188: Apache XML Security XPointer Expressions Processing Buffer Overflow  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: Apache XML Security XPointer Expressions Processing Buffer 8: Apache XML Security XPointer Expressions Processing Buffer Overflow Vulnerability V-188: Apache XML Security XPointer Expressions Processing Buffer Overflow Vulnerability June 28, 2013 - 6:00am Addthis PROBLEM: A vulnerability has been reported in Apache XML Security PLATFORM: vulnerability is reported in versions prior to 1.7.2 ABSTRACT: The vulnerability addresses the possibility of a heap overflow condition REFERENCE LINKS: Secunia Advisory SA53959 Apache Advisory CVE-2013-2210 IMPACT ASSESSMENT: High DISCUSSION: The vulnerability is caused due to an error within the XML Signature Reference processing code and can be exploited to cause a heap-based buffer overflow via a specially crafted document containing malformed XPointer expressions. IMPACT: Successful exploitation may allow execution of arbitrary code

232

T-717: Microsoft Security Bulletin Summary for September 2011 | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Microsoft Security Bulletin Summary for September 2011 7: Microsoft Security Bulletin Summary for September 2011 T-717: Microsoft Security Bulletin Summary for September 2011 September 14, 2011 - 9:30am Addthis PROBLEM: Summary of Microsoft security bulletins released on September 13, 2011. PLATFORM: MS Windows Operating System and Components ABSTRACT: Microsoft Security Bulletin Summary for September 2011. reference LINKS: Microsoft Security Bulletin Microsoft Security Bulletin Summaries IMPACT ASSESSMENT: Medium Discussion: CVE-2011-1984 - MS11-070 WINS Local Elevation of Privilege Vulnerability CVE-2011-1991 - MS11-071 Windows Components Insecure Library Loading Vulnerability CVE-2011-1986 - MS11-072 Excel Use after Free WriteAV Vulnerability CVE-2011-1987 - MS11-072 Excel Out of Bounds Array Indexing Vulnerability

233

V-125: Cisco Connected Grid Network Management System Multiple...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

System 2.x ABSTRACT: Some vulnerabilities have been reported in Cisco Connected Grid Network Management System. REFERENCE LINKS: Cisco Security Notice CVE-2013-1163 Cisco...

234

CLIMATE CHANGE AND WATER SUPPLY SECURITY  

E-Print Network (OSTI)

CLIMATE CHANGE AND WATER SUPPLY SECURITY: Reconfiguring Groundwater Management to Reduce with climate change, present a significant planning challenge for California's water agencies. This research Drought Vulnerability A White Paper from the California Energy Commission's California Climate

235

Improving application security with data flow assertions  

E-Print Network (OSTI)

Resin is a new language runtime that helps prevent security vulnerabilities, by allowing programmers to specify application-level data flow assertions. Resin provides policy objects, which programmers use to specify assertion ...

Yip, Alexander

236

V-057: eXtplorer "ext_find_user()" Authentication Bypass Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

V-057: eXtplorer "ext_find_user()" Authentication Bypass V-057: eXtplorer "ext_find_user()" Authentication Bypass Vulnerability V-057: eXtplorer "ext_find_user()" Authentication Bypass Vulnerability December 28, 2012 - 6:00am Addthis December 28 2012 - 6:00am PROBLEM: eXtplorer "ext_find_user()" Authentication Bypass Vulnerability PLATFORM: eXtplorer 2.x ABSTRACT: A vulnerability has been reported in eXtplorer, which can be exploited by malicious people to bypass certain security restrictions. REFERENCE LINKS: Secunia Advisory SA51636 eXtplorer 2.1.3 Security Release IMPACT ASSESSMENT: Medium DISCUSSION: eXtplorer was notified of a problem within the authentication system of eXtplorer Versions 2.1.2, 2.1.1, 2.1.0 and 2.1.0RC5 that have been found to be vulnerable to an authentication bypass bug.

237

U-097: PHP "php_register_variable_ex()" Code Execution Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

097: PHP "php_register_variable_ex()" Code Execution 097: PHP "php_register_variable_ex()" Code Execution Vulnerability U-097: PHP "php_register_variable_ex()" Code Execution Vulnerability February 7, 2012 - 9:00am Addthis PROBLEM: PHP "php_register_variable_ex()" Code Execution Vulnerability PLATFORM: PHP 5.3.x ABSTRACT: Execution of arbitrary code via network as well as user access via network reference LINKS: PHP Security Archive SecurityTracker Alert ID: 1026631 Secunia Advisory SA47806 CVE-2012-0830 IMPACT ASSESSMENT: High Discussion: A vulnerability has been reported in PHP, which can be exploited by malicious people to compromise a vulnerable system. Impact: A remote user can send specially crafted data to trigger a memory error in php_register_variable_ex() and execute arbitrary code on the target system.

238

U-079: Adobe Acrobat/Reader Multiple Bugs Let Remote Users Execute  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

79: Adobe Acrobat/Reader Multiple Bugs Let Remote Users Execute 79: Adobe Acrobat/Reader Multiple Bugs Let Remote Users Execute Arbitrary Code U-079: Adobe Acrobat/Reader Multiple Bugs Let Remote Users Execute Arbitrary Code January 11, 2012 - 8:00am Addthis PROBLEM: Adobe Acrobat/Reader Multiple Bugs Let Remote Users Execute Arbitrary Code. PLATFORM: Adobe Acrobat/Reader Version(s): 9.x prior to 9.5, 10.x prior to 10.1.2 ABSTRACT: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system. reference LINKS: SecurityTracker Alert ID: 1026496 Adobe Security Bulletin APSB12-01 CVE-2011-2462, CVE-2011-4369, CVE-2011-4370, CVE-2011-4371, CVE-2011-4372, CVE-2011-4373. IMPACT ASSESSMENT: High Discussion: Several vulnerabilities were reported in Adobe Acrobat/Reader. A remote

239

AP1000 Design for Security  

SciTech Connect

Nuclear power plants are protected from potential security threats through a combination of robust structures around the primary system and other vital equipment, security systems and equipment, and defensive strategy. The overall objective for nuclear power plant security is to protect public health and safety by ensuring that attacks or sabotage do not challenge the ability to safely shutdown the plant or protect from radiological releases. In addition, plants have systems, features and operational strategies to cope with external conditions, such as loss of offsite power, which could be created as part of an attack. Westinghouse considered potential security threats during design of the AP1000 PWR. The differences in plant configuration, safety system design, and safe shutdown equipment between existing plants and AP1000 affect potential vulnerabilities. This paper provides an evaluation of AP1000 with respect to vulnerabilities to security threats. The AP1000 design differs from the design of operating PWRs in the US in the configuration and the functional requirements for safety systems. These differences are intentional departures from conventional PWR designs which simplify plant design and enhance overall safety. The differences between the AP1000 PWR and conventional PWRs can impact vulnerabilities to security threats. The NRC addressed security concerns as part of their reviews for AP1000 Design Certification, and did not identify any security issues of concern. However, much of the detailed security design information for the AP1000 was deferred to the combined Construction and Operating License (COL) phase as many of the security issues are site-specific. Therefore, NRC review of security issues related to the AP1000 is not necessarily complete. Further, since the AP1000 plant design differs from existing PWRs, it is not obvious that the analyses and assessments prepared for existing plants also apply to the AP1000. We conclude that, overall, the AP1000 is less vulnerable to security threats such as malevolent use of vehicles (land, water or air), than are conventional PWRs. Further, the AP1000 is less vulnerable to external events (e.g., loss of transmission) than conventional PWRs. For some of the threats evaluated the AP1000 is comparable to conventional PWRs, while for other threats the AP1000 is inherently less vulnerable. (authors)

Long, L.B. [Southern Nuclear Operating Company, 40 Inverness Center Parkway, Birmingham, AL 35242 (United States); Cummins, W.E.; Winters, J.W. [Westinghouse Electric Company, 4350 Northern Pike, Monroeville, PA 15146 (United States)

2006-07-01T23:59:59.000Z

240

U-098: ISC BIND Deleted Domain Name Resolving Vulnerability | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

098: ISC BIND Deleted Domain Name Resolving Vulnerability 098: ISC BIND Deleted Domain Name Resolving Vulnerability U-098: ISC BIND Deleted Domain Name Resolving Vulnerability February 8, 2012 - 7:00am Addthis PROBLEM: A vulnerability has been reported in ISC BIND, which can be exploited by malicious people to bypass certain security restrictions. PLATFORM: ISC BIND 9.2.x ISC BIND 9.3.x ISC BIND 9.4.x ISC BIND 9.5.x ISC BIND 9.6.x ISC BIND 9.7.x ISC BIND 9.8.x ABSTRACT: The vulnerability is caused due to an error within the cache update policy. reference LINKS: Original Advisory Secunia Advisory SA47884 CVE-2012-1033 IMPACT ASSESSMENT: High Discussion: Researchers discovered a vulnerability affecting the large majority of popular DNS implementations which allows a malicious domain name to stay resolvable long after it has been removed from the upper level servers. The

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


241

Departmental Personnel Security- Clearance Automation  

Energy.gov (U.S. Department of Energy (DOE))

The primary objective of the DOE Integrated Security System (eDISS+) Initiative is to support the integration of multiple DOE security systems and databases. This integrated environment provides...

242

V-114: RealPlayer MP4 Processing Buffer Overflow Vulnerability | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

14: RealPlayer MP4 Processing Buffer Overflow Vulnerability 14: RealPlayer MP4 Processing Buffer Overflow Vulnerability V-114: RealPlayer MP4 Processing Buffer Overflow Vulnerability March 19, 2013 - 12:01am Addthis PROBLEM: RealPlayer MP4 Processing Buffer Overflow Vulnerability PLATFORM: Versions prior to 16.0.1.18. ABSTRACT: A vulnerability has been reported in RealPlayer REFERENCE LINKS: RealNetworks, Inc Secunia Advisory SA52692 CVE-2013-1750 IMPACT ASSESSMENT: High DISCUSSION: The vulnerability is caused due to an error when processing MP4 files and can be exploited to cause a heap-based buffer overflow via a specially crafted MP4 file. IMPACT: Successful exploitation may allow execution of arbitrary code. SOLUTION: Update to version 16.0.1.18. Addthis Related Articles U-042: Mac RealPlayer Multiple Vulnerabilities V-228: RealPlayer Buffer Overflow and Memory Corruption Error Let Remote

243

Developing new methodology for nuclear power plants vulnerability assessment  

Science Journals Connector (OSTI)

The fundamental aim of an efficient regulatory emergency preparedness and response system is to provide sustained emergency readiness and to prevent emergency situations and accidents. But when an event occurs, the regulatory mission is to mitigate consequences and to protect people and the environment against nuclear and radiological damage. The regulatory emergency response system, which would be activated in the case of a nuclear and/or radiological emergency and release of radioactivity to the environment, is an important element of a comprehensive national regulatory system of nuclear and radiation safety. In the past, national emergency systems explicitly did not include vulnerability assessments of the critical nuclear infrastructure as an important part of a comprehensive preparedness framework. But after the huge terrorist attack on 11/09/2001, decision-makers became aware that critical nuclear infrastructure could also be an attractive target to terrorism, with the purpose of using the physical and radioactive properties of the nuclear material to cause mass casualties, property damage, and detrimental economic and/or environmental impacts. The necessity to evaluate critical nuclear infrastructure vulnerability to threats like human errors, terrorist attacks and natural disasters, as well as preparation of emergency response plans with estimation of optimized costs, are of vital importance for assurance of safe nuclear facilities operation and national security. In this paper presented new methodology and solution methods for vulnerability assessment can help the overall national energy sector to identify and understand the terrorist threats to and vulnerabilities of its critical infrastructure. Moreover, adopted methodology could help national regulators and agencies to develop and implement a vulnerability awareness and education programs for their critical assets to enhance the security and a safe operation of the entire energy infrastructure. New methods can also assist nuclear power plants to develop, validate, and disseminate assessment and surveys of new efficient countermeasures. Consequently, concise description of developed new quantitative method and adapted new methodology for nuclear regulatory vulnerability assessment of nuclear power plants are presented.

Venceslav Kostadinov

2011-01-01T23:59:59.000Z

244

T-544: Cisco Security Advisory: Cisco Content Services Gateway  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Cisco Security Advisory: Cisco Content Services Gateway 4: Cisco Security Advisory: Cisco Content Services Gateway Vulnerabilities T-544: Cisco Security Advisory: Cisco Content Services Gateway Vulnerabilities January 27, 2011 - 7:00am Addthis PROBLEM: Cisco Security Advisory: Cisco Content Services Gateway Vulnerabilities PLATFORM: Cisco IOS Software Release 12.4(24)MD1 on the Cisco CSG2 ABSTRACT: Cisco IOS Software Release 12.4(24)MD1 on the Cisco CSG2 contains two vulnerabilities that can be exploited by a remote, unauthenticated attacker to create a denial of service condition that prevents traffic from passing through the CSG2. These vulnerabilities require only a single content service to be active on the Cisco CSG2 and can be exploited via crafted TCP packets. A three-way handshake is not required to exploit either of these

245

T-544: Cisco Security Advisory: Cisco Content Services Gateway  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Cisco Security Advisory: Cisco Content Services Gateway 4: Cisco Security Advisory: Cisco Content Services Gateway Vulnerabilities T-544: Cisco Security Advisory: Cisco Content Services Gateway Vulnerabilities January 27, 2011 - 2:04pm Addthis PROBLEM: Cisco Security Advisory: Cisco Content Services Gateway Vulnerabilities PLATFORM: Cisco IOS Software Release 12.4(24)MD1 on the Cisco CSG2 ABSTRACT: Cisco IOS Software Release 12.4(24)MD1 on the Cisco CSG2 contains two vulnerabilities that can be exploited by a remote, unauthenticated attacker to create a denial of service condition that prevents traffic from passing through the CSG2. These vulnerabilities require only a single content service to be active on the Cisco CSG2 and can be exploited via crafted TCP packets. A three-way handshake is not required to exploit either of these

246

Vulnerability Analysis of Energy Delivery Control Systems  

Energy Savers (EERE)

services and applications * Known vulnerabilities are mitigated through effective patch management and removal of unneeded applications and services. New vulnerabilities in...

247

U-126: Cisco Adaptive Security Appliances Port Forwarder ActiveX Control  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

26: Cisco Adaptive Security Appliances Port Forwarder ActiveX 26: Cisco Adaptive Security Appliances Port Forwarder ActiveX Control Buffer Overflow Vulnerability U-126: Cisco Adaptive Security Appliances Port Forwarder ActiveX Control Buffer Overflow Vulnerability March 16, 2012 - 7:00am Addthis PROBLEM: Cisco Adaptive Security Appliances Port Forwarder ActiveX Control Buffer Overflow Vulnerability PLATFORM: Cisco Adaptive Security Appliance (ASA) 7.x, Cisco Adaptive Security Appliance (ASA) 8.x, Cisco ASA 5500 Series Adaptive Security Appliances ABSTRACT: A vulnerability was reported in Cisco ASA. A remote user can cause arbitrary code to be executed on the target user's system. reference LINKS: Secunia Advisory SA48422 SecurityTracker Alert ID: 1026799 CVE-2012-0358 IMPACT ASSESSMENT: High Discussion: A remote user can create specially crafted HTML that, when loaded by the

248

Some Modeling Challenges when Testing Rich Internet Applications for Security Kamara Benjamin, Gregor v. Bochmann,  

E-Print Network (OSTI)

Some Modeling Challenges when Testing Rich Internet Applications for Security Kamara Benjamin (RIAs), using technologies such as Ajax, Flex, or Silverlight, break away from the traditional approach and servers. RIAs introduce new challenges, new security vulnerabilities, and their behavior makes

Jourdan, Guy-Vincent

249

MAPPING CLIMATE CHANGE EXPOSURES, VULNERABILITIES,  

E-Print Network (OSTI)

MAPPING CLIMATE CHANGE EXPOSURES, VULNERABILITIES, AND ADAPTATION TO PUBLIC HEALTH RISKS's California Climate Change Center JULY 2012 CEC5002012041 Prepared for: California Energy Commission of California. #12; ii ABSTRACT This study reviewed first available frameworks for climate change adaptation

250

Handbook of the Vulnerable Plaque  

Science Journals Connector (OSTI)

...predominantly a secondary phenomenon; the true culprit in unstable ischemic heart disease is rupture of the underlying vulnerable atherosclerotic plaque. Handbook of the Vulnerable Plaque was edited by two distinguished leaders in interventional cardiology, Patrick Serruys and Ron Waksman. They assembled a who's... Angiographic observations in the early 1980s confirmed that acute coronary thrombosis was the proximate cause of acute myocardial infarction seminal studies that led to revolutionary treatments for the recanalization of occluded vessels. However, during ...

Goldstein J.

2005-06-02T23:59:59.000Z

251

U-133: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

33: Google Chrome Multiple Flaws Let Remote Users Execute 33: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code U-133: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code March 26, 2012 - 3:35am Addthis PROBLEM: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Google Chrome prior to 17.0.963.83 ABSTRACT: Multiple vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. reference LINKS: SecurityTracker Alert ID: 1026841 CVE-2011-3049 Secunia Advisory SA48512 IMPACT ASSESSMENT: High Discussion: A remote user can create specially crafted content that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user. A use-after-free may occur

252

U-143: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Google Chrome Multiple Flaws Let Remote Users Execute 3: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code U-143: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code April 9, 2012 - 7:00am Addthis PROBLEM: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Version(s): prior to 18.0.1025.151 ABSTRACT: Multiple vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. reference LINKS: SecurityTracker Alert ID: 1026892 CVE-2011-3066 Secunia Advisory SA48732 IMPACT ASSESSMENT: High Discussion: A remote user can create specially crafted content that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user. An out-of-bounds memory

253

T-715: Microsoft SharePoint Multiple Flaws Permit Cross-Site Scripting  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

15: Microsoft SharePoint Multiple Flaws Permit Cross-Site 15: Microsoft SharePoint Multiple Flaws Permit Cross-Site Scripting Attacks T-715: Microsoft SharePoint Multiple Flaws Permit Cross-Site Scripting Attacks September 13, 2011 - 12:35pm Addthis PROBLEM: Multiple vulnerabilities were reported in Microsoft SharePoint. A remote user can conduct cross-site scripting attacks. PLATFORM: Version(s): SharePoint software ABSTRACT: Microsoft SharePoint Multiple Flaws Permit Cross-Site Scripting Attacks. reference LINKS: MS11-074: Article ID: 2552998 SecurityTracker Alert ID: 1026040 CVE-2011-1893 CVE-2011-1892 CVE-2011-1891 CVE-2011-1890 CVE-2011-0653 IMPACT ASSESSMENT: High Discussion: A remote user can create a specially crafted URL or web site that, when loaded by a target user, will cause arbitrary scripting code to be executed

254

T-673: Apple Safari Multiple Flaws Let Remote Users Execute Arbitrary Code,  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Apple Safari Multiple Flaws Let Remote Users Execute 3: Apple Safari Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Scripting Attacks T-673: Apple Safari Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Scripting Attacks July 21, 2011 - 1:27am Addthis PROBLEM: Multiple vulnerabilities were reported in Apple Safari. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can conduct cross-site scripting attacks. A remote user can obtain potentially sensitive information. A remote user can bypass a certificate validation control. PLATFORM: Safari 5.1 and Safari 5.0.6 Products Affected: Safari 5 (Mac OS X 10.6), Safari 5 (Mac OS X 10.5), Product Security, Safari 5.1 (OS X Lion) ABSTRACT: Apple Safari Multiple Flaws Let Remote Users Execute Arbitrary Code,

255

U-170: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

70: Apple QuickTime Multiple Flaws Let Remote Users Execute 70: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary Code U-170: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary Code May 16, 2012 - 7:00am Addthis PROBLEM: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: prior to 7.7.2 ABSTRACT: Multiple vulnerabilities were reported in Apple QuickTime. A remote user can cause arbitrary code to be executed on the target user's system. Reference LINKS: SecurityTracker Alert ID: 1027065 CVE-2012-0265 CVE-2012-0663 CVE-2012-0664 CVE-2012-0665 CVE-2012-0666 IMPACT ASSESSMENT: High Discussion: A remote user can create a specially crafted file that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user. Only Windows-based systems

256

T-715: Microsoft SharePoint Multiple Flaws Permit Cross-Site Scripting  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Microsoft SharePoint Multiple Flaws Permit Cross-Site 5: Microsoft SharePoint Multiple Flaws Permit Cross-Site Scripting Attacks T-715: Microsoft SharePoint Multiple Flaws Permit Cross-Site Scripting Attacks September 13, 2011 - 12:35pm Addthis PROBLEM: Multiple vulnerabilities were reported in Microsoft SharePoint. A remote user can conduct cross-site scripting attacks. PLATFORM: Version(s): SharePoint software ABSTRACT: Microsoft SharePoint Multiple Flaws Permit Cross-Site Scripting Attacks. reference LINKS: MS11-074: Article ID: 2552998 SecurityTracker Alert ID: 1026040 CVE-2011-1893 CVE-2011-1892 CVE-2011-1891 CVE-2011-1890 CVE-2011-0653 IMPACT ASSESSMENT: High Discussion: A remote user can create a specially crafted URL or web site that, when loaded by a target user, will cause arbitrary scripting code to be executed

257

U-069: Telnet code execution vulnerability: FreeBSD and Kerberos |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

69: Telnet code execution vulnerability: FreeBSD and Kerberos 69: Telnet code execution vulnerability: FreeBSD and Kerberos U-069: Telnet code execution vulnerability: FreeBSD and Kerberos December 27, 2011 - 5:18am Addthis PROBLEM: Telnet code execution vulnerability: FreeBSD and Kerberos PLATFORM: Operating System: FreeBSD 7.1, 7.3, 8.0 and 8.1 and Software: Kerberos ABSTRACT: Vulnerability was reported in FreeBSD Telnet. A remote user can execute arbitrary code on the target system. reference LINKS: FreeBSD-SA-11:08.telnetd MITKRB5-SA-2011-008 Secunia Advisory: SA47397 (FreeBSD) Secunia Advisory: SA47348 (Kerberos) SecurityTracker Alert ID: 1026460 CVE-2011-4862 IMPACT ASSESSMENT: High Discussion: When an encryption key is supplied via the TELNET protocol, its length is not validated before the key is copied into a fixed-size buffer. The telnet

258

V-056: FreeType BDF Glyph Processing Buffer Overflow Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: FreeType BDF Glyph Processing Buffer Overflow Vulnerability 6: FreeType BDF Glyph Processing Buffer Overflow Vulnerability V-056: FreeType BDF Glyph Processing Buffer Overflow Vulnerability December 27, 2012 - 6:00am Addthis PROBLEM: FreeType BDF Glyph Processing Buffer Overflow Vulnerability PLATFORM: Version(s): prior to 2.4.11 ABSTRACT: Several vulnerabilities were reported in FreeType. A remote user can cause arbitrary code to be executed on the target user's system. REFERENCE LINKS: SecurityTracker Alert ID: 1027921 CVE-2012-5668 CVE-2012-5669 CVE-2012-5670 IMPACT ASSESSMENT: High DISCUSSION: A remote user can create a specially crafted font file that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user or application. A null pointer dereference can be triggered in bdf_free_font()

259

T-572: VMware ESX/ESXi SLPD denial of service vulnerability | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

72: VMware ESX/ESXi SLPD denial of service vulnerability 72: VMware ESX/ESXi SLPD denial of service vulnerability T-572: VMware ESX/ESXi SLPD denial of service vulnerability March 8, 2011 - 3:05pm Addthis PROBLEM: A vulnerability was reported in VMware ESX. A remote user can cause denial of service conditions. PLATFORM: ESX/ESXi 4.0, 4.1 ABSTRACT: VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm. reference LINKS: VMware Security Advisory: VMSA-2011-0004 VMware vSphere 4 VMware ESXi 4.1 Update CVE-2010-3609 IMPACT ASSESSMENT: Moderate Discussion: A remote user can send specially crafted data to cause the target Service Location Protocol daemon (SLPD) to enter an infinite loop and consume excessive CPU resources.A remote user can consume excessive CPU resources.

