CVE-2019-0391

The CVE-2019-0391 issue affects SAP NetWeaver AS Java and enables information disclosure. Multiple sources confirm affected SAP NetWeaver AS Java versions: 7.10, 7.20, 7.30, 7.31, 7.40, and 7.50. Root cause and impact are described as an information-disclosure vulnerability that could allow attac...

CVE-2019-0391: Undefined Security Weakness

Under certain conditions SAP NetWeaver AS Java corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 allows an attacker to access information which would otherwise be restricted...

PT-2019-15710

Name of the Vulnerable Software and Affected Versions WSO2 IS as Key Manager version 5.7.0 Description The issue allows for stored XSS in the download-userinfo.jag component due to mishandling of the Content-Type. Recommendations For WSO2 IS as Key Manager version 5.7.0, update the software to a...

PT-2019-4404

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java versions prior to 7.10 SAP NetWeaver AS Java versions prior to 7.20 SAP NetWeaver AS Java versions prior to 7.30 SAP NetWeaver AS Java versions prior to 7.31 SAP NetWeaver AS Java versions prior to 7.40 SAP NetWeaver AS...

CVE-2019-18882: Improper Neutralization of Input During Web Page Generation

WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled...

CVE-2019-18881: Improper Neutralization of Input During Web Page Generation

WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile...

SAP NetWeaver AS Java CVE-2019-0391 Information Disclosure Vulnerability

Description SAP NetWeaver AS Java is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. SAP NetWeaver AS Java versions 7.10, 7.20, 7.30, 7.31, 7.4 and 7.5 are vulnerable. Technologies Affect...

PT-2019-15709

Name of the Vulnerable Software and Affected Versions WSO2 IS as Key Manager version 5.7.0 Description The issue allows unauthenticated reflected XSS in the dashboard user profile. Recommendations For version 5.7.0, update to a newer version that contains a fix for this issue...

Raccoon Malware Scavenges 100,000+ Devices to Steal Data

A new information stealer, dubbed Raccoon, is rapidly gaining popularity with cybercriminals. In just a few months, researchers say the malware has already infected hundreds of thousands of devices across the world to rove through victims’ credit card data, email credentials and more. The malware...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - Crescendo

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Crescendo By Jessica Saavedra-Morales · October 20, 2019 Episode 4: Crescendo This is the final installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi and its connections to GandGrab, the most prolific...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - Crescendo

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Crescendo By Jessica Saavedra-Morales · October 20, 2019 Episode 4: Crescendo This is the final installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi and its connections to GandGrab, the most prolific...

10 Steps for Ransomware Protection

Just the thought of ransomware is enough to keep CISOs and security teams up at night. Victims are caught in an awful choice between paying a ransom to a criminal who may or may not release their captured network and data, or potentially spending millions of dollars to remove the ransomware on...

PT-2019-16849

Name of the Vulnerable Software and Affected Versions IBM Workload Scheduler Distributed versions 9.2 through 9.5 Description The issue allows a local user to write files as root in the file system, potentially enabling the attacker to gain root privileges. Recommendations For versions 9.2 throug...

Sudo Flaw Lets Linux Users Run Commands As Root Even When They're Restricted

Attention Linux Users! A new vulnerability has been discovered in Sudo —one of the most important, powerful, and commonly used utilities that comes as a core command installed on almost every UNIX and Linux-based operating system. The vulnerability in question is a sudo security policy bypass iss...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money

ARCHIVED STORY McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money By John Fokker · October 14, 2019 Episode 3: Follow the Money This is the third installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi and its connections to GandCrab, the mos...

PT-2019-5815

Name of the Vulnerable Software and Affected Versions D-Link DIR-846 version 100A35 Description The issue is related to insufficient argument checking in the SetWizardConfig function of the D-Link DIR-846 firmware, allowing remote attackers to execute arbitrary OS commands as root. This can be...

CVE-2017-15691

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion XXE capability of various XML parsers. UIMA as part of its...

vBulletin 5.0 < 5.5.4 - 'updateAvatar' Authenticated Remote Code Execution

?php / --------------------------------------------------------------------- vBulletin = 5.5.4 updateAvatar Remote Code Execution Vulnerability --------------------------------------------------------------------- author..............: Egidio Romano aka EgiX mail................:...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - What The Code Tells Us

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us By McAfee Labs · October 2, 2019 Episode 1: What the Code Tells Us McAfee’s Advanced Threat Research team ATR observed a new ransomware family in the wild, dubbed Sodinokibi or REvil, at the end of April 201...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - The All-Stars | McAfee Blogs

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – The All-Stars John Fokker · OCT 02, 2019 Episode 2: The All-Stars Analyzing Affiliate Structures in Ransomware-as-a-Service Campaigns This is the second installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi...