ATENTION‼ New - CVE-2018-12638
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device name. A malicious device name can execute JavaScript on the registered Bose User Account if a speaker has been connected to the app.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-12572
📖 Read
via "National Vulnerability Database".
Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping AvastUI.exe application memory and parsing the data.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-12023
📖 Read
via "National Vulnerability Database".
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-12022
📖 Read
via "National Vulnerability Database".
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-11789
📖 Read
via "National Vulnerability Database".
When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be modifying the parameter path= to go to the directory you would like to view. i.e. ..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-11767
📖 Read
via "National Vulnerability Database".
In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-11747
📖 Read
via "National Vulnerability Database".
Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-16255
📖 Read
via "National Vulnerability Database".
An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request at At 0x9d014e84 the value for the cmd1 key is copied using strcpy to the buffer at $sp+0x280. This buffer is 16 bytes large.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-16254
📖 Read
via "National Vulnerability Database".
An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request at 0x9d014e4c the value for the flg key is copied using strcpy to the buffer at $sp+0x270. This buffer is 16 bytes large, sending anything longer will cause a buffer overflow.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-16253
📖 Read
via "National Vulnerability Database".
An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012 for the cc channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request At 0x9d014dd8 the value for the id key is copied using strcpy to the buffer at $sp+0x290. This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.📖 Read
via "National Vulnerability Database".
🕴 Hacker AI vs. Enterprise AI: A New Threat 🕴
📖 Read
via "Dark Reading: ".
Artificial intelligence and machine learning are being weaponized using the same logic and functionality that legitimate organizations use.📖 Read
via "Dark Reading: ".
Darkreading
Hacker AI vs. Enterprise AI: A New Threat
Artificial intelligence and machine learning are being weaponized using the same logic and functionality that legitimate organizations use.
🕴 SaaS Ecosystem Complexity Ratcheting Up Risk of Insider Threats 🕴
📖 Read
via "Dark Reading: ".
Even with common security platforms like CASBs, organizations struggle to deal with the volume of apps and accounts that interact with business-critical data.📖 Read
via "Dark Reading: ".
Dark Reading
SaaS Ecosystem Complexity Ratcheting Up Risk of Insider Threats
Even with common security platforms like CASBs, organizations struggle to deal with the volume of apps and accounts that interact with business-critical data.
⚠ Change your Facebook password now! ⚠
📖 Read
via "Naked Security".
Facebook has done an audit and shocked even itself by finding plaintext passwords in logfiles back to 2012. Change your password now!📖 Read
via "Naked Security".
Naked Security
Change your Facebook password now!
Facebook has done an audit and shocked even itself by finding plaintext passwords in logfiles back to 2012. Change your password now!
🕴 Facebook Employees for Years Could See Millions of User Passwords in Plain Text 🕴
📖 Read
via "Dark Reading: ".
📖 Read
via "Dark Reading: ".
Dark Reading
Facebook Employees for Years Could See Millions of User Passwords in Plain Text
| Facebook Employees for Years Could See Millions of User Passwords in Plain Text
ATENTION‼ New - CVE-2018-13798
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V14), SICAM A8000 CP-802X (All versions < V14), SICAM A8000 CP-8050 (All versions < V2.00). Specially crafted network packets sent to port 80/TCP or 443/TCP could allow an unauthenticated remote attacker to cause a Denial-of-Service condition of the web server. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 80/TCP or 443/TCP. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the web server. A system reboot is required to recover the web service of the device. At the time of advisory update, exploit code for this security vulnerability is public.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-6462
📖 Read
via "National Vulnerability Database".
Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-6461
📖 Read
via "National Vulnerability Database".
Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.📖 Read
via "National Vulnerability Database".
❌ WordPress Plugin Removed After Zero Day Discovered ❌
📖 Read
via "Threatpost".
The plugin, Social Warfare, is no longer listed after a cross site scripting flaw was found being exploited in the wild.📖 Read
via "Threatpost".
Threat Post
WordPress Plugin Patched After Zero Day Discovered
The plugin, Social Warfare, is no longer listed after a cross site scripting flaw was found being exploited in the wild.
🕴 Businesses Manage 9.7PB of Data but Struggle to Protect It 🕴
📖 Read
via "Dark Reading: ".
What's more, their attempts to secure it may be putting information at risk, a new report finds.📖 Read
via "Dark Reading: ".
Dark Reading
Businesses Manage 9.7PB of Data but Struggle to Protect It
What's more, their attempts to secure it may be putting information at risk, a new report finds.
ATENTION‼ New - CVE-2015-6458
📖 Read
via "National Vulnerability Database".
Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-6457
📖 Read
via "National Vulnerability Database".
Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.📖 Read
via "National Vulnerability Database".