260

V-236: MediaWiki CentralAuth Extension Authentication Bypass Vulnerability  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: MediaWiki CentralAuth Extension Authentication Bypass 6: MediaWiki CentralAuth Extension Authentication Bypass Vulnerability V-236: MediaWiki CentralAuth Extension Authentication Bypass Vulnerability September 6, 2013 - 4:36am Addthis PROBLEM: A vulnerability has been reported in the CentralAuth extension for MediaWiki, which can be exploited by malicious people to bypass certain security restrictions. PLATFORM: MediaWiki CentralAuth Extension ABSTRACT: A vulnerability has been reported in the CentralAuth extension for MediaWik REFERENCE LINKS: Secunia Advisory SA54723 IMPACT ASSESSMENT: Medium DISCUSSION: The vulnerability is caused due to an error when handling auto-logins and can be exploited to bypass the authentication mechanism by providing a valid username within the "centralauth_User" cookie. IMPACT:

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


261

Cyber Security Reports | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Cyber Security Reports Cyber Security Reports Cyber Security Reports 2012 Review of the Classified Cyber Security Programs at the Lawrence Livermore National Laboratory, January 2012, (OUO) Independent Oversight Review of the Classified Cyber Security Programs at the Savannah River Site, March 2012, (OUO) Independent Oversight Review of the Unclassified and Classified Cyber Security Programs at the Office of Scientific and Technical Information, March 2012, (OUO) Independent Oversight 2011 Report on Security Vulnerabilities of National Laboratory Computers, April 13, 2012, (OUO) Technical Review of the Office of Health, Safety and Security Classified Local Area Network, May 2012, (OUO) 2011 (U) Unclassified Cyber Security Technical Review of the Bonneville Power Administration Transmission Services Control Center Network, (OUO),

262

Global Security  

NLE Websites -- All DOE Office Websites (Extended Search)

Applications Global Security science-innovationassetsimagesicon-science.jpg Global Security National security depends on science and technology. The United States relies on...

263

Nonproliferation and National Security Program - Nuclear Engineering  

NLE Websites -- All DOE Office Websites (Extended Search)

Major Programs > Nonproliferation and Major Programs > Nonproliferation and National Security Program Nonproliferation & National Security (NPNS) Overview Technical Nonproliferation Policy Support Strategic Trade Control Review of export license applications Multilateral Export Control Arrangements Interdiction Engagement & Training INECP INSEP GIPP Safeguards Concepts and Approaches Human Capital Development Additional Protocol Technical Assistance National Security Systems & Assessments National Security Information Systems Vulnerability Assessment Team (VAT) Radiation Detection & Response (RDR) Contact NPNS Other Major Programs Work with Argonne Contact us For Employees Site Map Help Join us on Facebook Follow us on Twitter NE Division on Flickr Nonproliferation and National Security Program (NPNS)

264

T-665: Microsoft Security Bulletin Advance Notification for July 2011 |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Microsoft Security Bulletin Advance Notification for July 5: Microsoft Security Bulletin Advance Notification for July 2011 T-665: Microsoft Security Bulletin Advance Notification for July 2011 July 11, 2011 - 7:28am Addthis PROBLEM: Microsoft Security Bulletin Advance Notification for July 2011 PLATFORM: Windows Operating System and Components ABSTRACT: Microsoft released 4 bulletins to address vulnerability involving Microsoft Office Suites and Software in Windows OS. This Microsoft Bulletin contains 1 Critical vulnerabilities which require a restart after the applied patch. The Exploitability Index, displays both CVE and Microsoft bulletin ID associated to vulnerability. reference LINKS: TechNet Webcast Microsoft Security Bulletin Summaries and Webcasts Microsoft Security Bulletin Advance Notification for July 2011

265

T-584: Microsoft March 2011 Security Bulletin Release | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

84: Microsoft March 2011 Security Bulletin Release 84: Microsoft March 2011 Security Bulletin Release T-584: Microsoft March 2011 Security Bulletin Release March 21, 2011 - 4:25pm Addthis PROBLEM: Microsoft March 2011 Security Bulletin Release PLATFORM: Please see the Microsoft listing for affected software and various Windows OS Platforms.(Affected Software and Download Locations) ABSTRACT: Microsoft released 3 bulletins to address vulnerabilities involving Microsoft Office Suites and Software in Windows OS. This Microsoft Bulletin contains 1 Critical vulnerabilities which require a restart after the applied patch. The Exploitability Index, displays both CVE and Microsoft bulletin ID associated to vulnerability. reference LINKS: Microsoft Security Bulletin Summary for March 2011 Microsoft Technical Security Notifications

266

Cyber Assessment Methods for SCADA Security | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Assessment Methods for SCADA Security Assessment Methods for SCADA Security Cyber Assessment Methods for SCADA Security This paper describes vulnerability assessment methodologies used in ongoing research and assessment activities designed to identify and resolve vulnerabilities so as to improve the security of the nation's critical infrastructure. The terrorist attacks of September 11, 2001 brought to light threats and vulnerabilities that face the United States. In response, the U.S. Government is directing the effort to secure the nation's critical infrastructure by creating programs to implement the National Strategy to Secure Cyberspace (1). One part of this effort involves assessing Supervisory Control and Data Acquisition (SCADA) systems. These systems are essential to the control of critical elements of our national

267

T-553: Microsoft February 2011 Security Bulletin Release | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

53: Microsoft February 2011 Security Bulletin Release 53: Microsoft February 2011 Security Bulletin Release T-553: Microsoft February 2011 Security Bulletin Release February 9, 2011 - 7:28am Addthis PROBLEM: Microsoft February 2011 Security Bulletin Release PLATFORM: Please see the Microsoft listing for affected software and various Windows OS Platforms. (Affected Software and Download Locations) ABSTRACT: Microsoft released 21 bulletins to address vulnerabilities involving Microsoft Office Suites and Software in Windows OS. This Microsoft Bulletin contains 3 Critical vulnerabilities which require a restart after the applied patch. The Exploitability Index, displays both CVE and Microsoft bulletin ID associated to vulnerability. reference links: Microsoft Security Bulletin Summary for February 2011 Microsoft Technical Security Notifications

268

Old Threats Never Die By: Gunter Ollmann, Director of Security Strategy  

E-Print Network (OSTI)

Old Threats Never Die By: Gunter Ollmann, Director of Security Strategy IBM Internet Security Systems #12;Table of Contents Threat Lifecycle 1 Malware Threat Lifecycle 2 Vulnerability Lifecycle 2 Conclusions 12 #12;Old Threats Never Die Page 1 With year-on-year increases in vulnerabilities, malware

269

Protocol, Security Assistance - January 2007 | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Protocol, Security Assistance - January 2007 Protocol, Security Assistance - January 2007 Protocol, Security Assistance - January 2007 January 2007 Provide timely technical assistance and system support to Field and HQ Elements to enhance site safeguards and security. The Assistance Program is comprised of technologists and subject matter experts from all the S&S disciplines and technical areas including Program Planning Management and Support, Advanced Security Technologies, Protective Force, Physical Security, Information Protection, Safeguards and Security Construction Projects, Vulnerability Assessments, and Nuclear Materials Control and Accountability. Our commitment is to continue to build an assistance program dedicated to serving the interests of the Department and our customers' S&S programs. Our emphasis remains

270

Security systems engineering overview  

SciTech Connect

Crime prevention is on the minds of most people today. The concern for public safety and the theft of valuable assets are being discussed at all levels of government and throughout the public sector. There is a growing demand for security systems that can adequately safeguard people and valuable assets against the sophistication of those criminals or adversaries who pose a threat. The crime in this country has been estimated at $70 billion in direct costs and up to $300 billion in indirect costs. Health insurance fraud alone is estimated to cost American businesses $100 billion. Theft, warranty fraud, and counterfeiting of computer hardware totaled $3 billion in 1994. A threat analysis is a prerequisite to any security system design to assess the vulnerabilities with respect to the anticipated threat. Having established a comprehensive definition of the threat, crime prevention, detection, and threat assessment technologies can be used to address these criminal activities. This talk will outline the process used to design a security system regardless of the level of security. This methodology has been applied to many applications including: government high security facilities; residential and commercial intrusion detection and assessment; anti-counterfeiting/fraud detection technologies (counterfeit currency, cellular phone billing, credit card fraud, health care fraud, passport, green cards, and questionable documents); industrial espionage detection and prevention (intellectual property, computer chips, etc.); and security barrier technology (creation of delay such as gates, vaults, etc.).

Steele, B.J.

1996-12-31T23:59:59.000Z

271

U-011: Cisco Security Response: Cisco TelePresence Video Communication  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

1: Cisco Security Response: Cisco TelePresence Video 1: Cisco Security Response: Cisco TelePresence Video Communication Server Cross-Site Scripting Vulnerability U-011: Cisco Security Response: Cisco TelePresence Video Communication Server Cross-Site Scripting Vulnerability October 14, 2011 - 12:30pm Addthis PROBLEM: Cisco Security Response: Cisco TelePresence Video Communication Server Cross-Site Scripting Vulnerability PLATFORM: Version(s): VCS prior to 7.0 ABSTRACT: A vulnerability was reported in Cisco TelePresence Video Communication Server. A remote user can conduct cross-site scripting attacks. reference LINKS: Cisco Document ID: 113264 SecurityTracker Alert ID: 1026186 CVE-2011-3294 IMPACT ASSESSMENT: Medium Discussion: A vulnerability exists in Cisco TelePresence Video Communication Server (VCS) due to improper validation of user-controlled input to the web-based

272

Improving tamper detection for hazardous waste security  

SciTech Connect

After September 11, waste managers are increasingly expected to provide improved levels of security for the hazardous materials in their charge. Many low-level wastes that previously had minimal or no security must now be well protected, while high-level wastes require even greater levels of security than previously employed. This demand for improved security comes, in many cases, without waste managers being provided the necessary additional funding, personnel, or security expertise. Contributing to the problem is the fact that--at least in our experience--waste managers often fail to appreciate certain types of security vulnerabilities. They frequently overlook or underestimate the security risks associated with disgruntled or compromised insiders, or the potential legal and political liabilities associated with nonexistent or ineffective security. Also frequently overlooked are potential threats from waste management critics who could resort to sabotage, vandalism, or civil disobedience for purposes of discrediting a waste management program.

Johnston, R. G. (Roger G.); Garcia, A. R. E. (Anthony R. E.); Pacheco, A. N. (Adam N.); Trujillo, S. J. (Sonia J.); Martinez, R. K. (Ronald K.); Martinez, D. D. (Debbie D.); Lopez, L. N. (Leon N.)

2002-01-01T23:59:59.000Z

273

U-184: Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

U-184: Mozilla Firefox Multiple Bugs Let Remote Users Execute U-184: Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary Code U-184: Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary Code June 6, 2012 - 7:00am Addthis PROBLEM: Multiple vulnerabilities were reported in Mozilla Firefox. PLATFORM: Version(s): prior to 13.0 ABSTRACT: A remote user can cause arbitrary code to be executed on the target user's system. A remote user can conduct cross-site scripting attacks. A remote user can obtain potentially sensitive information. Reference Links: Security Tracker ID 1027120 CVE-2012-0441,CVE-2012-1937 Vendor URL IMPACT ASSESSMENT: High Discussion: A remote user can create specially crafted content that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code on the target system [CVE-2012-1937 , CVE-2012-1938, CVE-2012-1939 ].

274

U-277: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Google Chrome Multiple Flaws Let Remote Users Execute 7: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code U-277: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code October 9, 2012 - 6:00am Addthis PROBLEM: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Version(s): prior to 22.0.1229.92 ABSTRACT: Several vulnerabilities were reported in Google Chrome. reference LINKS: SecurityTracker Alert ID: 1027617 Stable Channel Update CVE-2012-2900 CVE-2012-5108 CVE-2012-5109 CVE-2012-5110 CVE-2012-5111 IMPACT ASSESSMENT: High Discussion: A remote user can create specially crafted content that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user. A crash may occur in Skia text rendering [CVE-2012-2900].

275

U-160: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

60: Google Chrome Multiple Flaws Let Remote Users Execute 60: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code U-160: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code May 2, 2012 - 7:00am Addthis PROBLEM: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Prior to 18.0.1025.168 ABSTRACT: Several vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system reference LINKS: SecurityTracker Alert ID: 1027001 CVE-2011-3078 CVE-2011-3079 CVE-2011-3080 IMPACT ASSESSMENT: High Discussion: A remote user can create specially crafted content that, when loaded by the target user, will trigger a use-after-free, validation error, or race condition and execute arbitrary code on the target system. The code will

276

U-160: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Google Chrome Multiple Flaws Let Remote Users Execute 0: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code U-160: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code May 2, 2012 - 7:00am Addthis PROBLEM: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Prior to 18.0.1025.168 ABSTRACT: Several vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system reference LINKS: SecurityTracker Alert ID: 1027001 CVE-2011-3078 CVE-2011-3079 CVE-2011-3080 IMPACT ASSESSMENT: High Discussion: A remote user can create specially crafted content that, when loaded by the target user, will trigger a use-after-free, validation error, or race condition and execute arbitrary code on the target system. The code will

277

287 Security Blunders You Should Avoid  

NLE Websites -- All DOE Office Websites (Extended Search)

Security Blunders ! Security Blunders ! You Should Avoid" Jon S. Warner, Ph.D. Roger G. Johnston, Ph.D., CPP Vulnerability Assessment Team Argonne National Laboratory 630-252-6168 rogerj@anl.gov http://www.ne.anl.gov/capabilities/vat Presentation for the ASIS International Annual Meeting! Anaheim, CA, September 21-24, 2009! Sponsors! *! DHS! *! DoD! *! DOS! *! IAEA! *! Euratom! *! DOE/NNSA! *! private companies! *! intelligence agencies! *! public interest organizations! The VAT has done detailed ! vulnerability assessments on! hundreds of different security! devices, systems, & programs.! Vulnerability Assessment Team (VAT)" The greatest of faults, I should say, is to be conscious of none. -- Thomas Carlyle (1795-1881) A multi-disciplinary team of physicists,

278

Securing Infrastructure from High Explosive Threats  

SciTech Connect

Lawrence Livermore National Laboratory (LLNL) is working with the Department of Homeland Security's Science and Technology Directorate, the Transportation Security Administration, and several infrastructure partners to characterize and help mitigate principal structural vulnerabilities to explosive threats. Given the importance of infrastructure to the nation's security and economy, there is a clear need for applied research and analyses (1) to improve understanding of the vulnerabilities of these systems to explosive threats and (2) to provide decision makers with time-critical technical assistance concerning countermeasure and mitigation options. Fully-coupled high performance calculations of structural response to ideal and non-ideal explosives help bound and quantify specific critical vulnerabilities, and help identify possible corrective schemes. Experimental validation of modeling approaches and methodologies builds confidence in the prediction, while advanced stochastic techniques allow for optimal use of scarce computational resources to efficiently provide infrastructure owners and decision makers with timely analyses.

Glascoe, L; Noble, C; Reynolds, J; Kuhl, A; Morris, J

2009-03-20T23:59:59.000Z

279

CLIMATE CHANGE IMPACTS, VULNERABILITIES, AND  

E-Print Network (OSTI)

CLIMATE CHANGE IMPACTS, VULNERABILITIES, AND ADAPTATION IN THE SAN FRANCISCO BAY AREA Commission's California Climate Change Center JULY 2012 CEC5002012071 Prepared for: California Energy, as well as projections of future changes in climate based on modeling studies using various plausible

280

Threat Insight Quarterly Vulnerability Management  

E-Print Network (OSTI)

X-Force ® Threat Insight Quarterly Vulnerability Management July 2006 #12;X - F O R C E T H R E.................. 7 X-Force Catastrophic Risk Index.............................. 10 Future X-Force Threat Insight Introduction There is a wide range of threats that can exist in any network. The presence of unpatched

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


281

V-164: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Apple QuickTime Multiple Flaws Let Remote Users Execute 4: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary Code V-164: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary Code May 27, 2013 - 12:23am Addthis PROBLEM: Apple QuickTime Multiple Flaws Let Remote Users Execute Arbitrary Code PLATFORM: Apple QuickTime prior to 7.7.4. ABSTRACT: Apple QuickTime Multiple Vulnerabilities REFERENCE LINKS: Apple Article: HT5770 SecurityTracker Alert ID: 1028589 Secunia Advisory SA53520 CVE-2013-0986, CVE-2013-0987, CVE-2013-0988 CVE-2013-0989, CVE-2013-1015, CVE-2013-1016 CVE-2013-1017, CVE-2013-1018, CVE-2013-1019 CVE-2013-1020, CVE-2013-1021, CVE-2013-1022 IMPACT ASSESSMENT: High DISCUSSION: Multiple vulnerabilities have been reported in Apple QuickTime, which can be exploited by malicious people to compromise a user's system.

282

COMMON VULNERABILITIES IN CRITICAL INFRASTRUCTURE CONTROL SYSTEMS  

NLE Websites -- All DOE Office Websites (Extended Search)

enforcement and auditing. Page 114 SECURITY POLICY Figure 1. PCS administration. A security plan documents the overall security architecture for a system or subsystem. Typical...

283

Safeguarding Children and Vulnerable Adults Introduction  

E-Print Network (OSTI)

Safeguarding Children and Vulnerable Adults Introduction The University is expected and has a responsibility to take appropriate steps to safeguard children and vulnerable adults who are on University · Safeguarding:"Institutionshaveanenhanceddutytowardschildren,andsafeguardingispartofthatcommon-lawdutyof care

Aickelin, Uwe

284

U-120: RSA SecurID Software Token Converter Unspecified Buffer Overflow  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: RSA SecurID Software Token Converter Unspecified Buffer 0: RSA SecurID Software Token Converter Unspecified Buffer Overflow Vulnerability U-120: RSA SecurID Software Token Converter Unspecified Buffer Overflow Vulnerability March 8, 2012 - 7:00am Addthis PROBLEM: RSA SecurID Software Token Converter Unspecified Buffer Overflow Vulnerability PLATFORM: RSA SecurID Software Token Converter 2.x ABSTRACT: Successful exploitation may allow execution of arbitrary code. reference LINKS: Secunia Advisory SA48297 CVE-2012-0397 IMPACT ASSESSMENT: High Discussion: A vulnerability has been reported in RSA SecurID Software Token Converter, which can be exploited by malicious people to compromise a user's system. Impact: An unspecified error can be exploited to cause a buffer overflow. Solution: Update to version 2.6.1. Addthis Related Articles

285

Framework for SCADA Security Policy (October 2005) | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Framework for SCADA Security Policy (October 2005) Framework for SCADA Security Policy (October 2005) Framework for SCADA Security Policy (October 2005) Modern automation systems used in infrastruc-ture (including Supervisory Control and Data Acquisition, or SCADA) have myriad security vulnerabilities. Many of these relate directly to inadequate security administration, which precludes truly effective and sustainable security. Adequate security management mandates a clear administrative struc-ture and enforcement hierarchy. The security policy is the root document, with sections covering purpose, scope, posi-tions, responsibilities, references, revision history, enforce-ment, and exceptions for various subjects relevant for system security. It covers topics including the overall security risk management program, data security, platforms,

286

U-149: Apache OFBiz Cross-Site Scripting and Code Execution Vulnerabilities  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

9: Apache OFBiz Cross-Site Scripting and Code Execution 9: Apache OFBiz Cross-Site Scripting and Code Execution Vulnerabilities U-149: Apache OFBiz Cross-Site Scripting and Code Execution Vulnerabilities April 17, 2012 - 8:00am Addthis PROBLEM: Multiple vulnerabilities have been reported in Apache OFBiz, which can be exploited by malicious people to conduct cross-site scripting attacks and compromise a vulnerable system. PLATFORM: Apache OFBiz 10.x ABSTRACT: The vulnerabilities are reported in version 10.04.01. Prior versions may also be affected. references LINKS: Vendor Advisory Secunia Advisory 48800 CVE-2012-1621 IMPACT ASSESSMENT: High Discussion: 1) Certain unspecified input is not properly sanitised within the "getServerError()" function in checkoutProcess.js before being returned to the user. This can be exploited to execute arbitrary HTML and script code

287

Security Rulemaking | Department of Energy  

Office of Environmental Management (EM)

Security Rulemaking Security Rulemaking Transportation Security Rulemaking Activities Security Rulemaking More Documents & Publications Transportation Security Rulemaking...

