Where do I report a security flaw?

Hey there,
I just stumbled across a security flaw on the Cisco Collateral Store website.
Might you have an idea where to report it to?
Thank you.

Thank you Mike for your reply but it does not bring me any further.
I am just not comfortable with reporting a security issue to some feedback button.
I am looking for a specific address comparable to the Cisco Product Security Incident Response Team (PSIRT) for the Cisco website.
Kind regards
Colin

Similar Messages

Security flaw-To use CSOM/Javascript code for Custom Office365(Sharepoint Online) application

Hi,
I've developed custom application in Office365(Sharepoint Online) using CSOM/Javascript. Security team from client side has been reported one major issue to the our application that any end user can comment our CSOM/Javascript code and bypass the validation
or can update / insert into sharepoint list item using developer tool/ Console in Google Chrome(F12 Key).
Also end user can write his own separate code in console of Google Chrome (Developer Tool / F12) and can update / insert into Sharepoint List.
Note:- End user has Add, Edit, View permission on all Sharepoint List.
This is one major security flaw of the Sharepoint/Office365 to use CSOM /Javascript for writing code, to overcome this issue could you please provide me some solution.
Your help would be greatly appreciated!!!
Looking for reply.
Thanks,
Mahesh Sherkar
Web: http://Mahesh-Sherkar.com
Email: [email protected]

Hello Paras,
Did you get any solution for this? I think your website was implemented this form. Can you please tell me the way how I can achieve it? I am also facing same problem. Please reply me as early as possible.
Thanks,
Mihir

Where should I report and attach crash logs?

Hello,
I'm having some crashes on my app, most of them associated with the WebView, I think.
Where should I report these crashes and also attach the generated logs?
Should I open one jira issue for each of them?
Thanks.

Hi. You can file a bug against runtime in the following link:
https://javafx-jira.kenai.com/secure/Dashboard.jspa
You can also post your issue in this forum, but search for it first.
May be someone had the same issue and already filed a bug.

Security Flaw on iPhone???

Critical iPhone security flaw found
Fortify Software, a security firm, has uncovered a critical security flaw in the Apple iPhone which could lead to phishing attacks.
Because the iPhone only displays the first few characters of a URL in its Safari web browser, phishers could easily hide a fraudulent URL at the end of a link without the user even knowing it.
Even worse, the iPhone connects the browser and the phone in such a way that it may be possible to embed scam telephone numbers into a site to make the phone automatically dial the scam number.
Let’s hope Apple is working on a fix for this one because that is some scary stuff. Now, if you input addresses yourself and use bookmarks, the chances of being affected by this are relatively minimal. That said, watch out for strange emails and Google results — you can’t always trust that either.
Anybody read this? Any comments or thoughts??? Valid?

It's hardly a new flaw since disguising URLs in links has been common practice for some time. However, while the browser does indeed only show a limited number of characters from the URL being opened (more if in landscape mode than portrait) to get to the URL at all the user would either have to enter it manually, or encounter it in an email or web page where the full URL should readily be discovered.
It seems probable to me that over time, security holes will be found as in all accessible and discoverable devices on the internet. Based on experience with Apple and MacOS, I would have confidence that genuine weaknesses found in the iPhone will benefit from security fixes as expeditiously as possible.

PS2010 Report Center Security (subscribe to a report)

I don't see where I can manipulate the Report Center security, but I've noticed that people with the "Team Member" role cannot subscribe to reports. (Actions > Subscribe) The option is grayed out.
Any ideas?

Kevin,
1) The "Subscribe" option is only available if you are talking about SSRS Reports.
2) Standard BI Center in PS2010 does not come with SSRS reports. SO I am presuming you have Reporting Services implemented in SharePoint Integrated Mode.
In this scenario, the Team members group (Microsoft Project Server) is mapped to SharePoint Group Readers (Microsoft Project Server), which is why they cannot create subscriptions. The only was I see out of this is to break the inheritance
of permissions of BI Center from PWA and add users manually to at least Contribute Level, if you really need to the self-subscription option. Alternatively, you could just set up a subscription as an admin for the users I believe.
Prasanna Adavi,PMP,MCTS,MCITP,MCT TWitter: @prasannaadavi Blog: http://www.prasannaadavi.com

