Senate Gives Nod To Controversial Cross-Border Data Access Bill

The United States Senate on Thursday approved a controversial cross-border data access act, dubbed the CLOUD Act, that was part of the overall omnibus government spending bill. Buried on page 2,201 of the government spending bill is the Clarifying Lawful Overseas Use of Data Act the CLOUD Act, a...

Election Security

I joined a letter supporting the Secure Elections Act S. 2261: The Secure Elections Act strikes a careful balance between state and federal action to secure American voting systems. The measure authorizes appropriation of grants to the states to take important and time-sensitive actions, includin...

January 19, 2018 – Morning Cyber Coffee Headlines – “Puppies” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 19, 2018 - Headlines The Five Laws Of Cybersecurity - Forbes 3 things y...

Mozilla Joins U.S. Attorneys General In Bid to Restore Net Neutrality

Mozilla has joined a coalition of U.S. state attorneys general in battling the Federal Communications Commission’s controversial recent ruling that overturned net neutrality laws. “The internet is a global, public resource,” Mozilla wrote in a blog post. “It relies on the core principle of net...

Fedora Update for osc-source_validator FEDORA-2018-ac8aab1f7a

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Alleged creator of Fruitfly indicted for 13 years of spying

Way back at the start of last year, we took a look at something called Fruitfly, a Mac backdoor using old code that had been around for a long time and could deep breath upload files to computers, record images and video, snoop around in victims' information, take screenshots, and also log...

Cells Blog Cross-Site Scripting Vulnerability

Cells Blog is a free but powerful mini blogging system. A cross-site scripting vulnerability exists in Cells Blog 3.5. An attacker can exploit this vulnerability by using the jfdname parameter in the act=showpic request to conduct a cross-site scripting attack...

Cross site request forgery (csrf)

Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request...

CVE-2017-17948

Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request...

November 20, 2017 – Morning Cyber Coffee Headlines – “Thanksgiving Week” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! November 20, 2017 - Headlines Carbon Black in the News: Why business is booming...

CVE-2017-11876

Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delet...

advocatekhoj.com XSS vulnerability

Open Bug Bounty ID: OBB-408072 Description| Value ---|--- Affected Website:| advocatekhoj.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

The vulnerability of the pmmasterd software from One Identity Privilege Manager allows a hacker to gain full access to the server’s policies.

The vulnerability of the pmmasterd software for integrating ActiveDirectory with Linux and Unix systems is due to an operation that goes beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full access to the server’s policies by usin...

act-us.info XSS vulnerability

Vulnerable URL: https://www.act-us.info/sensorlist.php?cat='"=Chemical Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3921504 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|---...

Threat Outbreak Alert RuleID30961: Email Messages Distributing Malicious Software on October 13, 2017

Medium Alert ID: 55618 First Published: 2017 October 13 16:04 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30961 may contain the following files: Name |...

SQL Injection Vulnerability in list.act.php in mall_order directory of DuoDuoRebate.com System_V8.3

DuoDuo rebate system is for e-commerce rebate, shopping guide to provide solutions, is the open source PHP rebate site system. DuoDuo rebate systemV8.3 mallorder directory list.act.php SQL injection vulnerability. The vulnerability is due to the system status parameter does not filter the data...

DuoDuoRebate.com System_V8.3 list.act.php suffers from SQL Injection Vulnerability

DuoDuo rebate system is for e-commerce rebate, shopping guide to provide solutions, is the open source PHP rebate site system. DuoDuoRebate.com SystemV8.3 list.act.php SQL injection vulnerability. The vulnerability due to the system code parameters do not filter the data submitted by the user , a...

New Bill Seeks Basic IoT Security Standards

Lawmakers in the U.S. Senate today introduced a bill that would set baseline security standards for the government's purchase and use of a broad range of Internet-connected devices, including computers, routers and security cameras. The legislation, which also seeks to remedy some widely-perceive...

Breach at Third Party Contractor Affects 18,000 Anthem Members

A month after it agreed to settle 2015’s massive data breach, Anthem Inc., the United States’ largest healthcare company, has a new problem on its hands. The Indianapolis-based company began notifying 18,000 members affected by another unrelated data breach last week. Anthem reported the breach o...

UK Teenager, Aged 18, Charged With Running DDoS-For-Hire Service

A teenage student has been charged with running a supplying malware that was used for launching distributed denial of service DDoS attacks against websites of some of the world's leading businesses. Jack Chappell, an 18-year-old teenager from Stockport, is accused of helping cyber criminals with...