288

Security | Y-12 National Security Complex  

NLE Websites -- All DOE Office Websites (Extended Search)

Security Security The Y-12 National Security Complex places the highest priority on maintaining and improving its security posture. We employ security police officers, cyber...

289

V-237: TYPO3 Security Bypass Vulnerabilities | Department of...  

Energy Savers (EERE)

check by inserting certain special characters and e.g. rename files to have the PHP file extension. IMPACT: Cross-Site Scripting Remote Code Execution SOLUTION: Vendor...

290

U.S. Energy Sector Vulnerabilities to Climate Change and Extreme Weather |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

U.S. Energy Sector Vulnerabilities to Climate Change and Extreme U.S. Energy Sector Vulnerabilities to Climate Change and Extreme Weather U.S. Energy Sector Vulnerabilities to Climate Change and Extreme Weather This report-part of the Administration's efforts to support national climate change adaptation planning through the Interagency Climate Change Adaptation Task Force and Strategic Sustainability Planning process established under Executive Order 13514 and to advance the U.S. Department of Energy's goal of promoting energy security-examines current and potential future impacts of these climate trends on the U.S. energy sector. Report updated July 16, 2013. Explore an interactive map that shows where climate change has already impacted the energy sector. US Energy Sector Vulnerabilities to Climate Change More Documents & Publications

291

T-668: Vulnerability in a BlackBerry Enterprise Server component could  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: Vulnerability in a BlackBerry Enterprise Server component 8: Vulnerability in a BlackBerry Enterprise Server component could allow information disclosure and partial denial of service T-668: Vulnerability in a BlackBerry Enterprise Server component could allow information disclosure and partial denial of service July 14, 2011 - 7:20am Addthis PROBLEM: Vulnerability in a BlackBerry Enterprise Server component could allow information disclosure and partial denial of service PLATFORM: Affected Software >> BlackBerry Enterprise Server (BES) version(s) 5.0.0 for API/MS Exchange (Admin API Option Only), BES/Express version 5.0.2 & 5.0.3 IBM Lotus Domino , BES 5.0.1, 5.0.2 & 5.0.3 for MS Exchange, IBM Lotus Domino, BlackBerry Enterprise Server versions 5.0.1 for GroupWise ABSTRACT: This advisory describes a security issue in the BlackBerry Administration

292

U.S. Energy Sector Vulnerabilities to Climate Change and Extreme Weather |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

U.S. Energy Sector Vulnerabilities to Climate Change and Extreme U.S. Energy Sector Vulnerabilities to Climate Change and Extreme Weather U.S. Energy Sector Vulnerabilities to Climate Change and Extreme Weather This report-part of the Administration's efforts to support national climate change adaptation planning through the Interagency Climate Change Adaptation Task Force and Strategic Sustainability Planning process established under Executive Order 13514 and to advance the U.S. Department of Energy's goal of promoting energy security-examines current and potential future impacts of these climate trends on the U.S. energy sector. Report updated July 16, 2013. Explore an interactive map that shows where climate change has already impacted the energy sector. US Energy Sector Vulnerabilities to Climate Change More Documents & Publications

293

Control Systems Security Publications Library | Department of Energy  

NLE Websites -- All DOE Office Websites (Extended Search)

Publications Library Publications Library Control Systems Security Publications Library Publications Library Repository of documents, listed by topic. (Some of the documents in this section require Adobe Acrobat Reader. You can download a free copy of the Reader by visiting Adobe.) VULNERABILITY REPORTS PERIODICAL ARTICLES ENERGY SECTOR ROADMAP AND ROADMAP IMPLEMENTATION DOE NSTB PROGRAM PLANNING AND RESOURCE DOCUMENTS PROJECT FACT SHEETS TRAINING MATERIALS AND RECOMMENDED PRACTICES ASSESSMENT AND TECHNICAL PUBLICATIONS SANDIA NATIONAL LABORATORIES REPORTS FOR NSTB PACIFIC NORTHWEST NATIONAL LABORATORY REPORTS FOR NSTB IDAHO NATIONAL LABORATORY REPORTS FOR NSTB FEDERAL GUIDANCE AND POLICY DOCUMENTS VULNERABILITY REPORTS INL Common Vulnerabilities Report - 2008 NERC Top 10 Vulnerabilities of Control Systems and Their Associated

294

Cyber Security  

Office of Environmental Management (EM)

Associate CIO for Cyber Security (IM-30) Rod Turk Deputy Associate CIO for Cyber Security (IM-30) Paul Cunningham Incident Management Division (IM-32) Rob Ciochon Director Policy,...

295

Cyber Security Requirements for Risk Management  

Directives, Delegations, and Requirements

The Notice ensures that system owners consistently assess the threats to and vulnerabilities of systems in order to implement adequate security controls. The Notice will also ensure compliance with the requirements of DOE O 205.1, Department of Energy Cyber Security Management Program, dated 3-21-03, and protect DOE information and information systems from unauthorized access, use, disclosure, modification, or destruction. DOE N 205.15, dated 3/18/05, extends this directive until 3/18/06.

2004-02-19T23:59:59.000Z

296

Microgrid cyber security reference architecture.  

SciTech Connect

This document describes a microgrid cyber security reference architecture. First, we present a high-level concept of operations for a microgrid, including operational modes, necessary power actors, and the communication protocols typically employed. We then describe our motivation for designing a secure microgrid; in particular, we provide general network and industrial control system (ICS)-speci c vulnerabilities, a threat model, information assurance compliance concerns, and design criteria for a microgrid control system network. Our design approach addresses these concerns by segmenting the microgrid control system network into enclaves, grouping enclaves into functional domains, and describing actor communication using data exchange attributes. We describe cyber actors that can help mitigate potential vulnerabilities, in addition to performance bene ts and vulnerability mitigation that may be realized using this reference architecture. To illustrate our design approach, we present a notional a microgrid control system network implementation, including types of communica- tion occurring on that network, example data exchange attributes for actors in the network, an example of how the network can be segmented to create enclaves and functional domains, and how cyber actors can be used to enforce network segmentation and provide the neces- sary level of security. Finally, we describe areas of focus for the further development of the reference architecture.

Veitch, Cynthia K.; Henry, Jordan M.; Richardson, Bryan T.; Hart, Derek H.

2013-07-01T23:59:59.000Z

297

A Learning-Based Approach to Reactive Security  

E-Print Network (OSTI)

Terms--Reactive security, risk management, attack graphs, online learning, adversarial learning, game vulnerability is plugged, CISOs typically perform a cost- benefit analysis to identify which risks to address of reactive strategies in an economic model of the CISO's security cost-benefit trade- offs. Unlike previously

Song, Dawn

298

A Formal Framework for Secure Routing Protocols Wenchao Zhou3  

E-Print Network (OSTI)

verifies its security claims. Existing model-checking-based protocol analysis tools cannot be directlyA Formal Framework for Secure Routing Protocols Chen Chen1 Limin Jia2 Hao Xu1 Cheng Luo1 Wenchao routing protocol, is vulner- able to various attacks. Redesigns of Internet routing infrastructure (e.g. S

Sandholm, Tuomas W.

299

Information security: where computer science, economics and psychology meet  

Science Journals Connector (OSTI)

...trade became too hazardous. Camp Wolfram (2000) built on this...vulnerabilities There has been debate for centuries about whether security is helped...Cambridge, UK, 26-28 June 2006. Camp, J. Wolfram, C. 2000 Pricing...information security L.J. Camp and S. Lewis2004pp. 1-15...

2009-01-01T23:59:59.000Z

300

V-196: Microsoft Security Bulletin Advance Notification for July 2013  

Energy.gov (U.S. Department of Energy (DOE))

Microsoft Security Bulletin Advance Notification for July 2013. Microsoft has posted 6 Critical Bulletin and 1 Important Bulletins. Bulletins with the Maximum Severity Rating and Vulnerability Impact of "Critical" July allow remote execution of code. Microsoft will host a webcast to address customer questions on the security bulletins on July 10, 2013, at 11:00 AM Pacific Time (US & Canada).

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


301

V-057: eXtplorer "ext_find_user()" Authentication Bypass Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: eXtplorer "ext_find_user()" Authentication Bypass 7: eXtplorer "ext_find_user()" Authentication Bypass Vulnerability V-057: eXtplorer "ext_find_user()" Authentication Bypass Vulnerability December 28, 2012 - 6:00am Addthis PROBLEM: eXtplorer "ext_find_user()" Authentication Bypass Vulnerability PLATFORM: eXtplorer 2.x ABSTRACT: A vulnerability has been reported in eXtplorer, which can be exploited by malicious people to bypass certain security restrictions. REFERENCE LINKS: Secunia Advisory SA51636 eXtplorer 2.1.3 Security Release IMPACT ASSESSMENT: Medium DISCUSSION: eXtplorer was notified of a problem within the authentication system of eXtplorer Versions 2.1.2, 2.1.1, 2.1.0 and 2.1.0RC5 that have been found to be vulnerable to an authentication bypass bug. IMPACT: An error within the "ext_find_user()" function in users.php can be

302

V-216: Drupal Monster Menus Module Security Bypass and Script Insertion  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

216: Drupal Monster Menus Module Security Bypass and Script 216: Drupal Monster Menus Module Security Bypass and Script Insertion Vulnerabilities V-216: Drupal Monster Menus Module Security Bypass and Script Insertion Vulnerabilities August 12, 2013 - 6:00am Addthis PROBLEM: Two vulnerabilities have been reported in the Monster Menus module for Drupal PLATFORM: Drupal Monster Menus Module 6.x and 7.x ABSTRACT: The vulnerabilities can be exploited by malicious users to bypass certain security restrictions and conduct script insertion attacks. REFERENCE LINKS: Secunia Advisory SA54391 Drupal Security Advisory CVE-2013-4229 CVE-2013-4230 IMPACT ASSES SMENT: Medium DISCUSSION: 1) Input passed via the title when editing page settings is not properly sanitised before being edited the next time. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's

303

Security API analysis with the spi-calculus Levente Buttyn Ta Vinh Thong  

E-Print Network (OSTI)

Security API analysis with the spi-calculus Levente Buttyán Ta Vinh Thong buttyan@crysys.hu thong of Technology and Economics Abstract: API level vulnerabilities of hardware security modules represent a serious threat, thus, discovering and patching security holes in APIs are important. In this paper, we argue

Levente, Buttyán

304

SP 800-61 Rev. 1. Computer Security Incident Handling Guide  

Science Journals Connector (OSTI)

Computer security incident response has become an important component of information technology (IT) programs. Security-related threats have become not only more numerous and diverse but also more damaging and disruptive. An incident response capability ... Keywords: Computer security incident, incident handling, incident response, threats, vulnerabilities

Karen A. Scarfone; Timothy Grance; Kelly Masone

2008-03-01T23:59:59.000Z

305

Economic vulnerability to Peak Oil  

Science Journals Connector (OSTI)

Abstract Peak Oil, which refers to the maximum possible global oil production rate, is increasingly gaining attention in both science and policy discourses. However, little is known about how this phenomenon will impact economies, despite its apparent imminence and potential dangers. In this paper, we construct a vulnerability map of the U.S. economy, combining two approaches for analyzing economic systems, i.e. inputoutput analysis and social network analysis (applied to economic data). Our approach reveals the relative importance of individual economic sectors, and how vulnerable they are to oil price shocks. As such, our dual-analysis helps identify which sectors, due to their strategic position, could put the entire U.S. economy at risk from Peak Oil. For the U.S., such sectors would include Iron Mills, Fertilizer Production and Transport by Air. Our findings thus provide early warnings to downstream companies about potential trouble in their supply chain, and inform policy action for Peak Oil. Although our analysis is embedded in a Peak Oil narrative, it is just as valid and useful in the context of developing a climate roadmap toward a low carbon economy.

Christian Kerschner; Christina Prell; Kuishuang Feng; Klaus Hubacek

2013-01-01T23:59:59.000Z

306

Assessing Climate Change Impacts, Vulnerability and Adaptation...  

Open Energy Info (EERE)

The Case of Pantabangan-Carranglan Watershed Jump to: navigation, search Name Assessing Climate Change Impacts, Vulnerability and Adaptation: The Case of Pantabangan-Carranglan...

307

Information Security: Coordination of Federal Cyber Security...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Security: Coordination of Federal Cyber Security Research and Development Information Security: Coordination of Federal Cyber Security Research and Development GAO recommends that...

308

Fuzzy integrated vulnerability assessment model for critical facilities in combating the terrorism  

Science Journals Connector (OSTI)

Critical facility vulnerability assessment is a highly complex strategic activity in combating the terrorism and necessitates a structured quantified methodology to support the decision-making process in defense planning. In the system perspective, the critical facility, such as airport, dam, governmental facility, harbor, nuclear power plant, oil plant etc., can be defined as a system that relies on a group of different interdependent logical and physical entities as system functions and system components. The aim of this paper is to present a realistic approach to determine the vulnerability of such a system defended against the terrorist attack under multiple criteria which can be both qualitative and quantitative by considering these interdependencies. The proposed approach, called fuzzy integrated vulnerability assessment model (FIVAM), is based on fuzzy set theory, Simple Multi-Attribute Rating Technique (SMART) and Fuzzy Cognitive Maps (FCM) methodology in a group decision-making environment. The FIVAM approach is presented step-by-step and applied to a simple case study on airport vulnerability assessment. The results of the application are compared to those observed through a classical vulnerability assessment model to illustrate the effectiveness of the FIVAM. Furthermore, FIVAM provides a framework to identify the hidden vulnerabilities caused by the functional interdependencies within the system. The results also show that FIVAM quantifies the vulnerability of the system, system functions and system components, and determines the most critical functions and components by simulating the system behavior.

Ilker Akgun; Ahmet Kandakoglu; Ahmet Fahri Ozok

2010-01-01T23:59:59.000Z

309

Developing a Taxonomy for Various Types of Security Force Positions  

NLE Websites -- All DOE Office Websites (Extended Search)

UR 04-7226 Security Assignments 1 UR 04-7226 Security Assignments 1 Journal of Security Administration 26(2): 1-11 (2003) A TAXONOMY FOR SECURITY ASSIGNMENTS Edward G. Bitzer III, M.A. and Roger G. Johnston, Ph.D., CPP Vulnerability Assessment Team Los Alamos National Laboratory LA-UR 04-7226 Security Assignments 2 Abstract Despite its importance in most security plans, the position of security guard has undergone very little systematic examination. In response this paper proposes a formal taxonomy of security guard positions as a starting point for research. A number of procedures that could be used to test the taxonomy are proposed. Finally, implications of this work are discussed for both researchers and practitioners in the security field.

310

Hallmark Project Commercialization of the Secure SCADA Communications  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Project Commercialization of the Secure SCADA Project Commercialization of the Secure SCADA Communications Protocol, a cryptographic security solution for device-to-device communication Hallmark Project Commercialization of the Secure SCADA Communications Protocol, a cryptographic security solution for device-to-device communication Increased connectivity and automation in the control systems that manage the nation's energy infrastructure have improved system functionality, but left systems more vulnerable to cyber attack. Intruders could severely disrupt control system operation by sending fabricated information or commands to control system devices. To ensure message integrity, supervisory control and data acquisition (SCADA) systems require a method to validate device-to-device communication and verify that information has

311

V-033: ownCloud Cross-Site Scripting and File Upload Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: ownCloud Cross-Site Scripting and File Upload 3: ownCloud Cross-Site Scripting and File Upload Vulnerabilities V-033: ownCloud Cross-Site Scripting and File Upload Vulnerabilities November 26, 2012 - 2:00am Addthis PROBLEM: ownCloud Cross-Site Scripting and File Upload Vulnerabilities PLATFORM: ownCloud 4.5.2, 4.5.1, 4.0.9 ABSTRACT: Multiple vulnerabilities have been reported in ownCloud REFERENCE LINKS: ownCloud Server Advisories Secunia Advisory SA51357 IMPACT ASSESSMENT: Medium DISCUSSION: 1) Input passed via the filename to apps/files_versions/js/versions.js and apps/files/js/filelist.js and event title to 3rdparty/fullcalendar/js/fullcalendar.js is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

312

T-626: Xen Multiple Buffer Overflow and Integer Overflow Vulnerabiliti...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

RedHat Enterprise Linux Desktop Multi OS 5 client ,RedHat Enterprise Linux 5 server, Red Hat Fedora 15 ,and Red Hat Enterprise Linux Desktop 5 client ABSTRACT: It was found...

313

V-157: Adobe Reader / Acrobat Multiple Vulnerabilities | Department...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

the Adobe Reader sandbox protection. 5) An unspecified error related to the Javascript API can be exploited to disclose certain information. 6) An unspecified error can be...

314

U-146: Adobe Reader/Acrobat Multiple Vulnerabilities | Department...  

Energy Savers (EERE)

of sensitive information System access Solution: The vendor has issued a fix. The patch is available at Adobe downloads Addthis Related Articles V-066: Adobe AcrobatReader...

315

V-029: Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

29: Mozilla Firefox Multiple Bugs Let Remote Users Execute 29: Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting Attacks V-029: Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting Attacks November 21, 2012 - 2:00am Addthis PROBLEM: Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting Attacks PLATFORM: Version(s): prior to 17.0 ABSTRACT: Multiple vulnerabilities were reported in Mozilla Firefox REFERENCE LINKS: Mozilla Foundation Security Advisories Bugtraq ID: 55260 SecurityTracker Alert ID: 1027791 CVE-2012-4201, CVE-2012-4202, CVE-2012-4203, CVE-2012-4204, CVE-2012-4205, CVE-2012-4206, CVE-2012-4207,CVE-2012-4208, CVE-2012-4209, CVE-2012-4210, CVE-2012-4212, CVE-2012-4213, CVE-2012-4214, CVE-2012-4215, CVE-2012-4216,

316

Security Cases  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

security-cases Office of Hearings and Appeals 1000 security-cases Office of Hearings and Appeals 1000 Independence Ave., SW Washington, DC, 20585 202-287-1566 en PSH-13-0103 - In the Matter of Personnel Security http://energy.gov/oha/downloads/psh-13-0103-matter-personnel-security security" class="title-link">PSH-13-0103 - In the Matter of Personnel Security

317

Infrastructure Security  

NLE Websites -- All DOE Office Websites (Extended Search)

for the U.S. Department of Energy's National Nuclear Security Administration under contract DE-AC04-94AL85000. SAND2013-7809W to enhance the nation's security and prosperity...

