ATENTION‼ New - CVE-2016-5819
📖 Read
via "National Vulnerability Database".
Moxa G3100V2 Series, editions prior to Version 2.8, and OnCell G3111/G3151/G3211/G3251 Series, editions prior to Version 1.7 allows a reflected cross-site scripting attack which may allow an attacker to execute arbitrary script code in the user?s browser within the trust relationship between their browser and the server.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2016-5800
📖 Read
via "National Vulnerability Database".
A malicious attacker can trigger a remote buffer overflow in the Communication Server in Fatek Automation PM Designer V3 Version 2.1.2.2, and Automation FV Designer Version 1.2.8.0.📖 Read
via "National Vulnerability Database".
🕴 Microsoft Brings Defender Security Tools to Mac 🕴
📖 Read
via "Dark Reading: ".
Windows Defender becomes Microsoft Defender, and it's available in limited preview for Mac users.📖 Read
via "Dark Reading: ".
Dark Reading
Cybersecurity Analytics recent news | Dark Reading
Explore the latest news and expert commentary on Cybersecurity Analytics, brought to you by the editors of Dark Reading
🕴 Police Federation of England and Wales Suffers Apparent Ransomware Attack 🕴
📖 Read
via "Dark Reading: ".
National Cyber Security Centre and National Crime Agency investigate random attack that locked down the association's data and deleted backups.📖 Read
via "Dark Reading: ".
Dark Reading
Cyberattacks & Data Breaches recent news | Dark Reading
Explore the latest news and expert commentary on Cyberattacks & Data Breaches, brought to you by the editors of Dark Reading
🔏 What CISOs Should Be Aware Of (But Typically Aren't) 🔏
📖 Read
via "Subscriber Blog RSS Feed ".
The life of a CISO is a busy one and it can be easy for priorities to get lost in the shuffle. We've polled a group of CISOs and other security professionals to find out what CISOs should be aware of but likely aren't.📖 Read
via "Subscriber Blog RSS Feed ".
Digital Guardian
What CISOs Should Be Aware Of (But Typically Aren't)
The life of a CISO is a busy one and it can be easy for priorities to get lost in the shuffle. We've polled a group of CISOs and other security professionals to find out what CISOs should be aware of but likely aren't.
❌ Hackers Take Down Safari, VMware and Oracle at Pwn2Own ❌
📖 Read
via "Threatpost".
On the first day of Pwn2Own 2019 hackers poked holes in Apple Safari, VMware Workstation and Oracle VirtualBox.📖 Read
via "Threatpost".
Threat Post
Hackers Take Down Safari, VMware and Oracle at Pwn2Own
On the first day of Pwn2Own 2019 hackers poked holes in Apple Safari, VMware Workstation and Oracle VirtualBox.
ATENTION‼ New - CVE-2018-14745
📖 Read
via "National Vulnerability Database".
Buffer overflow in prot_get_ring_space in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allows an attacker (who has obtained code execution on the Wi-Fi chip) to overwrite kernel memory due to improper validation of the ring buffer read pointer. The Samsung ID is SVE-2018-12029.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-14724
📖 Read
via "National Vulnerability Database".
In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the ban reason, which is executed on the bans.php page.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-14575
📖 Read
via "National Vulnerability Database".
Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-14486
📖 Read
via "National Vulnerability Database".
DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-13104
📖 Read
via "National Vulnerability Database".
OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-13103
📖 Read
via "National Vulnerability Database".
OX App Suite 7.8.4 and earlier allows SSRF.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-12638
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device name. A malicious device name can execute JavaScript on the registered Bose User Account if a speaker has been connected to the app.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-12572
📖 Read
via "National Vulnerability Database".
Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping AvastUI.exe application memory and parsing the data.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-12023
📖 Read
via "National Vulnerability Database".
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-12022
📖 Read
via "National Vulnerability Database".
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-11789
📖 Read
via "National Vulnerability Database".
When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be modifying the parameter path= to go to the directory you would like to view. i.e. ..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-11767
📖 Read
via "National Vulnerability Database".
In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-11747
📖 Read
via "National Vulnerability Database".
Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-16255
📖 Read
via "National Vulnerability Database".
An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request at At 0x9d014e84 the value for the cmd1 key is copied using strcpy to the buffer at $sp+0x280. This buffer is 16 bytes large.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-16254
📖 Read
via "National Vulnerability Database".
An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request at 0x9d014e4c the value for the flg key is copied using strcpy to the buffer at $sp+0x270. This buffer is 16 bytes large, sending anything longer will cause a buffer overflow.📖 Read
via "National Vulnerability Database".