BusinessObjects security flaw left users vulnerable to attack

Audit found this web article "BusinessObjects security flaw left users vulnerable to attack" http://searchsap.techtarget.com/news/2240025968/BusinessObjects-security-flaw-left-users-vulnerable-to-attack?asrc=EM_NLN_13056439&track=NL-137&ad=804092
and they were wondering if our installation of BusinessObjects was also vulnerable. I was not able to answer for sure, so I asked our BASIS team. They said that it is not clear from the article what components are actually affected or in what patch level this is corrected.
Does anyone know specifically where the security flaw is?
Thanks,
~Matt Strehlow

Hi Denis
thanks for the reply.
Are you absolutely sure that the passage should not be in the file any more?
I've checked now 3 different installations and I've even checked the axis2.xml in the war files I found (dated 04/22/2010) and they all do contain these two lines:
<parameter name="userName">admin</parameter>
<parameter name="password">axis2</parameter>
The installation were BOXI 3.1 SP3, meaning we used the "merged" installation files that include the SP3. One of the installations I checked has even Fix Pack 3.4 installed.
The only axis2.xml file I found that did not contain this passage was from a BODI installation...
am I missing something here?
thanks for any help!
MU

Security Flaw: Screen Saver Authentication

Hi,
I have found a security flaw, it exists in both Panther and Tiger. If a system has 2 accounts, the first account being active and locked through a screen saver. The second account (if administrator) can type their username/password in the authentication screen, and it will unlock the first account. This works if the first account is an administrator or not. Any administrator username/password will authenticate any other account from the screen saver authentication box. I have proven this on 2 machines, a D2.5 G5, and a 1.6 iMac G5.
Please contact me for further testing.

it's not a TECHNICAL flaw, it is however a logical flaw, yes.
Because admins are part of the sudoers files, one admin does have the permission to unlock another admin like that, the same as how when logged in with one account you can use another admin account to authorize the installation of software (why it's not necessary to be logged in with your admin account)
The behavior I suspect you desire is the behavior Windows uses, where when you use an admin account to unlock a computer, it logs out the user who locked it (assuming the admin isn't the one logged in).
I suggest you submit a feature request to Apple.

Firefox reporting bad security certificates

All of a sudden, Firefox is reporting "bad security certificate" for a number of websites--including Mozilla's!! I am using version 6.0.
The problem is worst on Google+. I added exceptions for the security certificate issues, but Firefox will not load any photos at all anymore for Google+. This is not an issue with IE on the same computer. This problem has been occurring only for the last three days.

I had already read that article, performed the recommended actions, and upgraded to 6.0.1. Unfortunately this has not solved anything. In addition to Google+, other https websites are having the same problem: Vanguard, Yahoo Mail, etc. This is happening across three of my computers, only on Firefox. When I use IE on the same computers to navigate to the same sites, no problems are occurring. I have tested both work and home PCs and it is happening no matter where I connect from.

Adobe Read X1 security flaws

In a recent issue of Computer Active, I noticed that you had released a patch for eight security flaws discovered in Adobe Reader. I tried to apply this fix via Computer Active's suggested link, but could not. I have checked Adobe Reader X1 on my computer but the help just says there are no updates. Could you please advise me where to find the fix in order that I may ensure my system is not at risk.
Thanks.

You can get the latest version of Reader for your OS here: Adobe - Adobe Reader download - All versions

How to create a crystal report using secured web service as a datasource?

Hi All Expert,
I having some challenges on how to create a report using secured web service as a datasource in crystal report designer (CR11 R3).
Secured Web Service including the certificate trusting, token authentication, header and/or body encryption. All web services running on https protocal.
Could you please suggest me on the solution?
Thank you and Best Regards,
Cherr

Please re-post if this is still an issue or purchase a case and have a dedicated support engineer work with you directly:
http://store.businessobjects.com/store/bobjamer/DisplayProductByTypePage&parentCategoryID=&categoryID=11522300?resid=-Z5tUwoHAiwAAA8@NLgAAAAS&rests=1254701640551

How do I report a security problem to Firefox?

Here's the problem: 
Wednesday morning my Mac at home got infected by malware which I believe is usually called the "Google redirect virus". My Mac at home has been upgraded to OSX 10.6.7 and I believe I was using Firefox 3.6.13 (it automatically upgraded tonight). I haven't been able to find any useful information on line about this malware. 
The behavior after infection was that every time I tried to use Google my request would get redirected. If I entered www.google.com in the address bar, the URL would get changed to www.google.com/FuneralHomes/<something> and the browser would try to go there and a "Under Construction" error message or a no-such-page message would be returned. This started happening after I did a Google search and was checking various links in Firefox, but once it started in Firefox I got the same behavior in Safari even without using Safari to look at any links. And it continued to happen in Safari even after I did a "Reset Safari..." 
When I got infected I was using a non-adminstrator account and I was not asked to download anything nor was I prompted for a password. 
I searched on "Google redirect Mac virus" using my (so far) untouched work computer and found several suggestions but no solutions. Apparently this is a PC problem that's been around a few years, but there were some Mac reports from last year. So last night I checked the DNS addresses in my
Network preferences, looked at /etc/hosts, and removed the only plug-in from the Library:Internet Plug-ins of the infected account, even though it was a Picasa plug-in that predated this infection. None of those seemed to be the problem. I also scanned my disk with an up-to-date "Norton AntiVirus" which
I got from work some time ago, but it found no viruses. 
What really puzzles me is that the problem gradually went away while I was checking it last night. At first, when I entered www.google.com the browser would still show the redirected address in the prompt that comes up and it had the Legacy.com logo on the left instead of the Google one but it would actually go to the Google website (unless I'm being spoofed). Then at a later attempt, only the wrong logo persisted. Then at an even later attempt the logo got fixed and everything looked fine and appeared to behave correctly. 
Frankly, that's a little scary. It's as if a really smart trojan got
installed and was covering its tracks while it set up a man-in-the-middle attack (please advise if I'm misusing the jargon). If I'm being too paranoid, great, but I'd still like to know how such behavior could be induced on my machine just by linking to a website. Can anyone help?
''moderator- fixed the leading space formatting errors in this posting''

Thanks, the-edmeister, but the only relevant post I found was from GB Colburn on bleepingcomputer.com, wherein he reported a similar problem about a year ago. I've found a few similar threads in the last year or so (by searching "Google redirect mac virus" in Google) but they are all about the same: someone reports the problem, responders have various random suggestions, the problem seems to go away by itself (at least sometimes), and there's nothing conclusive either good or bad.
Without myself being as knowledgeable as GB Colburn, it doesn't look to me like the problem is in the DNS system or the router. It acts more like some malware in the automatic completion in the address bar of the browser or maybe in the history system, but I can't figure out how an infection in one browser could affect another browser. And I *really* can't figure out how it could be self-healing.
It's really frustrating that none of the major parties involved in this—Firefox, Google, Safari (Apple), Verizon (my internet provider)—even have a process for reporting a security issue. At least not one that I, an ordinary semi-naive user, can find.

Acrobat 9.2.0 Update Breaks Text Box Tool, Possibly Introduces a New Security Flaw.