318

U-190: Microsoft Security Bulletin MS12-037 - Critical | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Microsoft Security Bulletin MS12-037 - Critical 0: Microsoft Security Bulletin MS12-037 - Critical U-190: Microsoft Security Bulletin MS12-037 - Critical June 13, 2012 - 3:30pm Addthis PROBLEM: Microsoft Security Bulletin MS12-037 - Critical PLATFORM: Internet Explorer 8.x ABSTRACT: This security update resolves one publicly disclosed and twelve privately reported vulnerabilities in Internet Explorer. LINKS: Microsoft Security Bulletin MS12-037 - Critical Secunia Advisory SA49412 IMPACT ASSESSMENT: High Discussion: The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who

319

Detecting Network Vulnerabilities Through Graph Theoretical Methods  

E-Print Network (OSTI)

benchmark power networks. 1 Introduction The electric power grid network is susceptible to power outages of our work is power networks, our techniques are applicable to other systems such as the transportation vulnerabilities in power networks is an important prob- lem, as even a small number of vulnerable connections can

Geddes, Cameron Guy Robinson

320

T-528: Mozilla Firefox/Thunderbird/SeaMonkey Multiple HTML Injection  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: Mozilla Firefox/Thunderbird/SeaMonkey Multiple HTML 8: Mozilla Firefox/Thunderbird/SeaMonkey Multiple HTML Injection Vulnerabilities T-528: Mozilla Firefox/Thunderbird/SeaMonkey Multiple HTML Injection Vulnerabilities January 5, 2011 - 2:28pm Addthis PROBLEM: Mozilla Firefox/Thunderbird/SeaMonkey Multiple HTML Injection Vulnerabilities PLATFORM: Mozilla Firefox 3.5.11 - 3.6.10, Mozilla SeaMonkey 2.0 - 2.0.9 Vulnerable Platforms Details ABSTRACT: Mozilla Firefox/Thunderbird/SeaMonkey Multiple HTML Injection Vulnerabilities. Mozilla Firefox, SeaMonkey, and Thunderbird are prone to multiple HTML-injection vulnerabilities. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


321

T-585: Mac OS X v10.6.7 Security Update 2011-001 | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

85: Mac OS X v10.6.7 Security Update 2011-001 85: Mac OS X v10.6.7 Security Update 2011-001 T-585: Mac OS X v10.6.7 Security Update 2011-001 March 22, 2011 - 2:02pm Addthis PROBLEM: Mac OS X v10.6.7 Security Update 2011-001 PLATFORM: Mac OS X 10.3, Mac OS X 10.4, Mac OS X 10.6, Mac OS X 10.5.(Affected Software and Download Locations) ABSTRACT: Mac OS Update: Mac OS 10.6.7 fixes multiple vulnerabilities in the following release. This update can be installed on non-startup volumes, but you should only do this if the current startup volume has already been updated to Mac OS X Server v10.6.7. The simplest way to avoid issues from an improper installation is to start up from the volume that you wish to update. reference LINKS: APPLE-SA-2011-03-21-1 Mac OS X v10.6.7 About the Mac OS X Server v10.6.7 Update Apple security updates

322

V-177: VMware vCenter Chargeback Manager File Upload Handling Vulnerability  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

177: VMware vCenter Chargeback Manager File Upload Handling 177: VMware vCenter Chargeback Manager File Upload Handling Vulnerability V-177: VMware vCenter Chargeback Manager File Upload Handling Vulnerability June 13, 2013 - 6:00am Addthis PROBLEM: vCenter Chargeback Manager Remote Code Execution PLATFORM: VMware vCenter Chargeback Manager 2.x ABSTRACT: The vCenter Chargeback Manager contains a critical vulnerability that allows for remote code execution REFERENCE LINKS: Secunia Advisory SA53798 VMWare Security Advisory VMSA-2013-0008 CVE-2013-3520 IMPACT ASSESSMENT: Medium DISCUSSION: The vCenter Chargeback Manager (CBM) contains a flaw in its handling of file uploads. Exploitation of this issue may allow an unauthenticated attacker to execute code remotely. IMPACT: System Access SOLUTION: Vendor recommends updating to version 2.5.1

323

Vulnerability Take Grant (VTG): An efficient approach to analyze network vulnerabilities  

Science Journals Connector (OSTI)

Modeling and analyzing information system vulnerabilities help predict possible attacks to computer networks using vulnerabilities information and the network configuration. In this paper, we propose a comprehensive approach to analyze network vulnerabilities in order to answer the safety problem focusing on vulnerabilities. The approach which is called Vulnerability Take Grant (VTG) is a graph-based model consists of subject/objects as nodes and rights/relations as edges to represent the system protection state. Each node may have properties including single vulnerabilities such as buffer overflow. We use the new concept of vulnerability rewriting rule to specify the requirements and consequences of exploiting vulnerabilities. Analysis of the model is achieved using our bounded polynomial algorithm, which generates the most permissive graph in order to verify whether a subject can obtain an access right over an object. The algorithm also finds the likely attack scenarios. Applicability of the approach is investigated by modeling widespread vulnerabilities in their general patterns. A real network is modeled as a case study in order to examine how an attacker can gain unauthorized access via exploiting the chain of vulnerabilities. Our experience shows the efficiency, applicability, and expressiveness in modeling a broader range of vulnerabilities in our approach in comparison to the previous approaches.

Hamid Reza Shahriari; Rasool Jalili

2007-01-01T23:59:59.000Z

324

Climate Change and Infrastructure, Urban Systems, and Vulnerabilities  

SciTech Connect

This Technical Report on Climate Change and Infrastructure, Urban Systems, and Vulnerabilities has been prepared for the U.S. Department of Energy by the Oak Ridge National Laboratory in support of the U.S. National Climate Assessment (NCA). It is a summary of the currently existing knowledge base on its topic, nested within a broader framing of issues and questions that need further attention in the longer run. The report arrives at a number of assessment findings, each associated with an evaluation of the level of consensus on that issue within the expert community, the volume of evidence available to support that judgment, and the section of the report that provides an explanation for the finding. Cross-sectoral issues related to infrastructures and urban systems have not received a great deal of attention to date in research literatures in general and climate change assessments in particular. As a result, this technical report is breaking new ground as a component of climate change vulnerability and impact assessments in the U.S., which means that some of its assessment findings are rather speculative, more in the nature of propositions for further study than specific conclusions that are offered with a high level of confidence and research support. But it is a start in addressing questions that are of interest to many policymakers and stakeholders. A central theme of the report is that vulnerabilities and impacts are issues beyond physical infrastructures themselves. The concern is with the value of services provided by infrastructures, where the true consequences of impacts and disruptions involve not only the costs associated with the clean-up, repair, and/or replacement of affected infrastructures but also economic, social, and environmental effects as supply chains are disrupted, economic activities are suspended, and/or social well-being is threatened. Current knowledge indicates that vulnerability concerns tend to be focused on extreme weather events associated with climate change that can disrupt infrastructure services, often cascading across infrastructures because of extensive interdependencies threatening health and local economies, especially in areas where human populations and economic activities are concentrated in urban areas. Vulnerabilities are especially large where infrastructures are subject to multiple stresses, beyond climate change alone; when they are located in areas vulnerable to extreme weather events; and if climate change is severe rather than moderate. But the report also notes that there are promising approaches for risk management, based on emerging lessons from a number of innovative initiatives in U.S. cities and other countries, involving both structural and non-structural (e.g., operational) options.

Wilbanks, Thomas J [ORNL] [ORNL; Fernandez, Steven J [ORNL] [ORNL

2014-01-01T23:59:59.000Z

325

Lessons Learned from Cyber Security Assessments of SCADA and Energy Management Systems  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

U.S. Department of Energy U.S. Department of Energy Office of Electricity Delivery and Energy Reliability Enhancing control systems security in the energy sector NSTB September 2006 LESSONS LEARNED FROM CYBER SECURITY ASSESSMENTS OF SCADA AND ENERGY MANAGEMENT SYSTEMS Raymond K. Fink David F. Spencer Rita A. Wells NSTB INL/CON-06-11665 iii ABSTRACT Results from ten cyber security vulnerability assessments of process control, SCADA, and energy management systems, or components of those systems, were reviewed to identify common problem areas. The common vulnerabilities identified ranged from conventional IT security issues to specific weaknesses in control system protocols. In each vulnerability category, relative measures were assigned to the severity of the vulnerability and

326

U-060: Security update: Hotfix available for ColdFusion | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Security update: Hotfix available for ColdFusion 0: Security update: Hotfix available for ColdFusion U-060: Security update: Hotfix available for ColdFusion December 13, 2011 - 6:40am Addthis PROBLEM: Security update: Hotfix available for ColdFusion. PLATFORM: ColdFusion 9.0.1, 9.0, 8.0.1 and 8.0 for Windows, Macintosh and UNIX ABSTRACT: Vulnerabilities have been identified in ColdFusion 9.0.1 and earlier versions for Windows, Macintosh and UNIX. These vulnerabilities could lead to a cross-site scripting attack. Adobe categorizes this as an important update and recommends that users apply the latest update for their product installation.This update resolves a cross-site scripting vulnerability in cfform tag (CVE-2011-2463). This update resolves a cross-site scripting vulnerability in RDS (CVE-2011-4368).

327

Performing Energy Security Assessments- A How-To Guide for Federal Facility Managers  

Energy.gov (U.S. Department of Energy (DOE))

Guide describes the best practices and recommended process for federal facility managers to prepare for the following sections of a facilitys energy security plan: vulnerability assessments, energy preparedness and operations plans, and remedial action plans.

328

V-008: Debian Security Advisory | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: Debian Security Advisory 8: Debian Security Advisory V-008: Debian Security Advisory October 23, 2012 - 6:00am Addthis PROBLEM: Debian Security Advisory PLATFORM: Debian GNU/Linux 6.0 ABSTRACT: Debian update for bind9 REFERENCE LINKS: Debian Security Advisory DSA-2560-1 Debian bugtracking system: Bug 690118 ISC Reference Number: AA-00801 Secunia Advisory SA51054 CVE-2012-5166 IMPACT ASSESSMENT: Medium DISCUSSION: was discovered that BIND, a DNS server, hangs while constructing the additional section of a DNS reply, when certain combinations of resource records are present. This vulnerability affects both recursive and authoritative servers. For the stable distribution (squeeze), this problem has been fixed in version 1:9.7.3.dfsg-1~squeeze8. IMPACT: Debian has issued an update for bind9. This fixes a vulnerability, which

329

V-008: Debian Security Advisory | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

08: Debian Security Advisory 08: Debian Security Advisory V-008: Debian Security Advisory October 23, 2012 - 6:00am Addthis PROBLEM: Debian Security Advisory PLATFORM: Debian GNU/Linux 6.0 ABSTRACT: Debian update for bind9 REFERENCE LINKS: Debian Security Advisory DSA-2560-1 Debian bugtracking system: Bug 690118 ISC Reference Number: AA-00801 Secunia Advisory SA51054 CVE-2012-5166 IMPACT ASSESSMENT: Medium DISCUSSION: was discovered that BIND, a DNS server, hangs while constructing the additional section of a DNS reply, when certain combinations of resource records are present. This vulnerability affects both recursive and authoritative servers. For the stable distribution (squeeze), this problem has been fixed in version 1:9.7.3.dfsg-1~squeeze8. IMPACT: Debian has issued an update for bind9. This fixes a vulnerability, which

330

Nonproliferation and National Security Multimedia - Argonne National  

NLE Websites -- All DOE Office Websites (Extended Search)

Nonproliferation and National Security Nonproliferation and National Security > Multimedia Multimedia Nuclear Systems Analysis Engineering Analysis Nonproliferation and National Security Detection & Diagnostic Systems Engineering Development & Applications Argonne's Nuclear Science & Technology Legacy Other Multimedia Work with Argonne Contact us For Employees Site Map Help Join us on Facebook Follow us on Twitter NE on Flickr Bookmark and Share Nonproliferation and National Security: Multimedia Related Resources Nonproliferation and National Security Vulnerability Assessment Team (VAT) Click on the "Date" header to sort the videos/podcasts in chronological order (ascending or descending). You may also search for a specific keyword; click on the reset button refresh to remove the keyword filter and show again all the Videos/Podcasts.

331

Cyber Assessment Methods for SCADA Security  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5 by ISA - The Instrumentation, Systems and Automation Society. 5 by ISA - The Instrumentation, Systems and Automation Society. Presented at 15th Annual Joint ISA POWID/EPRI Controls and Instrumentation Conference http://www.isa.org Cyber Assessment Methods for SCADA Security May Robin Permann Kenneth Rohde Staff Computer Security Researcher Information & Communications Systems Cyber Security Technologies Idaho National Laboratory Idaho National Laboratory Idaho Falls, ID 83415 Idaho Falls, ID 83415 KEYWORDS Supervisory Control and Data Acquisition, SCADA, Cyber Security, Testing, Assessment ABSTRACT The terrorist attacks of September 11, 2001 brought to light threats and vulnerabilities that face the United States. In response, the U.S. Government is directing the effort to secure the nation's critical

332

T-645: Microsoft Security Bulletin Advance Notification | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Microsoft Security Bulletin Advance Notification 5: Microsoft Security Bulletin Advance Notification T-645: Microsoft Security Bulletin Advance Notification June 13, 2011 - 3:45pm Addthis PROBLEM: This is an advance notification of security bulletins that Microsoft is intending to release on June 14, 2011. PLATFORM: Windows Operating System and Components, Microsoft Office Suites and Software, Microsoft Server Software, Microsoft Developer Tools and Software and Microsoft Security Software ABSTRACT: Microsoft provides the Microsoft Security Bulletin Advance Notification Service. This advance notification is intended to help our customers plan for effective deployment of security updates, and includes information about the number of new security updates being released, the software affected, severity levels of vulnerabilities, and information about any

333

Trusted Grid Computing with Security Assurance and Resource Optimization  

E-Print Network (OSTI)

Trusted Grid Computing with Security Assurance and Resource Optimization Shanshan Song and Kai The security of Grid sites can be enhanced by upgrading its intrusion defense capabilities against its previous security enforcement across multiple Grid resources sites. The design is aimed at securing Grid resources

Hwang, Kai

334

V-145: IBM Tivoli Federated Identity Manager Products Java Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: IBM Tivoli Federated Identity Manager Products Java Multiple 5: IBM Tivoli Federated Identity Manager Products Java Multiple Vulnerabilities V-145: IBM Tivoli Federated Identity Manager Products Java Multiple Vulnerabilities April 30, 2013 - 12:09am Addthis PROBLEM: IBM Tivoli Federated Identity Manager Products Java Multiple Vulnerabilities PLATFORM: IBM Tivoli Federated Identity Manager versions 6.1, 6.2.0, 6.2.1, and 6.2.2. IBM Tivoli Federated Identity Manager Business Gateway versions 6.1.1, 6.2.0, 6.2.1 and 6.2.2. ABSTRACT: IBM has acknowledged a weakness and two vulnerabilities in IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway REFERENCE LINKS: IBM Reference #:1634544 Secunia Advisory SA53233 CVE-2013-0169 CVE-2013-0440 CVE-2013-0443 IMPACT ASSESSMENT: Medium DISCUSSION: CVE-2013-0440 - Unspecified vulnerability in IBM Java

335

JC3 Bulletin Archive | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Archer eGRC. February 4, 2013 V-083: Oracle Java Multiple Vulnerabilities A Critical Patch Update is a collection of patches for multiple security vulnerabilities. The Critical...

336

T-620: Microsoft Security Bulletin Advance Notification for May 2011 |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

T-620: Microsoft Security Bulletin Advance Notification for May T-620: Microsoft Security Bulletin Advance Notification for May 2011 T-620: Microsoft Security Bulletin Advance Notification for May 2011 May 10, 2011 - 7:00am Addthis PROBLEM: Microsoft released 2 bulletins to address vulnerabilities involving Microsoft Windows Server and Microsoft Office. This Microsoft Bulletin contains 1 Critical vulnerability and 1 Important vulnerability which require a restart after the applied patches. PLATFORM: Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2, Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2, Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based

337

Cyber Security | National Security | ORNL  

NLE Websites -- All DOE Office Websites (Extended Search)

National Security Home | Science & Discovery | National Security | Initiatives | Cyber Security SHARE Cyber Security Through Science A Science-Based Approach image ORNL uses a science-based approach that combines experimentation, theory, modeling, and high performance computing to solve some of the nation's cyber security grand challenges. Significant, 'game-changing' transformation requires a science-based approach that combines fundamental understanding with experimentation, theory, and modeling. The most successful scientific programs use peer review to maximize intellectual capital and prioritize research needs. The Department of Energy has applied this approach through programs such as the Scientific Discovery through Advanced Computing (SciDAC) and ASCI,

338

T-730: Vulnerability in Citrix Provisioning Services could result...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Vulnerability in Citrix Provisioning Services could result in Arbitrary Code Execution T-730: Vulnerability in Citrix Provisioning Services could result in Arbitrary Code...

339

T-565: Vulnerability in Microsoft Malware Protection Engine Could...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

in Microsoft Malware Protection Engine Could Allow Elevation of PrivilegeVulnerability T-565: Vulnerability in Microsoft Malware Protection Engine Could Allow Elevation of...

340

Locating Climate Insecurity: Where Are the Most Vulnerable Places...  

Open Energy Info (EERE)

Insecurity: Where Are the Most Vulnerable Places in Africa? Jump to: navigation, search Tool Summary LAUNCH TOOL Name: Locating Climate Insecurity: Where Are the Most Vulnerable...

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


341

The Security Epidemic  

NLE Websites -- All DOE Office Websites (Extended Search)

5-1130 5-1130 A different version of this appeared in Security Management 50, pp. 88-94 (2006). Turnkey Turnover Solutions: Powerful Tools and Experts are Available! Eddie G. Bitzer III, M.A. and Roger G. Johnston, Ph.D., CPP Vulnerability Assessment Team Los Alamos National Laboratory Introduction It's early in World War II, and the US is scrambling to put together an effective fighting force. But how to you select and place millions of former civilians into military positions that will suit their abilities and temperament? The Army turned to industrial/organizational (I/O) psychologists. To solve this problem, the I/O psychologists developed the Army General Classification Test (AGCT), which later evolved into the Armed Services Vocational Aptitude Battery (ASVAB) still used

342

Assessing Vulnerabilities, Risks, and Consequences of Damage to Critical Infrastructure  

SciTech Connect

Since the publication of 'Critical Foundations: Protecting America's Infrastructure,' there has been a keen understanding of the complexity, interdependencies, and shared responsibility required to protect the nation's most critical assets that are essential to our way of life. The original 5 sectors defined in 1997 have grown to 18 Critical Infrastructures and Key Resources (CIKR), which are discussed in the 2009 National Infrastructure Protection Plan (NIPP) and its supporting sector-specific plans. The NIPP provides the structure for a national program dedicated to enhanced protection and resiliency of the nation's infrastructure. Lawrence Livermore National Laboratory (LLNL) provides in-depth, multi-disciplinary assessments of threat, vulnerability, and consequence across all 18 sectors at scales ranging from specific facilities to infrastructures spanning multi-state regions, such as the Oil and Natural Gas (ONG) sector. Like many of the CIKR sectors, the ONG sector is comprised of production, processing, distribution, and storage of highly valuable and potentially dangerous commodities. Furthermore, there are significant interdependencies with other sectors, including transportation, communication, finance, and government. Understanding the potentially devastating consequences and collateral damage resulting from a terrorist attack or natural event is an important element of LLNL's infrastructure security programs. Our work began in the energy sector in the late 1990s and quickly expanded other critical infrastructure sectors. We have performed over 600 physical assessments with a particular emphasis on those sectors that utilize, store, or ship potentially hazardous materials and for whom cyber security is important. The success of our approach is based on building awareness of vulnerabilities and risks and working directly with industry partners to collectively advance infrastructure protection. This approach consists of three phases: The Pre-Assessment Phase brings together infrastructure owners and operators to identify critical assets and help the team create a structured information request. During this phase, we gain information about the critical assets from those who are most familiar with operations and interdependencies, making the time we spend on the ground conducting the assessment much more productive and enabling the team to make actionable recommendations. The Assessment Phase analyzes 10 areas: Threat environment, cyber architecture, cyber penetration, physical security, physical penetration, operations security, policies and procedures, interdependencies, consequence analysis, and risk characterization. Each of these individual tasks uses direct and indirect data collection, site inspections, and structured and facilitated workshops to gather data. Because of the importance of understanding the cyber threat, LLNL has built both fixed and mobile cyber penetration, wireless penetration and supporting tools that can be tailored to fit customer needs. The Post-Assessment Phase brings vulnerability and risk assessments to the customer in a format that facilitates implementation of mitigation options. Often the assessment findings and recommendations are briefed and discussed with several levels of management and, if appropriate, across jurisdictional boundaries. The end result is enhanced awareness and informed protective measures. Over the last 15 years, we have continued to refine our methodology and capture lessons learned and best practices. The resulting risk and decision framework thus takes into consideration real-world constraints, including regulatory, operational, and economic realities. In addition to 'on the ground' assessments focused on mitigating vulnerabilities, we have integrated our computational and atmospheric dispersion capability with easy-to-use geo-referenced visualization tools to support emergency planning and response operations. LLNL is home to the National Atmospheric Release Advisory Center (NARAC) and the Interagency Modeling and Atmospheric Assessment Center (IMAAC). NA

Suski, N; Wuest, C

2011-02-04T23:59:59.000Z

343

Safety, Security  

NLE Websites -- All DOE Office Websites (Extended Search)

Safety, Security Safety, Security Safety, Security LANL's mission is to develop and apply science and technology to ensure the safety, security, and reliability of the U.S. nuclear deterrent; reduce global threats; and solve other emerging national security and energy challenges. Contact Operator Los Alamos National Laboratory (505) 667-5061 We do not compromise safety for personal, programmatic, or operational reasons. Safety: we integrate safety, security, and environmental concerns into every step of our work Our commitments We conduct our work safely and responsibly to achieve our mission. We ensure a safe and healthful environment for workers, contractors, visitors, and other on-site personnel. We protect the health, safety, and welfare of the general public. We do not compromise safety for personal, programmatic, or

344

Classification of Threats Via a Multi-sensor Security Portal  

Science Journals Connector (OSTI)

Classification of threats has always been a major security decision ... walks through a security portal. To classify threat by combining data from multiple sensors like ... metal detectors. We wish to identify th...

Amar Singh; Lawrence Holder

2006-01-01T23:59:59.000Z

345

Safeguarding Children and Vulnerable Adults 1. Introduction  

E-Print Network (OSTI)

1 Safeguarding Children and Vulnerable Adults 1. Introduction 2. Definition & Legislation 3. Scope 4. Roles & Responsibilities 5. Action Appendix 1 ­ Handling a Safeguarding Case & Contacts as best practice for all safeguarding activity; however, this policy reflects the different practices

Anderson, Jim

346

Lab announces security changes  

NLE Websites -- All DOE Office Websites (Extended Search)

Lab announces security changes Lab announces security changes The Laboratory is implementing several changes to its security procedures as the result of a recent security...

347

Security Specialist  

Energy.gov (U.S. Department of Energy (DOE))

A successful candidate in this position will serve as a Security Specialist with responsibility as the performance monitor for protective force operations conducts line management oversight of the...

348

Global Security  

NLE Websites -- All DOE Office Websites (Extended Search)

nonpartisan organization with a mission to strengthen global security by reducing the risk of use and preventing the spread of nuclear, biological, and chemical weapons and to...

