UBUNTU-CVE-2017-17855

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars...

Romanian Police Arrest 5 People for Spreading CTB Locker and Cerber Ransomware

Romanian police have arrested five individuals suspected of infecting tens of thousands of computers across Europe and the United States in recent years by spreading two infamous ransomware families—Cerber and CTB Locker. Under Operation Bakovia—a major global police operation conducted by Europo...

wildPwn - Brute forcer and shell deployer for WildFly (JBoss AS)

WildFly, formerly known as JBoss AS, or simply JBoss, is an application server authored by JBoss, now developed by Red Hat. WildFly is written in Java, and implements the Java Platform, Enterprise Edition Java EE specification. It runs on multiple platforms. WildFly is free and open-source...

12 Threats of Christmas

We've all heard the old classic, "The 12 Days of Christmas." While we all enjoy a good song about a partridge in a pear tree, Trend Micro has updated this seasonal standby, counting down the top threats to be aware of heading into 2018, from least to most pressing. Let's look at the vulnerabiliti...

PT-2017-3361

Name of the Vulnerable Software and Affected Versions Western Digital MyCloud PR4100 version 2.30.172 Description An issue in the web administration component allows for multipart upload functionality to be accessible without authentication. This is specifically related to the...

PT-2017-12499

Name of the Vulnerable Software and Affected Versions Cisco NX-OS System Software affected versions not specified Description A vulnerability in the patch installation process of Cisco NX-OS System Software could allow an authenticated, local attacker to write a file to arbitrary locations. This ...

Moderate: Red Hat Security Advisory: openstack-aodh security update

An update for openstack-aodh is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2017-11876

Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delet...

Excerpts from The Ransomware Economy: Projections

Carbon Black recently published an investigative report on the Dark Web marketplace for ransomware. This is the final excerpt from that report, which you can find here. For more information about the rise of ransomware, and what you can do about it, check out the Ransomware Epidemic: Stop Bad...

as-1.co.jp XSS vulnerability

Vulnerable URL: http://www.as-1.co.jp/rental/detail.php?id=13'" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 78254 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|---...

as-seen-on-tv-compare.com XSS vulnerability

Open Bug Bounty ID: OBB-382583 Description| Value ---|--- Affected Website:| as-seen-on-tv-compare.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventi...

ALPINE-CVE-2017-16227

The aspathput function in bgpd/bgpaspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service session drop via BGP UPDATE messages, because ASPATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message...

UBUNTU-CVE-2017-16227

The aspathput function in bgpd/bgpaspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service session drop via BGP UPDATE messages, because ASPATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message...

PT-2017-3116

Name of the Vulnerable Software and Affected Versions Junos Space Network Management Platform versions 16.1 prior to 16.1R3 Junos Space Network Management Platform version 17.1R1 without Patch v1 Description The issue is related to an authentication bypass vulnerability in the Junos Space Network...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

Microbus App for Android suffers from an override access vulnerability

Microbus is a mobile application that integrates the functions of bus inquiry, mobile payment for tickets, bus parking site navigation, and real-time bus operation information view. The Android version of the Microbus app has an overstepping access vulnerability that allows an attacker to log in ...

as-outlet.es XSS vulnerability

Open Bug Bounty ID: OBB-311225 Description| Value ---|--- Affected Website:| as-outlet.es Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-14581

CVE-2017-14581 involves SAP NetWeaver AS JAVA, affected in the Host Control web service for versions 7.0–7.5. The issue allows remote attackers to cause a denial of service (service crash) via a crafted request (as noted in SAP Security Note 2389181). The available references confirm the DoS impa...

CVE-2017-14581: Undefined Security Weakness

The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service service crash via a crafted request, aka SAP Security Note 2389181...

PT-2017-13558

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA versions 7.0 through 7.5 Description The issue allows remote attackers to cause a denial of service, resulting in a service crash, via a crafted request to the Host Control web service. Recommendations For SAP NetWeaver A...