Anyone have any ideas for this one?
Once we upgraded to version 9.2.0 (This is a major security release that fixes a Javascript security flaw) our text box tool no longer works the way we want it and crashes the program.
Try this:
1. Open any PDF document on a Windows XP SP3 computer with Adobe Acrobat 9.2.0.
2. Add the 'Text Box Tool' to the toolbar by right-clicking the toolbar and selecting 'MoreTools' then placing a checkbox next to the 'Text Box Tool'.
3. Click the 'Text Box Tool' on the toolbar and draw a new textbox anywhere on the PDF document.
4. Click out of the textbox to cancel typing mode, then single click back on the textbox that you just created.
5. Right-click the textbox that you created and select 'Properties..."
6. Under the 'Appearance' tab,
a. Select Style: No Border
b. Select Fill Color: No Color
c. Check the box 'Make Properties Default'
d. Click OK.
7. Click the Text Box Tool again, and draw another textbox (Since there is no border you will not see it but you will still be drawing a textbox).
8. Let go of the mouse when you are done drawing your textbox rectangle and the program will crash at this point.
Results:
1. "An internal error occurred." dialog box is displayed.
2. After clicking ok the following "Microsoft Visual C++ Runtime Library" dialog box is displayed:
"Runtime Error!
Program: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat.exe
R6025
- pure virtual function call
3. After clicking ok another dialog box is displayed:
Error signature
AppName: acrobat.exe AppVer: 9.2.0.124 ModName: acrobat.dll Offset: 000509dd
4. The same error has occurred on all five computers that we tested the new version on.
Expected results: A new textbox is created and you may start typing in text (This was the behavior in version 9.1.3).
Additional Information
At times, we need to add information to PDF files (i.e missing dates, etc). We have always used the Text Box Tool to do this with no border, and with no fill color as this is the EASIEST and FASTEST way to add information to PDF files in a precise manner. We want the fill color to be transparent so that we can fit text in between and exactly on lines easier, and so that there is not a solid background box behind the text. We want no border because a border around text that needs to go on a line looks stupid. Up until version 9.2 this procedure worked fine. Now, the program will crash. Perhaps this even adds another security vulnerability if the crash could be exploited. We want to maintain security by patching Adobe to address the JavaScript vulnerability that was addressed in version 9.2.0, however, we are not able to update our users as the new version breaks the fundamental purpose that we use Adobe Acrobat for. We are stuck with the vulnerable version 9.1.3 until this problem is addressed. Disabling JavaScript is not an option either, as we use a Java plug-in on a daily basis.
Any thoughts would be great, I have attached screenshots of the errors.

The question still is not answered.
The problem continues in Acrobat 8.1.7 for Windows, even after updating toAcrobat 8.2.0. ( I can't comment on whether recent updates to Acrobat 9 fix the problem in Acrobat 9.)
The internal error after text insertion problem occurs even with PDF documents created in Acrobat 8, i.e., not only old versions of PDF files. We have the text box insertion icon in the toolbar, and the properties set to "no color" for the box and "0" width for the text box lines, as other commentators have noted.
The problem did not exist when Acrobat 8 Pro was installed, it was introduced by one of the updaters.
The main reason we use Acrobat, rather than much cheaper PDF-creation software, is to annotate PDF files (including inputting data into spaces in standard forms).
So justify the high price of Acrobat and fix the problem please, Adobe !

Security Flaw: Since upgrading to iOS 8.3, I can by-pass passcode security by simply hitting RETURN on my bluetooth keyboard

I noticed when I typed my passcode incorrectly on my Logitech Fabric Skin Keyboard Folio, the iPad allowed me to log in. I checked again, but this time by just hitting RETURN key without entering any passcode, and again it allowed me to log in.
If I disconnect the keyboard, and use the soft keyboard on the iPad itself, it only allows the correct passcode.
Has anybody else seen this security flaw?
iPad Air
iOS 8.3

Please describe the problem in as much relevant detail as possible. The "etrecheck" fad hasn't made that step any less necessary. The better your description, the better the chance of a solution.
For example, if the computer is slow, which specific actions are slow? Is it slow all the time, or only sometimes? What other changes did you make, if any, just before it became slow? Have you seen any alerts or error messages? Have you done anything to try to fix it? Most importantly, do you have a current backup of all data? If the answer to the last question is "no," back up now. Ask if you need guidance. Do nothing else until you have a backup.

Where do I get my Security Number

Where do I get my Security Number to update my account and to download my updates and to change my address

What security number?
The one from your credit card?

Where should I report phishing?

I have received such an email. Is this phishing? where should I report it?
Dear Customer,
Due to concerns, for the safety and integrity of the Apple account we have issued this warning message. It has come to our attention that your account information needs to be updated.If you could please take 5-10 minutes out of your online experience and renew your records you will not run into any future problems with the online service.
Verify Now >
Wondering why you got this email?
If you need help logging in, go to our Help Center by clicking the Help link located in the upper right-hand corner of any Apple page.
For more information, see our frequently asked questions.
Sincerely,
Apple Support.

That's the address they give:
https://www.apple.com/legal/more-resources/phishing/
so if it's not working possibly it's a temporary glitch.

Where do I report a security flaw?

Similar Messages

Maybe you are looking for