349

Global security  

SciTech Connect

Patrick Lynch helps technical staff, academic leaders and governments around the world improve the safety and security of their nuclear power programs.

Lynch, Patrick

2014-07-14T23:59:59.000Z

350

Cyber Security  

NLE Websites -- All DOE Office Websites (Extended Search)

Cyber Security Previous cybersecurity evaluations and designs were often dependent upon personal experience and limited empirical evidence. An LDRD project focused on cybersecurity...

351

Global security  

ScienceCinema (OSTI)

Patrick Lynch helps technical staff, academic leaders and governments around the world improve the safety and security of their nuclear power programs.

Lynch, Patrick

2014-07-15T23:59:59.000Z

352

Infrastructure Security  

NLE Websites -- All DOE Office Websites (Extended Search)

to enhance the nation's security and prosperity through sustainable, transformative approaches to our most challenging energy, climate, and infrastructure problems. vision...

353

Transportation Security  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Preliminary Draft - For Review Only 1 Transportation Security Draft Annotated Bibliography Review July 2007 Preliminary Draft - For Review Only 2 Work Plan Task * TEC STG Work...

354

Cyber Security Audit and Attack Detection Toolkit: National SCADA Test Bed  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Audit and Attack Detection Toolkit: National SCADA Audit and Attack Detection Toolkit: National SCADA Test Bed May 2008 Cyber Security Audit and Attack Detection Toolkit: National SCADA Test Bed May 2008 This project of the cyber security audit and attack detection toolkit is adding control system intelligence to widely deployed enterprise vulnerability scanners and security event managers While many energy utilities employ vulnerability scanners and security event managers (SEM) on their enterprise systems, these tools often lack the intelligence necessary to be effective in control systems. This two-year project aims to integrate control system intelligence into widely deployed vulnerability scanners and SEM, and to integrate security incident detection intelligence into control system historians. These upgrades will

355

U-200: Red Hat Directory Server Information Disclosure Security Issue and  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

200: Red Hat Directory Server Information Disclosure Security 200: Red Hat Directory Server Information Disclosure Security Issue and Vulnerability U-200: Red Hat Directory Server Information Disclosure Security Issue and Vulnerability June 27, 2012 - 7:00am Addthis PROBLEM: A security issue and a vulnerability have been reported in Red Hat Directory Server, which can be exploited by malicious users to disclose sensitive information. PLATFORM: Red Hat Directory Server 8.x ABSTRACT: If an LDAP user had changed their password, and the directory server had not been restarted since that change, an attacker able to bind to the directory server could obtain the plain text version of that user's password. Reference Links: Original Advisory Secunia ID 49734 CVE-2012-2678, CVE-2012-2746 IMPACT ASSESSMENT: Medium Discussion: 1) The security issue is caused due to new passwords being saved to the

356

U-200: Red Hat Directory Server Information Disclosure Security Issue and  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Red Hat Directory Server Information Disclosure Security 0: Red Hat Directory Server Information Disclosure Security Issue and Vulnerability U-200: Red Hat Directory Server Information Disclosure Security Issue and Vulnerability June 27, 2012 - 7:00am Addthis PROBLEM: A security issue and a vulnerability have been reported in Red Hat Directory Server, which can be exploited by malicious users to disclose sensitive information. PLATFORM: Red Hat Directory Server 8.x ABSTRACT: If an LDAP user had changed their password, and the directory server had not been restarted since that change, an attacker able to bind to the directory server could obtain the plain text version of that user's password. Reference Links: Original Advisory Secunia ID 49734 CVE-2012-2678, CVE-2012-2746 IMPACT ASSESSMENT: Medium Discussion: 1) The security issue is caused due to new passwords being saved to the

357

Defining and Computing a Valued Based Cyber-Security Measure  

SciTech Connect

In earlier work, we presented a value based measure of cybersecurity that quantifies the security of a system in concrete terms, specifically, in terms of how much each system stakeholder stands to lose (in dollars per hour of operation) as a result of security threats and system vulnerabilities; our metric varies according to the stakes that each stakeholder has in meeting each security requirement. In this paper, we discuss the specification and design of a system that collects, updates, and maintains all the information that pertains to estimating our cybersecurity measure, and offers stakeholders quantitative means to make security-related decisions.

Aissa, Anis Ben [University of Tunis, Belvedere, Tunisia; Abercrombie, Robert K [ORNL; Sheldon, Frederick T [ORNL; Mili, Ali [New Jersey Insitute of Technology

2012-01-01T23:59:59.000Z

358

T-644: Prenotification Security Advisory - Adobe Acrobat & Adobe Readers  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Prenotification Security Advisory - Adobe Acrobat & Adobe 4: Prenotification Security Advisory - Adobe Acrobat & Adobe Readers Updates T-644: Prenotification Security Advisory - Adobe Acrobat & Adobe Readers Updates June 10, 2011 - 3:16pm Addthis PROBLEM: Prenotification Security Advisory - Adobe Updates Available Tuesday, June 14, 2011 PLATFORM: Adobe : Security Vulnerabilities Published In 2011, Severity Rating System for Security Bulletins Adobe Reader X (10.0.1) and earlier versions for Windows Adobe Reader X (10.0.3) and earlier versions for Macintosh Adobe Reader 9.4.3 and earlier versions for Windows and Macintosh Adobe Acrobat X (10.0.3) and earlier versions for Windows and Macintosh Adobe Acrobat 9.4.3 and earlier versions for Windows and Macintosh ABSTRACT: A prenotification Security Advisory has been posted in regards to the

359

T-533: Microsoft January 2011 Security Bulletin Release | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Microsoft January 2011 Security Bulletin Release 3: Microsoft January 2011 Security Bulletin Release T-533: Microsoft January 2011 Security Bulletin Release January 12, 2011 - 2:25pm Addthis PROBLEM: Microsoft January 2011 Security Bulletin Release PLATFORM: Various Windows OS Platforms, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2 ABSTRACT: Microsoft released 2 bulletins to address 3 vulnerabilities involving Microsoft Windows and components in Windows OS, and Windows Server Releases. Only 1 of these bulletins get our maximum severity rating of Critical. reference LINKS: Microsoft Security Bulletin Advance Notification for December 2010 TechNet Webcast: Information About Microsoft January 2011 Security Bulletins Discussion: Microsoft Security Bulletin MS11-001 - Important CVE-2010-3145 - This

360

CDKN-Colombia-Cartagena Vulnerability Assessment | Open Energy Information  

Open Energy Info (EERE)

Cartagena Vulnerability Assessment Cartagena Vulnerability Assessment Jump to: navigation, search Name CDKN-Colombia-Cartagena Vulnerability Assessment Agency/Company /Organization Climate and Development Knowledge Network (CDKN), United Kingdom Department for International Development Sector Climate Topics Background analysis, Low emission development planning, Pathways analysis Website http://resilient-cities.iclei. Country Colombia UN Region South America References CDKN-Colombia-Cartagena Vulnerability Assessment[1] CDKN-Colombia-Cartagena Vulnerability Assessment Screenshot This article is a stub. You can help OpenEI by expanding it. References ↑ "CDKN-Colombia-Cartagena Vulnerability Assessment" Retrieved from "http://en.openei.org/w/index.php?title=CDKN-Colombia-Cartagena_Vulnerability_Assessment&oldid=407543

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


361

Energy Security  

NLE Websites -- All DOE Office Websites (Extended Search)

Energy Security Energy Security Energy Security LANL's mission is to develop and apply science and technology to ensure the safety, security, and effectiveness of the U.S. nuclear deterrent; reduce global threats; and solve other emerging national security and energy challenges. April 12, 2012 A closed photobioreactor system is essentially a series of plastic or glass containers for water and algae. A closed photobioreactor system is essentially a series of plastic or glass containers for water and algae. Proponents of such bioreactors (compared to open ponds) say the growth environment can be more easily controlled; they prevent evaporation; and light penetrates through all sides of the container, which increases cell density. However, bioreactors suffer high materials and energy costs as well as mixing and gas-exchange

362

Comparisons of purely topological model, betweenness based model and direct current power flow model to analyze power grid vulnerability  

Science Journals Connector (OSTI)

This paper selects three frequently used power grid models including a purely topological model (PTM) a betweennness based model (BBM) and a direct current power flow model (DCPFM) to describe three different dynamical processes on a power grid under both single and multiple component failures. Each of the dynamical processes is then characterized by both a topology-based and a flow-based vulnerability metrics to compare the three models with each other from the vulnerability perspective. Taking as an example the IEEE 300 power grid with line capacity set proportional to a tolerance parameter tp the results show non-linear phenomenon: under single node failures there exists a critical value of tp?=?1.36 above which the three models all produce identical topology-based vulnerability results and more than 85% nodes have identical flow-based vulnerability from any two models; under multiple node failures that each node fails with an identical failure probability fp there exists a critical fp?=?0.56 above which the three models produce almost identical topology-based vulnerability results at any tp???1 but producing identical flow-based vulnerability results only occurs at fp?=?1. In addition the topology-based vulnerability results can provide a good approximation for the flow-based vulnerability under large fp and the priority of PTM and BBM to better approach the DCPFM for vulnerability analysis mainly depends on the value of fp. Similar results are also found for other failure types other system operation parameters and other power grids.

2013-01-01T23:59:59.000Z

363

Safety, security and safeguard  

Science Journals Connector (OSTI)

Abstract A physical protection system (PPS) integrates people, procedures, and equipment for the protection of assets or facilities against theft, sabotage and terrorist attacks. Therefore, this paper proposes the use of a systematic and measurable approach to the design of PPS and its emphases on the concept of detection, delay and response. The proposed performance based PPS has the capability of defeating adversaries thereby achieving its targets. Therefore, timely detection of intrusion based on the use of sensors, signal lines and alarm systems is a major principle in the proposed system. Also the need for deterrence such as barriers in form of guards, access control, close circuit television (CCTV), strong policy and procedures, then the security culture amongst the facility workers was appropriately discussed. Since nuclear power is considered the only source that can provide large scale electricity with comparatively minimal impact on the environment, the paper also considered base guidelines for the application of PPS in any nuclear and radioactive facilities, followed with the necessity to incorporate inherent safety, security and safeguard (3S) synergy innovation in the physical protection system design and other characteristics that will enhance to reduce the vulnerability of nuclear facilities and materials to theft sabotage and terrorist attacks.

Nasiru Imam Zakariya; M.T.E. Kahn

2015-01-01T23:59:59.000Z

364

T-565: Vulnerability in Microsoft Malware Protection Engine Could Allow  

NLE Websites -- All DOE Office Websites (Extended Search)

65: Vulnerability in Microsoft Malware Protection Engine Could 65: Vulnerability in Microsoft Malware Protection Engine Could Allow Elevation of PrivilegeVulnerability T-565: Vulnerability in Microsoft Malware Protection Engine Could Allow Elevation of PrivilegeVulnerability February 25, 2011 - 7:40am Addthis PROBLEM: Vulnerability in Microsoft Malware Protection Engine Could Allow Elevation of PrivilegeVulnerability. PLATFORM: Microsoft Malware Protection Engine Last version of the Microsoft Malware Protection Engine affected by this vulnerability: Version 1.1.6502.0 This version is the last version of the Microsoft Malware Protection Engine that is affected by the vulnerability. First version of the Microsoft Malware Protection Engine with this vulnerability addressed:Version 1.1.6603.0 If the version of the Microsoft Malware Protection Engine is equal to or

365

Initial CTBT international monitoring system security findings and recommendations  

SciTech Connect

An initial security evaluation of the proposed International Monitoring System (IMS) suggests safeguards at various points in the IMS to provide reliable information to the user community. Modeling the IMS as a network of information processing nodes provides a suitable architecture for assessing data surety needs of the system. The recommendations in this paper include the use of public-key authentication for data from monitoring stations and for commands issued to monitoring stations. Other monitoring station safeguards include tamper protection of sensor subsystems, preservation of data (i.e. short-term archival), and limiting the station`s network services. The recommendations for NDCs focus on the need to provide a backup to the IDC for data archival and data routing. Safeguards suggested for the IDC center on issues of reliability. The production of event bulletins should employ {open_quotes}two-man{close_quotes} procedures. As long as the data maintains its integrity, event bulletins can be produced by NDCs as well. The effective use of data authentication requires a sound key management system. Key management systems must be developed for the authentication of data, commands, and event bulletins if necessary. It is recommended that the trust placed in key management be distributed among multiple parties. The recommendations found in this paper offer safeguards for identified vulnerabilities in the IMS with regard to data surety. However, several outstanding security issues still exist. These issues include the need to formalize and obtain a consensus on a threat model and a trust model for the IMS. The final outstanding security issue that requires in-depth analysis concerns the IDC as a potential single point of failure in the current IMS design.

Craft, R.L.; Draelos, T.J.

1996-08-01T23:59:59.000Z

366

V-069: BlackBerry Tablet OS Adobe Flash Player and Samba Multiple  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

9: BlackBerry Tablet OS Adobe Flash Player and Samba Multiple 9: BlackBerry Tablet OS Adobe Flash Player and Samba Multiple Vulnerabilities V-069: BlackBerry Tablet OS Adobe Flash Player and Samba Multiple Vulnerabilities January 15, 2013 - 4:00am Addthis PROBLEM: BlackBerry Tablet OS Adobe Flash Player and Samba Multiple Vulnerabilities PLATFORM: BlackBerry Tablet Software versions 2.1.0.1032 and prior. ABSTRACT: Multiple vulnerabilities have been reported in BlackBerry Tablet OS REFERENCE LINKS: BlackBerry Knowledge Base Article ID: KB32019 BlackBerry Knowledge Base Article ID: KB32189 Secunia Advisory SA51830 CVE-2012-1182 CVE-2012-1535 CVE-2012-2034 CVE-2012-2037 CVE-2012-4163 CVE-2012-4165 CVE-2012-4166 CVE-2012-4167 IMPACT ASSESSMENT: High DISCUSSION: Multiple vulnerabilities have been reported in BlackBerry Tablet OS, which

367

defense nuclear security | National Nuclear Security Administration  

National Nuclear Security Administration (NNSA)

nuclear security | National Nuclear Security Administration People Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response...

368

nuclear security | National Nuclear Security Administration  

National Nuclear Security Administration (NNSA)

security | National Nuclear Security Administration People Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response Recapitalizing Our...

369

Security In Information Systems  

E-Print Network (OSTI)

rights, and they are proposing security policies, security planning, personal data protection laws, etc

Candan, Selçuk

370

Resilient and Self-Organizing Overlay of Collaborative Security Monitors  

E-Print Network (OSTI)

, destructive and widespread, especially those distributed attacks that exploit multiple launching sites, security systems that are deployed in isolation within administrative domains and do not exchange infor

Li, Jun

371

Security | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Security Security Security Security program under Office of Health, Safety and Security developes security policy, provides security expertise to assist field elements in planning site protection strategies and coordinates with domestic authorities to provide safeguards and security technical assistance, technical systems support, and technology development and deployment opportunities. Departmental Personnel Security, also ensures that Departmental personnel security programs (included the National Nuclear Security Administration) are consistent and effectively implemented. Headquarters Facilities Master Security Plan The purpose of the Headquarters Facility Master Security Plan (HQFMSP) is to inform employees, contractors, and visitors of the security procedures

372

V-134: Cisco AnyConnect Secure Mobility Client Heap Overflow Lets Local  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

4: Cisco AnyConnect Secure Mobility Client Heap Overflow Lets 4: Cisco AnyConnect Secure Mobility Client Heap Overflow Lets Local Users Gain Elevated Privileges V-134: Cisco AnyConnect Secure Mobility Client Heap Overflow Lets Local Users Gain Elevated Privileges April 15, 2013 - 1:30am Addthis PROBLEM: Cisco AnyConnect Secure Mobility Client Heap Overflow Lets Local Users Gain Elevated Privileges PLATFORM: Cisco AnyConnect Secure Mobility Client Cisco Secure Desktop ABSTRACT: Some vulnerabilities were reported in Cisco AnyConnect Secure Mobility Client. REFERENCE LINKS: Cisco Security Notice CVE-2013-1172 Cisco Security Notice CVE-2013-1173 SecurityTracker Alert ID: 1028425 CVE-2013-1172 CVE-2013-1173 IMPACT ASSESSMENT: Medium DISCUSSION: A local user can trigger a heap overflow in the Cisco Host Scan component to execute arbitrary code on the target system with System privileges

373

DOE/DHS INDUSTRIAL CONTROL SYSTEM CYBER SECURITY PROGRAMS: A MODEL FOR USE IN NUCLEAR FACILITY SAFEGUARDS AND SECURITY  

SciTech Connect

Many critical infrastructure sectors have been investigating cyber security issues for several years especially with the help of two primary government programs. The U.S. Department of Energy (DOE) National SCADA Test Bed and the U.S. Department of Homeland Security (DHS) Control Systems Security Program have both implemented activities aimed at securing the industrial control systems that operate the North American electric grid along with several other critical infrastructure sectors (ICS). These programs have spent the last seven years working with industry including asset owners, educational institutions, standards and regulating bodies, and control system vendors. The programs common mission is to provide outreach, identification of cyber vulnerabilities to ICS and mitigation strategies to enhance security postures. The success of these programs indicates that a similar approach can be successfully translated into other sectors including nuclear operations, safeguards, and security. The industry regulating bodies have included cyber security requirements and in some cases, have incorporated sets of standards with penalties for non-compliance such as the North American Electric Reliability Corporation Critical Infrastructure Protection standards. These DOE and DHS programs that address security improvements by both suppliers and end users provide an excellent model for nuclear facility personnel concerned with safeguards and security cyber vulnerabilities and countermeasures. It is not a stretch to imagine complete surreptitious collapse of protection against the removal of nuclear material or even initiation of a criticality event as witnessed at Three Mile Island or Chernobyl in a nuclear ICS inadequately protected against the cyber threat.

Robert S. Anderson; Mark Schanfein; Trond Bjornard; Paul Moskowitz

2011-07-01T23:59:59.000Z

374

ENERGY SECURITY  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

national strategy for national strategy for ENERGY SECURITY recommendations to the nation on reducing u.s. oil dependence september 2008 a project of a project of a national strategy for energy security Recommendations to the Nation on Reducing U.S. Oil Dependence september 2008 Table of Contents 2 Energy Security Leadership Council 3 Statement of Purpose 4 Letter to the President, the Congress, and the American People 7 Outline of Main Body of Report 13 Introduction 21 Policy Recommendations: Summary 33 Part I · Diversify Energy Supplies for the Transportation Sector

375

Climate change and climate variability affect all regions of the world. U.S. vulnerability to the changes and variations are not only dependent on changes within the U.S. but also on  

E-Print Network (OSTI)

OVERVIEW Climate change and climate variability affect all regions of the world. U.S. vulnerability, it is important to assess emerging threats to national security due to climate change far into the future. Having with national security establish practical responses to climate change and extreme weather events

376

Enhancing Energy Infrastructure Resiliency and Addressing Vulnerabilities  

Energy.gov (U.S. Department of Energy (DOE))

Quadrennial Energy Review Task Force Secretariat and Energy Policy and Systems Analysis Staff, U. S. Department of Energy (DOE) Public Meeting on Enhancing Resilience in Energy Infrastructure and Addressing Vulnerabilities On Friday, April 11, 2014, at 10 a.m. in room HVC-215 of the U.S. Capitol, the Department of Energy (DOE), acting as the Secretariat for the Quadrennial Energy Review Task Force, will hold a public meeting to discuss and receive comments on issues related to the Quadrennial Energy Review (QER). The meeting will focus on infrastructure vulnerabilities related to the electricity, natural gas and petroleum transmission, storage and distribution systems (TS&D). The meeting will consist of two facilitated panels of experts on identifying and addressing vulnerabilities within the nations energy TS&D infrastructure. Following the panels, an opportunity will be provided for public comment via an open microphone session. The meeting will be livestreamed at energy.gov/live

377

Transportation Security | ornl.gov  

NLE Websites -- All DOE Office Websites (Extended Search)

Transportation Security SHARE Global Threat Reduction Initiative Transportation Security Cooperation Secure Transport Operations (STOP) Box Security of radioactive material while...

378

Personnel Security  

Directives, Delegations, and Requirements

The manual establishes the overall objectives and requirements for the Department of Energy Personnel Security Program. Cancels DOE M 472.1-1B. Canceled by DOE O 472.2.

2005-08-26T23:59:59.000Z

379

Security Rulemaking  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2 NATIONAL TRANSPORTATION STAKEHOLDERS FORUM 2 NATIONAL TRANSPORTATION STAKEHOLDERS FORUM Knoxville, TN - May 16, 2012 2 NRC Actions Since September 11, 2001 * Interim solution - enhance existing regulations through Security Orders * Objectives of the Orders are enhanced control of material to - Prevent unauthorized access - Prevent malevolent use of material - Mitigate consequences * Orders were issued to NRC licensees that transport: - Spent Nuclear Fuel - IAEA Code of Conduct Category 1 and 2 quantities of radioactive material Security Rulemakings 3 NRC Ongoing Activities * Orders are an interim measure * Long-term approach is to enhance transport security through public rulemaking * Rulemaking process in progress for - SNF Transportation Security - Physical Protection of Category 1 and 2 material (both fixed

380

Personnel Security  

Directives, Delegations, and Requirements

The Order establishes requirements for a successful, efficient and cost-effective personnel security program to ensure accurate, timely and equitable determinations of individuals eligibility for access to classified information and fitness for placement or retention in national security positions. Cancels DOE M 470.4-5, DOE N 470.4 and DOE N 470.5. Admin Chg 1, 10-8-13.

2011-07-27T23:59:59.000Z

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


381

U-138: Cisco IOS IPSec IKE Unspecified Denial of Service Vulnerability |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: Cisco IOS IPSec IKE Unspecified Denial of Service 8: Cisco IOS IPSec IKE Unspecified Denial of Service Vulnerability U-138: Cisco IOS IPSec IKE Unspecified Denial of Service Vulnerability April 2, 2012 - 7:00am Addthis PROBLEM: A vulnerability has been reported in Cisco IOS, which can be exploited by malicious people to cause a DoS (Denial of Service). PLATFORM: Cisco IOS XE 2.1.x Cisco IOS XE 2.2.x Cisco IOS XE 2.3.x Cisco IOS XE 2.4.x Cisco IOS XE 2.5.x Cisco IOS XE 2.6.x Cisco IOS XE 3.1.x Cisco IOS XE 3.3.x ABSTRACT: The IKEv1 feature of Cisco IOS Software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a reload of an affected device. REFERENCE LINKS: Vendor Advisory Secunia Advisory SA48607 CVE-2012-0381 iMPACT ASSESSMENT: High discussion: The March 28, 2012, Cisco IOS Software Security Advisory bundled

382

V-025: Bugzilla Multiple Cross Site Scripting and Information...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

to version 3.6.12, 4.0.9, or 4.2.4 or apply patches. Addthis Related Articles V-080: Apple iOS Multiple Vulnerabilities T-568: Mozilla Firefox Bugs Let Remote Users Conduct...

383

U-062: Pidgin SILC (Secure Internet Live Conferencing) Protocol Denial of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

2: Pidgin SILC (Secure Internet Live Conferencing) Protocol 2: Pidgin SILC (Secure Internet Live Conferencing) Protocol Denial of Service Vulnerability U-062: Pidgin SILC (Secure Internet Live Conferencing) Protocol Denial of Service Vulnerability December 15, 2011 - 8:00am Addthis PROBLEM: Pidgin SILC (Secure Internet Live Conferencing) Protocol Denial of Service Vulnerability. PLATFORM: Versions Prior to Pidgin 2.10.1 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux Optional Productivity Application 5 server RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux Desktop version 4 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 ABSTRACT: An attacker can exploit these issues by constructing and submitting a specially crafted SILC message. Successful exploits will cause the affected

384

Climate Change and National Security  

SciTech Connect

Climate change is increasingly recognized as having national security implications, which has prompted dialogue between the climate change and national security communities with resultant advantages and differences. Climate change research has proven useful to the national security community sponsors in several ways. It has opened security discussions to consider climate as well as political factors in studies of the future. It has encouraged factoring in the stresses placed on societies by climate changes (of any kind) to help assess the potential for state stability. And it has shown that, changes such as increased heat, more intense storms, longer periods without rain, and earlier spring onset call for building climate resilience as part of building stability. For the climate change research community, studies from a national security point of view have revealed research lacunae, for example, such as the lack of usable migration studies. This has also pushed the research community to consider second- and third-order impacts of climate change, such as migration and state stability, which broadens discussion of future impacts beyond temperature increases, severe storms, and sea level rise; and affirms the importance of governance in responding to these changes. The increasing emphasis in climate change science toward research in vulnerability, resilience, and adaptation also frames what the intelligence and defense communities need to know, including where there are dependencies and weaknesses that may allow climate change impacts to result in security threats and where social and economic interventions can prevent climate change impacts and other stressors from resulting in social and political instability or collapse.

Malone, Elizabeth L.

2013-02-01T23:59:59.000Z

385

Guide to Critical Infrastructure Protection Cyber Vulnerability...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Standards New No-Cost ANTFARM Tool Maps Control System Networks to Help Implement Cyber Security Standards "Cybersecurity for State Regulators" - NARUC Primer (June 2012)...

386

V-099: Honeywell Multiple Products ActiveX Control Remote Code Execution  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

099: Honeywell Multiple Products ActiveX Control Remote Code 099: Honeywell Multiple Products ActiveX Control Remote Code Execution Vulnerability V-099: Honeywell Multiple Products ActiveX Control Remote Code Execution Vulnerability February 26, 2013 - 12:26am Addthis PROBLEM: Honeywell Multiple Products ActiveX Control Remote Code Execution Vulnerability PLATFORM: Honeywell ComfortPoint Open Manager (CPO-M) Honeywell Enterprise Buildings Integrator (EBI) Honeywell SymmetrE ABSTRACT: A vulnerability has been reported in multiple Honeywell products REFERENCE LINKS: Secunia Advisory SA52389 ICSA-13-053-02 CVE-2013-0108 IMPACT ASSESSMENT: Medium DISCUSSION: The vulnerability is caused due to an unspecified error in the HscRemoteDeploy.dll module. No further information is currently available. Successful exploitation may allow execution of arbitrary code.

387

V-099: Honeywell Multiple Products ActiveX Control Remote Code Execution  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

9: Honeywell Multiple Products ActiveX Control Remote Code 9: Honeywell Multiple Products ActiveX Control Remote Code Execution Vulnerability V-099: Honeywell Multiple Products ActiveX Control Remote Code Execution Vulnerability February 26, 2013 - 12:26am Addthis PROBLEM: Honeywell Multiple Products ActiveX Control Remote Code Execution Vulnerability PLATFORM: Honeywell ComfortPoint Open Manager (CPO-M) Honeywell Enterprise Buildings Integrator (EBI) Honeywell SymmetrE ABSTRACT: A vulnerability has been reported in multiple Honeywell products REFERENCE LINKS: Secunia Advisory SA52389 ICSA-13-053-02 CVE-2013-0108 IMPACT ASSESSMENT: Medium DISCUSSION: The vulnerability is caused due to an unspecified error in the HscRemoteDeploy.dll module. No further information is currently available. Successful exploitation may allow execution of arbitrary code.

388

T-570: HP Security Bulletin - HP-UX Running OpenSSL, Remote Execution of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

70: HP Security Bulletin - HP-UX Running OpenSSL, Remote 70: HP Security Bulletin - HP-UX Running OpenSSL, Remote Execution of Arbitrary Code, Denial of Service (DoS), Authentication Bypass T-570: HP Security Bulletin - HP-UX Running OpenSSL, Remote Execution of Arbitrary Code, Denial of Service (DoS), Authentication Bypass March 4, 2011 - 3:05pm Addthis PROBLEM: Potential Security Impact: Remote execution of arbitrary code, Denial of Service (DoS), authentication bypass. PLATFORM: HP-UX B.11.11, B.11.23, B.11.31 running OpenSSL before vA.00.09.08q. ABSTRACT: A potential security vulnerability has been identified with HP-UX OpenSSL. This vulnerability could be exploited remotely to execute arbitrary code or create a Denial of Service (DoS) or an authentication bypass. reference LINKS: Net-Security Advisory: HPSBUX02638

389

U-263: Trend Micro InterScan Messaging Security Flaws Permit Cross-Site  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Trend Micro InterScan Messaging Security Flaws Permit 3: Trend Micro InterScan Messaging Security Flaws Permit Cross-Site Scripting and Cross-Site Request Forgery Attacks U-263: Trend Micro InterScan Messaging Security Flaws Permit Cross-Site Scripting and Cross-Site Request Forgery Attacks September 19, 2012 - 6:00am Addthis PROBLEM: Trend Micro InterScan Messaging Security Flaws Permit Cross-Site Scripting and Cross-Site Request Forgery Attacks PLATFORM: 7.1-Build_Win32_1394; possibly other versions ABSTRACT: A vulnerability was reported in Trend Micro InterScan Messaging Security. reference LINKS: US CERT Vulnerability Note VU#471364 SecurityTracker Alert ID: 1027544 CVE-2012-2995 CVE-2012-2996 Micro Trend IMPACT ASSESSMENT: Medium Discussion: Several scripts do not properly filter HTML code from user-supplied input

390

T-570: HP Security Bulletin - HP-UX Running OpenSSL, Remote Execution of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: HP Security Bulletin - HP-UX Running OpenSSL, Remote 0: HP Security Bulletin - HP-UX Running OpenSSL, Remote Execution of Arbitrary Code, Denial of Service (DoS), Authentication Bypass T-570: HP Security Bulletin - HP-UX Running OpenSSL, Remote Execution of Arbitrary Code, Denial of Service (DoS), Authentication Bypass March 4, 2011 - 3:05pm Addthis PROBLEM: Potential Security Impact: Remote execution of arbitrary code, Denial of Service (DoS), authentication bypass. PLATFORM: HP-UX B.11.11, B.11.23, B.11.31 running OpenSSL before vA.00.09.08q. ABSTRACT: A potential security vulnerability has been identified with HP-UX OpenSSL. This vulnerability could be exploited remotely to execute arbitrary code or create a Denial of Service (DoS) or an authentication bypass. reference LINKS: Net-Security Advisory: HPSBUX02638

391

U-009:Microsoft Security Bulletin Summary for October 2011 | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

09:Microsoft Security Bulletin Summary for October 2011 09:Microsoft Security Bulletin Summary for October 2011 U-009:Microsoft Security Bulletin Summary for October 2011 October 12, 2011 - 8:15am Addthis PROBLEM: Microsoft Security Bulletin Summary for October 2011 PLATFORM: Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2. ABSTRACT: Microsoft released 8 bulletins to address vulnerabilities. This Microsoft bulletin contains 2 critical vulnerabilities. reference LINKS: Microsoft Security Bulletin Summary for October 2011 Security Bulletin Summary October Archive IMPACT ASSESSMENT: High Discussion: For more details regarding the Microsoft October 2011 bulletins, please see follow link for CVE details. You can find more information located under the "Affected Software and Download Locations" section using the following

392

U-078: Microsoft Security Bulletin Advance Notification for January 2012 |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

78: Microsoft Security Bulletin Advance Notification for January 78: Microsoft Security Bulletin Advance Notification for January 2012 U-078: Microsoft Security Bulletin Advance Notification for January 2012 January 10, 2012 - 8:15am Addthis PROBLEM: Microsoft Security Bulletin Advance Notification for January 2012. PLATFORM: Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003, Windows XP ABSTRACT: Microsoft Security Bulletin Advance Notification for January 2012. Microsoft has posted 1 Critical Bulletins and 6 Important bulletins. Bulletins with the Maximum Severity Rating and Vulnerability Impact of "Critical" may allow propagation of Internet worm without user action. Microsoft will host a webcast to address customer questions on the security bulletins on January 11, 2012, at 11:00 AM Pacific Time (US & Canada).

393

U-057: Microsoft Security Bulletin Advance Notification for December 2011 |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

57: Microsoft Security Bulletin Advance Notification for 57: Microsoft Security Bulletin Advance Notification for December 2011 U-057: Microsoft Security Bulletin Advance Notification for December 2011 December 9, 2011 - 12:00pm Addthis PROBLEM: Microsoft Security Bulletin Advance Notification for December 2011. PLATFORM: Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003, Windows XP ABSTRACT: Microsoft Security Bulletin Advance Notification for December 2011. Microsoft has posted 3 Critical Bulletins and 11 Important bulletins. Bulletins with the Maximum Severity Rating and Vulnerability Impact of "Critical" may allow propagation of Internet worm without user action. Microsoft will host a webcast to address customer questions on the security bulletins on December 14, 2011, at 11:00 AM Pacific Time (US & Canada).

394

T-636: Wireshark Multiple Flaws Let Remote Users Deny Service | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

T-636: Wireshark Multiple Flaws Let Remote Users Deny Service T-636: Wireshark Multiple Flaws Let Remote Users Deny Service T-636: Wireshark Multiple Flaws Let Remote Users Deny Service June 3, 2011 - 3:35pm Addthis PROBLEM: Wireshark Multiple Flaws Let Remote Users Deny Service PLATFORM: Wireshark Version(s): 1.2.0 to 1.2.16, 1.4.0 to 1.4.6 ABSTRACT: Multiple vulnerabilities were reported in Wireshark. A remote user can cause denial of service conditions. reference LINKS: wnpa-sec-2011-07 SecurityTracker Alert ID: 1025597 wnpa-sec-2011-08 IMPACT ASSESSMENT: High Discussion: A remote user can send specially crafted DICOM data, Visual Networks file, compressed capture data, snoop file, or Diameter dictionary file to cause the target service to crash or enter an infinite loop. Versions affected: 1.2.0 to 1.2.16 and 1.4.0 to 1.4.6.

395

Analysis of vulnerability to facebook users  

Science Journals Connector (OSTI)

Facebook, the largest social network nowadays currently has 901 million active users, with 526 million of them accessing the system daily. With a very rapid growth, Facebook has become a potential site for the collection of personal information by unauthorized ... Keywords: exposure, facebook, social networks, vulnerability

Michelle Hanne; Cristiano Silva; Jussara Almeida; Marcos Gonalves

2012-10-01T23:59:59.000Z

396

WATER AND ENERGY SECTOR VULNERABILITY TO CLIMATE  

E-Print Network (OSTI)

WATER AND ENERGY SECTOR VULNERABILITY TO CLIMATE WARMING IN THE SIERRA NEVADA: Water Year explores the sensitivity of water indexing methods to climate change scenarios to better understand how water management decisions and allocations will be affected by climate change. Many water management

397

Fragile Networks: Identifying Vulnerabilities and Synergies  

E-Print Network (OSTI)

, Efficiency Measurement, and Vulnerability Analysis · Part II: Applications and Extensions · Part III: Mergers the foundations for transportation and logistics, for communication, energy provision, social interactions that underlie our societies and economies are large-scale and complex in nature, they are liable to be faced

Nagurney, Anna

398

V-043: Perl Locale::Maketext Module '_compile()' Multiple Code Injection  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Perl Locale::Maketext Module '_compile()' Multiple Code 3: Perl Locale::Maketext Module '_compile()' Multiple Code Injection Vulnerabilities V-043: Perl Locale::Maketext Module '_compile()' Multiple Code Injection Vulnerabilities December 10, 2012 - 1:00am Addthis PROBLEM: Perl Locale::Maketext Module Two Code Injection Vulnerabilities PLATFORM: Locale::Maketext 1.23 is affected; other versions also may be affected. ABSTRACT: Two vulnerabilities have been reported in Locale::Maketext module for Perl REFERENCE LINKS: Secunia Advisory SA51498 Debian Bug report logs - #695224 Bugtraq ID: 56852 IMPACT ASSESSMENT: Medium DISCUSSION: Two vulnerabilities have been reported in Locale::Maketext module for Perl, which can be exploited by malicious users to compromise an application using the module. The vulnerabilities are caused due to the "_compile()" function not

399

V-043: Perl Locale::Maketext Module '_compile()' Multiple Code Injection  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: Perl Locale::Maketext Module '_compile()' Multiple Code 3: Perl Locale::Maketext Module '_compile()' Multiple Code Injection Vulnerabilities V-043: Perl Locale::Maketext Module '_compile()' Multiple Code Injection Vulnerabilities December 10, 2012 - 1:00am Addthis PROBLEM: Perl Locale::Maketext Module Two Code Injection Vulnerabilities PLATFORM: Locale::Maketext 1.23 is affected; other versions also may be affected. ABSTRACT: Two vulnerabilities have been reported in Locale::Maketext module for Perl REFERENCE LINKS: Secunia Advisory SA51498 Debian Bug report logs - #695224 Bugtraq ID: 56852 IMPACT ASSESSMENT: Medium DISCUSSION: Two vulnerabilities have been reported in Locale::Maketext module for Perl, which can be exploited by malicious users to compromise an application using the module. The vulnerabilities are caused due to the "_compile()" function not

400

T-536: Cisco ASA Multiple Flaws Let Remote Users Deny Service...  

Office of Energy Efficiency and Renewable Energy (EERE) Indexed Site

36: Cisco ASA Multiple Flaws Let Remote Users Deny Service and Bypass Security Controls T-536: Cisco ASA Multiple Flaws Let Remote Users Deny Service and Bypass Security Controls...

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


401

Tag: security | Y-12 National Security Complex  

NLE Websites -- All DOE Office Websites (Extended Search)

security security Tag: security Displaying 1 - 5 of 5... Category: Security Security Y-12 places the highest priority on maintaining and improving its security posture. More... Category: News Johnson shares perspective on security Rod Johnson, B&W Y-12 deputy general manager of Security, recently discussed the security atmosphere since his arrival last August and what he sees as Y-12's security future. More... Category: News Y-12 to Install New Fence to Reduce Trespassing The National Nuclear Security Administration today announced plans to extend the boundary fence at the Y-12 National Security Complex along Scarboro Road. The new fence is expected to be in place by April 4. More... Category: News New institute promotes nuclear security Y-12 is partnering with the University of Tennessee and others to provide

402

T-580: Apache Tomcat May Ignore @ServletSecurity Annotation Protections |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Apache Tomcat May Ignore @ServletSecurity Annotation 0: Apache Tomcat May Ignore @ServletSecurity Annotation Protections T-580: Apache Tomcat May Ignore @ServletSecurity Annotation Protections March 16, 2011 - 3:05pm Addthis PROBLEM: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by an error related to ignoring @ServletSecurity annotations. An attacker could exploit this vulnerability to bypass security restrictions and launch further attacks on the system. PLATFORM: Apache Tomcat versions 7.0.0 through 7.0.10. ABSTRACT: Apache Tomcat May Ignore @ServletSecurity Annotation Protections. A remote user may be able to bypass @ServletSecurity annotation protections. reference LINKS: Apache Tomcat Advisory: Apache Tomcat 7.0.11 CVE-2011-1088 Security Tracker Alert ID:1025215 OSVDB ID: 71027

403

Energy Security Council  

NLE Websites -- All DOE Office Websites (Extended Search)

Energy Security Council Energy Security Council Reliable, secure, sustainable carbon energy solutions for the nation. Contact Albert Migliori (505) 663-5627 Email David Watkins...

404

Best Practices for the Security of Radioactive Materials  

SciTech Connect

This work is funded under a grant provided by the US Department of Health and Human Services, Centers for Disease Control. The Department of Health and Mental Hygiene (DOHMH) awarded a contract to Brookhaven National Laboratory (BNL) to develop best practices guidance for Office of Radiological Health (ORH) licensees to increase on-site security to deter and prevent theft of radioactive materials (RAM). The purpose of this document is to describe best practices available to manage the security of radioactive materials in medical centers, hospitals, and research facilities. There are thousands of such facilities in the United States, and recent studies suggest that these materials may be vulnerable to theft or sabotage. Their malevolent use in a radiological-dispersion device (RDD), viz., a dirty bomb, can have severe environmental- and economic- impacts, the associated area denial, and potentially large cleanup costs, as well as other effects on the licensees and the public. These issues are important to all Nuclear Regulatory Commission and Agreement State licensees, and to the general public. This document outlines approaches for the licensees possessing these materials to undertake security audits to identify vulnerabilities in how these materials are stored or used, and to describe best practices to upgrade or enhance their security. Best practices can be described as the most efficient (least amount of effort/cost) and effective (best results) way of accomplishing a task and meeting an objective, based on repeatable procedures that have proven themselves over time for many people and circumstances. Best practices within the security industry include information security, personnel security, administrative security, and physical security. Each discipline within the security industry has its own 'best practices' that have evolved over time into common ones. With respect to radiological devices and radioactive-materials security, industry best practices encompass both physical security (hardware and engineering) and administrative procedures. Security regimes for these devices and materials typically use a defense-in-depth- or layered-security approach to eliminate single points of failure. The Department of Energy, the Department of Homeland Security, the Department of Defense, the American Society of Industrial Security (ASIS), the Security Industry Association (SIA) and Underwriters Laboratory (UL) all rovide design guidance and hardware specifications. With a graded approach, a physical-security specialist can tailor an integrated security-management system in the most appropriate cost-effective manner to meet the regulatory and non-regulatory requirements of the licensee or client.

Coulter, D.T.; Musolino, S.

2009-05-01T23:59:59.000Z

405

Transportation Security  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

For Review Only 1 Transportation Security Draft Annotated Bibliography Review July 2007 Preliminary Draft - For Review Only 2 Work Plan Task * TEC STG Work Plan, dated 8/2/06, Product #16, stated: "Develop an annotated bibliography of publicly-available documents related to security of radioactive material transportation." * Earlier this year, a preliminary draft annotated bibliography on this topic was developed by T-REX , UNM, to initially address this STG Work Plan Task. Preliminary Draft - For Review Only 3 Considerations in Determining Release of Information * Some "Publicly-available" documents could potentially contain inappropriate information according to standards set by DOE information security policy and DOE Guides. - Such documents would not be freely

406

Message Security  

NLE Websites -- All DOE Office Websites (Extended Search)

Message Message Security Services Overview ECS Audio/Video Conferencing Fasterdata IPv6 Network Network Performance Tools (perfSONAR) ESnet OID Registry PGP Key Service Virtual Circuits (OSCARS) OSCARS Case Study Documentation User Manual FAQ Design Specifications Functional Specifications Notifications Publications Authorization Policy Default Attributes Message Security Clients For Developers Interfaces Links Hardware Requirements DOE Grids Service Transition Contact Us Technical Assistance: 1 800-33-ESnet (Inside the US) 1 800-333-7638 (Inside the US) 1 510-486-7600 (Globally) 1 510-486-7607 (Globally) Report Network Problems: trouble@es.net Provide Web Site Feedback: info@es.net Message Security Overview The OSCARS Web pages and Web Services are run within a Tomcat container which uses SSL connections to encrypt all messages. The OSCARS Web Service

407

V-038: Google Chrome Two Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

8: Google Chrome Two Vulnerabilities 8: Google Chrome Two Vulnerabilities V-038: Google Chrome Two Vulnerabilities December 3, 2012 - 1:00am Addthis PROBLEM: Google Chrome Two Vulnerabilities PLATFORM: The vulnerabilities are reported in versions prior to 23.0.1271.95. ABSTRACT: Two vulnerabilities have been reported in Google Chrome REFERENCE LINKS: Stable Channel Update Secunia Advisory SA51447 CVE-2012-5137 CVE-2012-5138 IMPACT ASSESSMENT: High DISCUSSION: Two vulnerabilities have been reported in Google Chrome, where one has an unknown impact and the other can be exploited by malicious people to compromise a user's system. 1) An error exists when handling file paths. 2) A use-after-free error exists when handling media sources. The vulnerabilities are reported in versions prior to 23.0.1271.95. IMPACT:

408

IVF: characterizing the vulnerability of microprocessor structures to intermittent faults  

Science Journals Connector (OSTI)

With the advancement of CMOS manufacturing process to nano-scale, future shipped microprocessors will be increasingly vulnerable to intermittent faults. Quantitatively characterizing the vulnerability of microprocessor structures to intermittent faults ...

Songjun Pan; Yu Hu; Xiaowei Li

2010-03-01T23:59:59.000Z

409

Information Security  

Directives, Delegations, and Requirements

Establishes security requirements for the protection and control of information and matter required to be classified or controlled by statutes, regulations, or Department of Energy directives. Section E, Technical Surveillance Countermeasures Program, is Official Use Only. Please contact the DOE Office of Health, Safety and Security at 301-903-0292 if your official duties require you to have access to this part of the directive. Cancels: DOE M 471.2-1B, DOE M 471.2-1C, DOE M 471.2-4, and DOE O 471.2A

2007-06-29T23:59:59.000Z

410

Information Security  

Directives, Delegations, and Requirements

This Manual establishes security requirements for the protection and control of information and matter required to be classified or controlled by statutes, regulations, or Department of Energy directives. Attachment E, Technical Surveillance Countermeasures Program, is for Official Use Only. Contact the Office of Security and Safety Performance Assurance at 301-903-3653 if your official duties require you to have access to this part of the directive. Cancels: DOE M 471.2-1B, DOE M 471.2-1C, DOE M 471.2-4, and DOE O 471.2A.

2005-08-26T23:59:59.000Z

411

Energy Vulnerability Assessment for the US Pacific Islands. Technical Appendix 2  

SciTech Connect

The study, Energy Vulnerability Assessment of the US Pacific Islands, was mandated by the Congress of the United States as stated in House Resolution 776-220 of 1992, Section 1406. The resolution states that the US Secretary of Energy shall conduct a study of the implications of the unique vulnerabilities of the insular areas to an oil supply disruption. Such study shall outline how the insular areas shall gain access to vital oil supplies during times of national emergency. The resolution defines insular areas as the US Virgin Islands, Puerto Rico, Guam, American Samoa, the Commonwealth of the Northern Mariana Islands, and Palau. The US Virgin Islands and Puerto Rico are not included in this report. The US Department of Energy (USDOE) has broadened the scope of the study contained in the House Resolution to include emergency preparedness and response strategies which would reduce vulnerability to an oil supply disruption as well as steps to ameliorate adverse economic consequences. This includes a review of alternative energy technologies with respect to their potential for reducing dependence on imported petroleum. USDOE has outlined the four tasks of the energy vulnerability assessment as the following: (1) for each island, determine crude oil and refined product demand/supply, and characterize energy and economic infrastructure; (2) forecast global and regional oil trade flow patterns, energy demand/supply, and economic activities; (3) formulate oil supply disruption scenarios and ascertain the general and unique vulnerabilities of these islands to oil supply disruptions; and (4) outline emergency preparedness and response options to secure oil supplies in the short run, and reduce dependence on imported oil in the longer term.

Fesharaki, F.; Rizer, J.P.; Greer, L.S.

1994-05-01T23:59:59.000Z

412

SECURITY HANDBOOK 2 UH IT SECURITY HANDBOOK  

E-Print Network (OSTI)

Administration · 2-Factor Authentication Administration for PCI compliance · Web Site Security Scanning, please contact security@uh.edu. · Web Site Security Scanning · 2-Factor Authentication Administration

Azevedo, Ricardo

413

Tag: Security | Y-12 National Security Complex  

NLE Websites -- All DOE Office Websites (Extended Search)

Search Tags Tag: Security Tag: Security Displaying 1 - 6 of 6... Category: Security Sheltering in Place If you are advised to shelter-in-place by local news or our website,...

414

GAO Challenges and Efforts to Secure Control Systems (March 2004) |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

GAO Challenges and Efforts to Secure Control Systems (March 2004) GAO Challenges and Efforts to Secure Control Systems (March 2004) GAO Challenges and Efforts to Secure Control Systems (March 2004) Computerized control systems perform vital functions across many of our nation's critical infrastructures. For example, in natural gas distribution, they can monitor and control the pressure and flow of gas through pipelines. In October 1997, the President's Commission on Critical Infrastructure Protection emphasized the increasing vulnerability of control systems to cyber attacks. The House Committee on Government Reform and its Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census asked GAO to report on potential cyber vulnerabilities, focusing on (1) significant cybersecurity risks associated with control systems (2) potential and reported cyber attacks

415

Security rethink  

Science Journals Connector (OSTI)

......breaches or heightening the risks. One of my clients...business to the socio-political situation of particular...based on the return on investment in keeping a high standard...times that security risks are at their highest...lay-offs. The return on investment must consider the positive......

Michael Chua

2002-09-01T23:59:59.000Z

416

Security Conditions  

Directives, Delegations, and Requirements

To ensure that DOE uniformly meets the protection requirements specified in Presidential Decision Directive 39, "U.S. Policy on Counterterrorism (U)." Attachment 2 is no longer available online. Please e-mail your request for the Attachment to: Security.Directives@hq.doe.gov. DOE N 251.44, dated 05/06/02, extends this directive until 12/31/02.

2000-09-18T23:59:59.000Z

417

Personnel Security  

Directives, Delegations, and Requirements

The order establishes requirements that will enable DOE to operate a successful, efficient, cost-effective personnel security program that will ensure accurate, timely and equitable determinations of individuals eligibility for access to classified information and Special Nuclear Material (SNM). Admin Chg 1, 10-8-13.

2011-07-27T23:59:59.000Z

418

Physical Security Systems | National Nuclear Security Administration  

NLE Websites -- All DOE Office Websites (Extended Search)

Physical Security Systems | National Nuclear Security Administration Physical Security Systems | National Nuclear Security Administration Our Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response Recapitalizing Our Infrastructure Continuing Management Reform Countering Nuclear Terrorism About Us Our Programs Our History Who We Are Our Leadership Our Locations Budget Our Operations Media Room Congressional Testimony Fact Sheets Newsletters Press Releases Speeches Events Social Media Video Gallery Photo Gallery NNSA Archive Federal Employment Apply for Our Jobs Our Jobs Working at NNSA Blog Physical Security Systems Home > About Us > Our Programs > Nuclear Security > Physical Security Systems Physical Security Systems After the 9/11 terrorist attacks, NNSA took steps to protect its critical

419

Physical Security Systems | National Nuclear Security Administration  

National Nuclear Security Administration (NNSA)

Physical Security Systems | National Nuclear Security Administration Physical Security Systems | National Nuclear Security Administration Our Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response Recapitalizing Our Infrastructure Continuing Management Reform Countering Nuclear Terrorism About Us Our Programs Our History Who We Are Our Leadership Our Locations Budget Our Operations Media Room Congressional Testimony Fact Sheets Newsletters Press Releases Speeches Events Social Media Video Gallery Photo Gallery NNSA Archive Federal Employment Apply for Our Jobs Our Jobs Working at NNSA Blog Physical Security Systems Home > About Us > Our Programs > Nuclear Security > Physical Security Systems Physical Security Systems After the 9/11 terrorist attacks, NNSA took steps to protect its critical

420

Security Forms | National Nuclear Security Administration  

National Nuclear Security Administration (NNSA)

NMMSS Information, Reports & Forms Security Forms Security Forms U.S. Department of Energy U.S. Nuclear Regulatory Commission Nuclear Materials Management & Safeguards...

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


421

September 27 29, 2010, Baltimore Convention Center Focusing on Emerging Automation Specifications and Use Cases, Software Assurance, Healthcare IT, Cyber Security, and Regulatory Compliance  

E-Print Network (OSTI)

the technical burdens of policy compliance, and innovated uses of automation across the enterprise in both, Vulnerability Identification, and Remediation Federal Information Security Management Act (FISMA) Federal Validated Tools Content Validation Innovative Case Studies Highlights Beautiful Baltimore Inner Harbor

422

U-176: Wireshark Multiple Bugs Let Remote Users Deny Service | Department  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

U-176: Wireshark Multiple Bugs Let Remote Users Deny Service U-176: Wireshark Multiple Bugs Let Remote Users Deny Service U-176: Wireshark Multiple Bugs Let Remote Users Deny Service May 24, 2012 - 7:00am Addthis PROBLEM: Wireshark Multiple Bugs Let Remote Users Deny Service PLATFORM: 1.4.0 to 1.4.12, 1.6.0 to 1.6.7 ABSTRACT: Several vulnerabilities were reported in Wireshark. A remote user can cause denial of service conditions. Reference Links: SecurityTracker Alert ID: 1027094 CVE-2012-2392 CVE-2012-2393 CVE-2012-2394 IMPACT ASSESSMENT: Medium Discussion: A remote user can send specially crafted ANSI MAP, ASF, BACapp, Bluetooth HCI, IEEE 802.11, IEEE 802.3, LTP, and R3 data to cause Wireshark to hang or enter an infinite loop. A remote user can cause the DIAMETER dissector to crash. A remote user can trigger a memory error on SPARC or Itanium processors and

423

Colombia-Cartagena Vulnerability Assessment | Open Energy Information  

Open Energy Info (EERE)

Colombia-Cartagena Vulnerability Assessment Colombia-Cartagena Vulnerability Assessment Jump to: navigation, search Name Colombia-CDKN-Cartagena Vulnerability Assessment Agency/Company /Organization Climate and Development Knowledge Network (CDKN), United Kingdom Department for International Development Sector Climate Topics Background analysis, Low emission development planning, Pathways analysis Website http://resilient-cities.iclei. Country Colombia UN Region South America References CDKN-Colombia-Cartagena Vulnerability Assessment[1] Colombia-CDKN-Cartagena Vulnerability Assessment Screenshot This article is a stub. You can help OpenEI by expanding it. References ↑ "CDKN-Colombia-Cartagena Vulnerability Assessment" Retrieved from "http://en.openei.org/w/index.php?title=Colombia-Cartagena_Vulnerability_Assessment&oldid=699760"

424

T-531: The WebVPN implementation on Cisco Adaptive Security Appliances  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

T-531: The WebVPN implementation on Cisco Adaptive Security T-531: The WebVPN implementation on Cisco Adaptive Security Appliances (ASA) 5500 T-531: The WebVPN implementation on Cisco Adaptive Security Appliances (ASA) 5500 January 10, 2011 - 8:33pm Addthis PROBLEM: The WebVPN implementation on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) PLATFORM: Listed Vunerable Platform Details ABSTRACT: The WebVPN implementation on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) permits the viewing of CIFS shares even when CIFS file browsing has been disabled, which allows remote authenticated users to bypass intended access restrictions via CIFS requests, aka Bug ID CSCsz80777. reference LINKS: CVE Vulnerability Details: CVE-2010-4680 NIST Vulnerability Summary for CVE-2010-4680

425

V-220: Juniper Security Threat Response Manager Lets Remote Authenticated  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Juniper Security Threat Response Manager Lets Remote 0: Juniper Security Threat Response Manager Lets Remote Authenticated Users Execute Arbitrary Commands V-220: Juniper Security Threat Response Manager Lets Remote Authenticated Users Execute Arbitrary Commands August 17, 2013 - 4:01am Addthis PROBLEM: A remote authenticated user can execute arbitrary commands on the target system. PLATFORM: 2010.0, 2012.0, 2012.1, 2013.1 ABSTRACT: A vulnerability was reported in Juniper Security Threat Response Manager (STRM) REFERENCE LINKS: SecurityTracker Alert ID: 1028921 CVE-2013-2970 IMPACT ASSESSMENT: High DISCUSSION: A remote authenticated user can inject commands to execute arbitrary operating system commands with the privileges of the target web service. This can be exploited to gain shell access on the target device.

426

U-164: Microsoft Security Bulletin Advance Notification for May 2012 |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

64: Microsoft Security Bulletin Advance Notification for May 64: Microsoft Security Bulletin Advance Notification for May 2012 U-164: Microsoft Security Bulletin Advance Notification for May 2012 May 8, 2012 - 7:00am Addthis PROBLEM: Microsoft Security Bulletin Advance Notification for May 2012. PLATFORM: Windows XP Service Pack 3, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Microsoft Visio Viewer 2010 and Microsoft Visio Viewer 2010 Service Pack 1, Microsoft SharePoint Server, Microsoft Silverlight ABSTRACT: Microsoft Security Bulletin Advance Notification for May 2012. Microsoft has posted 3 Critical Bulletins and 4 Important Bulletins. Bulletins with the Maximum Severity Rating and Vulnerability Impact of "Critical" may allow remote execution of code. Microsoft is hosting a webcast to address

427

U-124: Microsoft Security Bulletin Advance Notification for March 2012 |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

24: Microsoft Security Bulletin Advance Notification for March 24: Microsoft Security Bulletin Advance Notification for March 2012 U-124: Microsoft Security Bulletin Advance Notification for March 2012 March 14, 2012 - 7:00am Addthis PROBLEM: Microsoft Security Bulletin Advance Notification for March 2012. PLATFORM: Windows XP Service Pack 3, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Microsoft Visio Viewer 2010 and Microsoft Visio Viewer 2010 Service Pack 1, Microsoft SharePoint Server, Microsoft Silverlight ABSTRACT: Microsoft Security Bulletin Advance Notification for March 2012. Microsoft has posted 1 Critical Bulletin, 4 Important bulletins and 1 Moderate bulletin. Bulletins with the Maximum Severity Rating and Vulnerability Impact of "Critical" may allow remote execution of code. Microsoft is

428

U-103: Microsoft Security Bulletin Advance Notification for February 2012 |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

03: Microsoft Security Bulletin Advance Notification for 03: Microsoft Security Bulletin Advance Notification for February 2012 U-103: Microsoft Security Bulletin Advance Notification for February 2012 February 15, 2012 - 7:00am Addthis PROBLEM: Microsoft Security Bulletin Advance Notification for February 2012. PLATFORM: Windows XP Service Pack 3, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Microsoft Visio Viewer 2010 and Microsoft Visio Viewer 2010 Service Pack 1, Microsoft SharePoint Server, Microsoft Silverlight ABSTRACT: Microsoft Security Bulletin Advance Notification for February 2012. Microsoft has posted 6 Critical Bulletins and 5 Important bulletins. Bulletins with the Maximum Severity Rating and Vulnerability Impact of "Critical" may allow remote execution of code. Microsoft is hosting a

429

T-635: Cisco AnyConnect Secure Mobility Client Lets Remote Users Execute  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Cisco AnyConnect Secure Mobility Client Lets Remote Users 5: Cisco AnyConnect Secure Mobility Client Lets Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges T-635: Cisco AnyConnect Secure Mobility Client Lets Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges June 2, 2011 - 4:38pm Addthis PROBLEM: The Cisco AnyConnect Secure Mobility Client is the Cisco next-generation VPN client, which provides remote users with secure IPsec (IKEv2) or SSL Virtual Private Network (VPN) connections to Cisco 5500 Series Adaptive Security Appliances (ASA) and devices that are running Cisco IOS Software. PLATFORM: Cisco AnyConnect Secure Mobility Client Platform & Affected Versions ABSTRACT: Cisco AnyConnect Secure Mobility Client contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a

430

CS2SAT: THE CONTROL SYSTEMS CYBER SECURITY SELF-ASSESSMENT TOOL  

SciTech Connect

The Department of Homeland Security National Cyber Security Division has developed the Control System Cyber Security Self-Assessment Tool (CS2SAT) that provides users with a systematic and repeatable approach for assessing the cyber-security posture of their industrial control system networks. The CS2SAT was developed by cyber security experts from Department of Energy National Laboratories and with assistance from the National Institute of Standards and Technology. The CS2SAT is a desktop software tool that guides users through a step-by-step process to collect facility-specific control system information and then makes appropriate recommendations for improving the systems cyber-security posture. The CS2SAT provides recommendations from a database of industry available cyber-security practices, which have been adapted specifically for application to industry control system networks and components. Each recommendation is linked to a set of actions that can be applied to remediate-specific security vulnerabilities.

Kathleen A. Lee

2008-01-01T23:59:59.000Z

431

Improved wireless security for GMSK-based devices using RF fingerprinting  

Science Journals Connector (OSTI)

Gaussian minimum shift keying (GMSK) is employed in current global system for mobile (GSM) networks and remains a viable option for future wireless systems. Physical layer (PHY) security is demonstrated using RF fingerprints from ... Keywords: GMSK, GSM networks, Gaussian minimum shift keying, MDA, PHY security, RF fingerprinting, SEI, authentication, electronic security, multiple discriminant analysis, physical layer, specific emitter identification, wireless networks, wireless security

Donald R. Reising; Michael A. Temple; Michael J. Mendenhall

2010-03-01T23:59:59.000Z

432

Multiplex Chaos Synchronization in Semiconductor Lasers with Multiple Optoelectronic Feedbacks  

E-Print Network (OSTI)

Secure chaos based multiplex communication system scheme is proposed utilizing globally coupled semiconductor lasers with multiple variable time delay optoelectronic feedbacks.

E. M. Shahverdiev; K. A. Shore

2011-11-06T23:59:59.000Z

433

Security seal  

DOE Patents (OSTI)

Security for a package or verifying seal in plastic material is provided by a print seal with unique thermally produced imprints in the plastic. If tampering is attempted, the material is irreparably damaged and thus detectable. The pattern of the imprints, similar to "fingerprints" are recorded as a positive identification for the seal, and corresponding recordings made to allow comparison. The integrity of the seal is proved by the comparison of imprint identification records made by laser beam projection.

Gobeli, Garth W. (Albuquerque, NM)

1985-01-01T23:59:59.000Z

434

T-630: Security update available for Adobe Flash Player | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Security update available for Adobe Flash Player 0: Security update available for Adobe Flash Player T-630: Security update available for Adobe Flash Player May 25, 2011 - 3:35pm Addthis PROBLEM: Vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system. PLATFORM: The vulnerabilities are reported in the following versions: Adobe Flash Player 10.2.159.1 and earlier for Windows, Macintosh, Linux and Solaris. Adobe Flash Player 10.2.154.28 and earlier for Chrome. Adobe Flash Player 10.2.157.51 and earlier for Android. ABSTRACT: Critical vulnerabilities have been identified in Adobe Flash Player 10.2.159.1 and earlier versions (Adobe Flash Player 10.2.154.28 and earlier for Chrome users) for Windows, Macintosh, Linux and Solaris, and Adobe

435

Nonproliferation & International Security | National Nuclear Security  

NLE Websites -- All DOE Office Websites (Extended Search)

Nonproliferation & International Security | National Nuclear Security Nonproliferation & International Security | National Nuclear Security Administration Our Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response Recapitalizing Our Infrastructure Continuing Management Reform Countering Nuclear Terrorism About Us Our Programs Our History Who We Are Our Leadership Our Locations Budget Our Operations Media Room Congressional Testimony Fact Sheets Newsletters Press Releases Speeches Events Social Media Video Gallery Photo Gallery NNSA Archive Federal Employment Apply for Our Jobs Our Jobs Working at NNSA Blog Nonproliferation & International Security Home > About Us > Our Programs > Nonproliferation > Nonproliferation & International Security Nonproliferation & International Security

436

Nonproliferation & International Security | National Nuclear Security  

National Nuclear Security Administration (NNSA)

Nonproliferation & International Security | National Nuclear Security Nonproliferation & International Security | National Nuclear Security Administration Our Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response Recapitalizing Our Infrastructure Continuing Management Reform Countering Nuclear Terrorism About Us Our Programs Our History Who We Are Our Leadership Our Locations Budget Our Operations Media Room Congressional Testimony Fact Sheets Newsletters Press Releases Speeches Events Social Media Video Gallery Photo Gallery NNSA Archive Federal Employment Apply for Our Jobs Our Jobs Working at NNSA Blog Nonproliferation & International Security Home > About Us > Our Programs > Nonproliferation > Nonproliferation & International Security Nonproliferation & International Security

437

2014 Headquarters Facilities Master Security Plan- Chapter 14, Cyber Security  

Energy.gov (U.S. Department of Energy (DOE))

2014 Headquarters Facilities Master Security Plan - Chapter 14, Cyber Security Describes the DOE Headquarters Cyber Security Program.

438

Secure the edge? Understanding the risk towards wireless grids Edgeware technology  

Science Journals Connector (OSTI)

This article contributes to the foundational understanding of the security vulnerabilities and risk towards wireless grid Edgeware technology. Since communication networks and devices are subject to becoming the target of exploitation by hackers (e.g., individuals who attempt to gain unauthorised access to computer systems), these individuals are gaining ever-increasing knowledge of the often widely-reported exploitable vulnerabilities in these types of innovative technologies; and thus are able to craft increasingly effective computer network attacks (CNA) against such technologies. This research responds to the overall proposition: what security vulnerability enumerations would contribute to the degradation and risk in using a wireless grid Edgeware application in a virtualised cloud environment? Using supporting research pertaining to cyber-attacks and vulnerabilities towards a wireless cloud (e.g., the integration of a cloud computing and a wireless grid architecture), security vulnerabilities in virtualisation environments and specific vulnerabilities exploited against a wireless grid Edgeware application, this research provides a greater understanding of the practical ways wireless grid Edgeware technology can be attacked and the risk in utilising this technology.

Tyson Brooks; Michelle Kaarst-Brown; Carlos Caicedo; Joon Park; Lee W. McKnight

2014-01-01T23:59:59.000Z

439

Using Operational Security (OPSEC) to Support a Cyber Security...  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Using Operational Security (OPSEC) to Support a Cyber Security Culture in Control Systems Environments Using Operational Security (OPSEC) to Support a Cyber Security Culture in...

440

Transportation Security | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

Transportation Security Transportation Security Transportation Security More Documents & Publications Overview for Newcomers West Valley Demonstration Project Low-Level Waste...

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


441

Cyber security in the Smart Grid: Survey and challenges  

Science Journals Connector (OSTI)

The Smart Grid, generally referred to as the next-generation power system, is considered as a revolutionary and evolutionary regime of existing power grids. More importantly, with the integration of advanced computing and communication technologies, the Smart Grid is expected to greatly enhance efficiency and reliability of future power systems with renewable energy resources, as well as distributed intelligence and demand response. Along with the silent features of the Smart Grid, cyber security emerges to be a critical issue because millions of electronic devices are inter-connected via communication networks throughout critical power facilities, which has an immediate impact on reliability of such a widespread infrastructure. In this paper, we present a comprehensive survey of cyber security issues for the Smart Grid. Specifically, we focus on reviewing and discussing security requirements, network vulnerabilities, attack countermeasures, secure communication protocols and architectures in the Smart Grid. We aim to provide a deep understanding of security vulnerabilities and solutions in the Smart Grid and shed light on future research directions for Smart Grid security.

Wenye Wang; Zhuo Lu

2013-01-01T23:59:59.000Z

442

Power grid vulnerability: A complex network approach  

Science Journals Connector (OSTI)

Power grids exhibit patterns of reaction to outages similar to complex networks. Blackout sequences follow power laws as complex systems operating near a critical point. Here the tolerance of electric power grids to both accidental and malicious outages is analyzed in the framework of complex network theory. In particular the quantity known as efficiency is modified by introducing a new concept of distance between nodes. As a result a new parameter called net-ability is proposed to evaluate the performance of power grids. A comparison between efficiency and net-ability is provided by estimating the vulnerability of sample networks in terms of both the metrics.

S. Arianos; E. Bompard; A. Carbone; F. Xue

2009-01-01T23:59:59.000Z

443

Border Security | ornl.gov  

NLE Websites -- All DOE Office Websites (Extended Search)

Border Security SHARE Border Security Testing of unmanned aerial surveillance equipment. ORNL performs border security research at the Security Sciences Field Laboratory (SSFL),...

444

Social vulnerability indicators as a sustainable planning tool  

SciTech Connect

In the face of global warming and environmental change, the conventional strategy of resource centralization will not be able to cope with a future of increasingly extreme climate events and related disasters. It may even contribute to inter-regional disparities as a result of these events. To promote sustainable development, this study offers a case study of developmental planning in Chiayi, Taiwan and a review of the relevant literature to propose a framework of social vulnerability indicators at the township level. The proposed framework can not only be used to measure the social vulnerability of individual townships in Chiayi, but also be used to capture the spatial developmental of Chiayi. Seventeen social vulnerability indicators provide information in five dimensions. Owing to limited access to relevant data, the values of only 13 indicators were calculated. By simply summarizing indicators without using weightings and by using zero-mean normalization to standardize the indicators, this study calculates social vulnerability scores for each township. To make social vulnerability indicators more useful, this study performs an overlay analysis of social vulnerability and patterns of risk associated with national disasters. The social vulnerability analysis draws on secondary data for 2012 from Taiwan's National Geographic Information System. The second layer of analysis consists of the flood potential ratings of the Taiwan Water Resources Agency as an index of biophysical vulnerability. The third layer consists of township-level administrative boundaries. Analytical results reveal that four out of the 18 townships in Chiayi not only are vulnerable to large-scale flooding during serious flood events, but also have the highest degree of social vulnerability. Administrative boundaries, on which social vulnerability is based, do not correspond precisely to cross-administrative boundaries, which are characteristics of the natural environment. This study adopts an exploratory approach that provides Chiayi and other government agencies with a foundation for sustainable strategic planning for environmental change. The final section offers four suggestions concerning the implications of social vulnerability for local development planning. -- Highlights: This study proposes a framework of social vulnerability indicators at the township level in Chiayi County, Taiwan. Seventeen social vulnerability indicators are categorized into four dimensions. This study performs a three-layer overlay analysis of social vulnerability and natural disaster risk patterns. 4 out of the 18 townships not only have potential for large-scale flooding, but also high degree of social vulnerability. This study provides a foundation for sustainable strategic planning to deal with environmental change. Four suggestions are proposed regarding the implications of social vulnerability for local development planning.

Lee, Yung-Jaan, E-mail: yungjaanlee@gmail.com

2014-01-15T23:59:59.000Z

445

Information Security | National Nuclear Security Administration  

National Nuclear Security Administration (NNSA)

Information Security | National Nuclear Security Administration Information Security | National Nuclear Security Administration Our Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response Recapitalizing Our Infrastructure Continuing Management Reform Countering Nuclear Terrorism About Us Our Programs Our History Who We Are Our Leadership Our Locations Budget Our Operations Media Room Congressional Testimony Fact Sheets Newsletters Press Releases Speeches Events Social Media Video Gallery Photo Gallery NNSA Archive Federal Employment Apply for Our Jobs Our Jobs Working at NNSA Blog Information Security Home > About Us > Our Programs > Nuclear Security > Information Security Information Security Information security deals with requirements for the protection and control of information and matter required to be classified or controlled by

446

Security for grids  

SciTech Connect

Securing a Grid environment presents a distinctive set of challenges. This paper groups the activities that need to be secured into four categories: naming and authentication; secure communication; trust, policy, and authorization; and enforcement of access control. It examines the current state of the art in securing these processes and introduces new technologies that promise to meet the security requirements of Grids more completely.

Humphrey, Marty; Thompson, Mary R.; Jackson, Keith R.

2005-08-14T23:59:59.000Z

447

V-087: Adobe Flash Player Two Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Adobe Flash Player Two Vulnerabilities 7: Adobe Flash Player Two Vulnerabilities V-087: Adobe Flash Player Two Vulnerabilities February 8, 2013 - 6:00am Addthis PROBLEM: Two vulnerabilities have been reported in Adobe Flash Player PLATFORM: Vulnerabilities are reported in the following versions: Adobe Flash Player versions 11.5.502.146 and earlier for Windows and Macintosh Adobe Flash Player versions 11.2.202.261 and earlier for Linux Adobe Flash Player versions 11.1.115.36 and earlier for Android 4.x Adobe Flash Player versions 11.1.111.31 and earlier for Android 3.x Adobe Flash Player versions 11.5.31.137 and earlier for Chrome users Adobe Flash Player versions 11.3.378.5 and earlier for Internet Explorer 10 users on Windows 8 ABSTRACT: Two vulnerabilities are reported as 0-day which can be exploited by

448

V-087: Adobe Flash Player Two Vulnerabilities | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

7: Adobe Flash Player Two Vulnerabilities 7: Adobe Flash Player Two Vulnerabilities V-087: Adobe Flash Player Two Vulnerabilities February 8, 2013 - 6:00am Addthis PROBLEM: Two vulnerabilities have been reported in Adobe Flash Player PLATFORM: Vulnerabilities are reported in the following versions: Adobe Flash Player versions 11.5.502.146 and earlier for Windows and Macintosh Adobe Flash Player versions 11.2.202.261 and earlier for Linux Adobe Flash Player versions 11.1.115.36 and earlier for Android 4.x Adobe Flash Player versions 11.1.111.31 and earlier for Android 3.x Adobe Flash Player versions 11.5.31.137 and earlier for Chrome users Adobe Flash Player versions 11.3.378.5 and earlier for Internet Explorer 10 users on Windows 8 ABSTRACT: Two vulnerabilities are reported as 0-day which can be exploited by

449

V-116: Google Picasa BMP and TIFF Images Processing Vulnerabilities |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

6: Google Picasa BMP and TIFF Images Processing Vulnerabilities 6: Google Picasa BMP and TIFF Images Processing Vulnerabilities V-116: Google Picasa BMP and TIFF Images Processing Vulnerabilities March 21, 2013 - 6:00am Addthis PROBLEM: Two vulnerabilities have been discovered in Google Picasa PLATFORM: Google Picasa Version 3.9.0 build 136.09 for Windows/3.9.14.34 for Mac ABSTRACT: Two vulnerabilities have been discovered in Google Picasa, which can be exploited by malicious people to compromise a user's system. REFERENCE LINKS: Secunia Advisory SA51652 Picasa Release Notes IMPACT ASSESSMENT: High DISCUSSION: 1) A sign extension error when processing the color table of a BMP image can be exploited to cause a heap-based buffer overflow via a BMP image with a specially crafted "biBitCount" field. 2) The application bundles a vulnerable version of LibTIFF.

450

T-550: Apache Denial of Service Vulnerability | Department of Energy  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

550: Apache Denial of Service Vulnerability 550: Apache Denial of Service Vulnerability T-550: Apache Denial of Service Vulnerability February 4, 2011 - 3:03am Addthis PROBLEM: Apache 'APR-util' is prone to a vulnerability that may allow attackers to cause a denial-of-service condition. PLATFORM: Versions prior to 'APR-util' 1.3.10 are vulnerable. ABSTRACT: Apache 'APR-util' is prone to a vulnerability that may allow attackers to cause a denial-of-service condition. Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, may allow remote users to cause a Denial of Service (DoS - memory consumption). reference LINKS: Securityfocus

451

Visualizing Cyber Security: Usable Workspaces  

SciTech Connect

An environment that supports cyber analytics work should enable multiple, simultaneous investigations, information foraging, and provide a solution space for organizing data. We describe our study of cyber security professionals and visualizations in a large, high-resolution display work environment. We discuss the tasks and needs of analysts that such an environment can support and present several prototypes designed to support these needs. We conclude with a usability evaluation of the prototypes and additional lessons learned.

Fink, Glenn A.; North, Christopher L.; Endert, Alexander; Rose, Stuart J.

2009-10-11T23:59:59.000Z

452

Vulnerability in Climate Change Research: A Comprehensive Conceptual Framework  

E-Print Network (OSTI)

hazards assessments, for instance, have regarded naturaladdressing natural hazards and vulnerability assessments ad-assessment developed by Klein and Nicholls (1999) sees natural

Fssel, HansMartin

2005-01-01T23:59:59.000Z

453

AFTER A Framework for electrical power sysTems vulnerability...  

Open Energy Info (EERE)

Germany) Jump to: navigation, search Project Name AFTER A Framework for electrical power sysTems vulnerability identification, dEfense and Restoration Country Germany Coordinates...

454

Mapping Climate Change Vulnerability and Impact Scenarios - A...  

Open Energy Info (EERE)

Sub-national Planners Jump to: navigation, search Tool Summary LAUNCH TOOL Name: Mapping Climate Change Vulnerability and Impact Scenarios - A Guidebook for Sub-national Planners...

455

Antioch University and EPA Webinar: Assessing Vulnerability of...  

Energy Savers (EERE)

Antioch University and EPA Webinar: Assessing Vulnerability of Water Conveyance Infrastructure from a Changing Climate in the Context of a Changing Landscape Antioch University and...

456

Comprehensive Vulnerability and Threat Analysis | ornl.gov  

NLE Websites -- All DOE Office Websites (Extended Search)

Vulnerability and Threat Analysis Our world is characterized by ever-changing threats to critical facilities, national assets and international interests. Understanding...

457

Privacy vulnerability of published anonymous mobility traces  

Science Journals Connector (OSTI)

Mobility traces of people and vehicles have been collected and published to assist the design and evaluation of mobile networks, such as large-scale urban sensing networks. Although the published traces are often made anonymous in that the true identities ... Keywords: mobility traces, privacy, security and protection

Chris Y. T. Ma; David K. Y. Yau; Nung Kwan Yip; Nageswara S. V. Rao

2013-06-01T23:59:59.000Z

458

Designing security into software  

E-Print Network (OSTI)

When people talk about software security, they usually refer to security applications such as antivirus software, firewalls and intrusion detection systems. There is little emphasis on the security in the software itself. ...

Zhang, Chang Tony

2006-01-01T23:59:59.000Z

459

Review: Intranet Security  

Science Journals Connector (OSTI)

......Review Review: Intranet Security Reviewed by John Williamson Intranet Security John Vacca...Advanced Computer Technology and the Law Curtis...that in advanced technology the legal system...Wolverhampton University Intranet Security ?? Intranet......

John Williamson

1998-05-01T23:59:59.000Z

460

U-063: RSA SecurID Software Token for Windows DLL Loading Error Lets Remote  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

3: RSA SecurID Software Token for Windows DLL Loading Error 3: RSA SecurID Software Token for Windows DLL Loading Error Lets Remote Users Execute Arbitrary Code U-063: RSA SecurID Software Token for Windows DLL Loading Error Lets Remote Users Execute Arbitrary Code December 16, 2011 - 8:00am Addthis PROBLEM: RSA SecurID Software Token for Windows DLL Loading Error Lets Remote Users Execute Arbitrary Code. PLATFORM: RSA SecurID Software Token 4.1 for Microsoft Windows ABSTRACT: A remote user can cause the target application to execute arbitrary code on the target user's system. reference LINKS: SecurityTracker Alert ID: 1026426 ESA-2011-039 Secunia Advisory: SA45665 Securityfocus Advisory CVE-2011-4141 RSA Online Fraud Resource Center IMPACT ASSESSMENT: High Discussion: A vulnerability was reported in RSA SecurID Software Token. A remote user

Note: This page contains sample records for the topic "multiple security vulnerabilities" from the National Library of EnergyBeta (NLEBeta).
While these samples are representative of the content of NLEBeta,
they are not comprehensive nor are they the most current set.
We encourage you to perform a real-time search of NLEBeta
to obtain the most current and comprehensive results.


461

U-063: RSA SecurID Software Token for Windows DLL Loading Error Lets Remote  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

63: RSA SecurID Software Token for Windows DLL Loading Error 63: RSA SecurID Software Token for Windows DLL Loading Error Lets Remote Users Execute Arbitrary Code U-063: RSA SecurID Software Token for Windows DLL Loading Error Lets Remote Users Execute Arbitrary Code December 16, 2011 - 8:00am Addthis PROBLEM: RSA SecurID Software Token for Windows DLL Loading Error Lets Remote Users Execute Arbitrary Code. PLATFORM: RSA SecurID Software Token 4.1 for Microsoft Windows ABSTRACT: A remote user can cause the target application to execute arbitrary code on the target user's system. reference LINKS: SecurityTracker Alert ID: 1026426 ESA-2011-039 Secunia Advisory: SA45665 Securityfocus Advisory CVE-2011-4141 RSA Online Fraud Resource Center IMPACT ASSESSMENT: High Discussion: A vulnerability was reported in RSA SecurID Software Token. A remote user

462

U-145: Microsoft Security Bulletin Summary for April 2012 | Department of  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

5: Microsoft Security Bulletin Summary for April 2012 5: Microsoft Security Bulletin Summary for April 2012 U-145: Microsoft Security Bulletin Summary for April 2012 April 11, 2012 - 9:30am Addthis PROBLEM: Microsoft Security Bulletin Summary for April 2012 PLATFORM: Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, ABSTRACT: Microsoft Security Bulletin Summary for April 2012. Microsoft has posted 4 Critical Bulletins and 2 Important bulletins. Bulletins with the Maximum Severity Rating and Vulnerability Impact of "Critical" may allow remote execution of code. Microsoft is hosting a webcast to address customer questions on these bulletins on April 11, 2012, at 11:00 AM Pacific Time (US & Canada). reference LINKS: Microsoft Security Bulletin Security Bulletin Summary Archive

463

V-040: Apache Tomcat Bug Lets Remote Users Bypass Security Constraints |  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

0: Apache Tomcat Bug Lets Remote Users Bypass Security 0: Apache Tomcat Bug Lets Remote Users Bypass Security Constraints V-040: Apache Tomcat Bug Lets Remote Users Bypass Security Constraints December 5, 2012 - 1:00am Addthis PROBLEM: Apache Tomcat Bug Lets Remote Users Bypass Security Constraints PLATFORM: Version(s): 6.0.0 - 6.0.35, 7.0.0 - 7.0.29 ABSTRACT: A vulnerability was reported in Apache Tomcat. REFERENCE LINKS: Apache Tomcat Red Hat Bugzilla - Bug 883634 SecurityTracker Alert ID: 1027833 CVE-2012-3546 IMPACT ASSESSMENT: High DISCUSSION: When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending /j_security_check to the end of the URL if some other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before the call to

464

National Nuclear Security Administration  

Energy.gov (U.S. Department of Energy (DOE)) Indexed Site

National Nuclear Security Administration National Nuclear Security Administration Ofice of Secure Transportation mKlK= Box RQMM= ^luquerqueI= kj= UTNUR= ;JAN 03 213 MEMORANDUM FOR GREGORY eK= WOODS GENERAL COUNSEL DEPARTMENT OF ENERGY FROM: SUBJECT: JEFFREY P. HARREL ASSIST ANT DEPU FOR SECURE 2013 ANNUAL PLANNING SUMMARY In response to your memorandum of December TI= 2012, the following information is provided for the National Nuclear Security Administration Ofice of Secure

465

Threats to financial system security  

SciTech Connect

The financial system in the United States is slowly migrating from the bricks and mortar of banks on the city square to branch banks, ATM`s, and now direct linkage through computers to the home. Much work has been devoted to the security problems inherent in protecting property and people. The impact of attacks on the information aspects of the financial system has, however, received less attention. Awareness is raised through publicized events such as the junk bond fraud perpetrated by Milken or gross mismanagement in the failure of the Barings Bank through unsupervised trading activities by Leeson in Singapore. These events, although seemingly large (financial losses may be on the order of several billion dollars), are but small contributors to the estimated $114 billion loss to all types of financial fraud in 1993. Most of the losses can be traced to the contribution of many small attacks perpetrated against a variety of vulnerable components and systems. This paper explores the magnitude of these financial system losses and identifies new areas for security to be applied to high consequence events.

McGovern, D.E.

1997-06-01T23:59:59.000Z

466

External Resources | National Nuclear Security Administration  

National Nuclear Security Administration (NNSA)

External Resources | National Nuclear Security Administration External Resources | National Nuclear Security Administration Our Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response Recapitalizing Our Infrastructure Continuing Management Reform Countering Nuclear Terrorism About Us Our Programs Our History Who We Are Our Leadership Our Locations Budget Our Operations Media Room Congressional Testimony Fact Sheets Newsletters Press Releases Speeches Events Social Media Video Gallery Photo Gallery NNSA Archive Federal Employment Apply for Our Jobs Our Jobs Working at NNSA Blog External Resources Home > content > External Resources External Resources National security is not achieved by one government agency alone, but through the joint effort of multiple agencies with extraordinarily talented

467

External Resources | National Nuclear Security Administration  

NLE Websites -- All DOE Office Websites (Extended Search)

External Resources | National Nuclear Security Administration External Resources | National Nuclear Security Administration Our Mission Managing the Stockpile Preventing Proliferation Powering the Nuclear Navy Emergency Response Recapitalizing Our Infrastructure Continuing Management Reform Countering Nuclear Terrorism About Us Our Programs Our History Who We Are Our Leadership Our Locations Budget Our Operations Media Room Congressional Testimony Fact Sheets Newsletters Press Releases Speeches Events Social Media Video Gallery Photo Gallery NNSA Archive Federal Employment Apply for Our Jobs Our Jobs Working at NNSA Blog External Resources Home > content > External Resources External Resources National security is not achieved by one government agency alone, but through the joint effort of multiple agencies with extraordinarily talented

468

Office of Security  

NLE Websites -- All DOE Office Websites (Extended Search)

Security Security Home Sub Offices › Security Policy › Security Assistance › Departmental Personnel Security Mission & Functions › Security Policy › Security Assistance › Departmental Personnel Security Human Reliability Program (HRP) Guidance Documents Security Technology Information Archive (STIA) Related Links › DOE › DOE CIO › NNSA › DOE CFO › NTC › S&S PIR Contact Us HSS Logo Welcome to the Office of Security Mission and Functions The Office of Security (HS-50) developes security policy, provides security expertise to assist field elements in planning site protection strategies and coordinates with domestic authorities to provide safeguards and security technical assistance, technical systems support, and technology development and deployment opportunities. The Office of Security, through the Office of Departmental Personnel Security, also ensures that Departmental personnel security programs (included the National Nuclear Security Administration) are consistent and effectively implemented.

469

Personnel Security Activities  

Directives, Delegations, and Requirements

Establishes objectives, requirements and responsibilities for the Personnel Security Program and Personnel Security Assurance Program. Cancels DOE O 472.1B

2003-03-25T23:59:59.000Z

470

Security | Department of Energy  

Energy Savers (EERE)

Security Security Preventing nuclear weapons materials and technologies from falling into the hands of adversaries seeking to develop weapons of mass destruction is the top...

471

Security & Privacy | EMSL  

NLE Websites -- All DOE Office Websites (Extended Search)

Security & Privacy Security & Privacy Privacy Notice We collect no