Hack Breaks PDF Encryption, Opens Content to Attackers

Researchers in Germany have invented a new hack that can allow someone to break the encryption of PDF files and access their content — or even forge signed PDF files under certain circumstances. A team from Ruhr University Bochum, FH Münster University of Applied Sciences and Hackmanit GmbH...

V-SOL GPON/EPON OLT Platform 2.03 - Cross-Site Request Forgery

Exploit Title: V-SOL GPON/EPON OLT Platform 2.03 - Cross-Site Request Forgery Author: LiquidWorm Discovery Date: 2019-09-26 Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd. Product web page: https://www.vsolcn.com Tested on: GoAhead-Webs Advisory ID: ZSL-2019-5536 Advisory URL:...

5G and IoT: How to Approach the Security Implications

When it comes to the next generation of mobile networks, 5G promises a more Internet of Things-friendly ecosystem with vast improvements over the current capabilities of 4G – however, its intersection with IoT will also raise the stakes on cybersecurity. The benefits of 5G are myriad: Not only wi...

CISOs: Support vendor security ops for best cloud results

Data from McKinsey Insights suggests that many CISOs are uneasy about increasing dependence on SaaS applications and the security risks – real or perceived – the cloud represents. Their apprehension isn’t slowing down cloud adoption. As McKinsey put it, “Most companies … will eventually confront...

Windows‌ ‌Exploitation‌ ‌Tricks:‌ ‌Spoofing‌ ‌Named‌ ‌Pipe‌ ‌Client‌ ‌PID‌

Posted by James Forshaw, Project Zero While researching the Access Mode Mismatch in IO Manager bug class I came across an interesting feature in named pipes which allows a server to query the connected clients PID. This feature was introduced in Vista and is exposed to servers through the...

Security Advisory - Improper Validation Vulnerability in Several Smartphones

There is an improper validation vulnerability on several smartphones. The system does not perform a properly validation of certain input models, an attacker could trick the user to install a malicious application then craft a malformed model , successful exploit could allow the attacker to get an...

USN-4134-2: IBus regression

USN-4134-1 fixed a vulnerability in IBus. The security fix introduced a regression when being used with Qt applications. This update reverts the security fix pending further investigation. Original advisory details: Simon McVittie discovered that IBus did not enforce appropriate access controls o...

DetExploit - Software That Detect Vulnerable Applications, Not-Installed OS Updates And Notify To User

DetExploit is software that detect vulnerable applications and not-installed important OS updates on the system, and notify them to user. As we know, most of cyberattacks uses vulnerability that is released out year before. I thought this is huge problem, and this kind of technology should be mor...

Microsoft SharePoint Cross-Site Request Forgery Vulnerability (CNVD-2019-31854)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site request...

WordPress Photo Gallery 1.5.34 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications...

Arbitrary File Deletion Vulnerability in Fish Leap CMS

Fish CMS is a content management system developed by the official Catfish CMS specifically for enterprise applications. There is an arbitrary file deletion vulnerability in FishCenter CMS, which can be exploited by an attacker to delete arbitrary files...

Multiple Code Execution Flaws Found In PHP Programming Language

Maintainers of the PHP programming language recently released the latest versions of PHP to patch multiple high-severity vulnerabilities in its core and bundled libraries, the most severe of which could allow remote attackers to execute arbitrary code and compromise targeted servers. Hypertext...

How to Get a Handle on Patch Management

Patch management is a thankless job. Data shows, despite best efforts, that 80 percent of enterprise applications have at least one unpatched vulnerability in them, according research by Veracode. It is not for lack of trying that vulnerabilities persist. Last year 16,500 vulnerabilities were...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for SAP Applications

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for SAP Applications. Vulnerability Details CVEID: CVE-2017-3289 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded...

Guangdong Yijiang Technology Co., Ltd. small strong bike App there are logic flaws vulnerability

Xiaoqiang Bicycle App is an Internet-based bicycle sharing solution, focusing on short-distance travel. Users can find a bike online anytime and anywhere through the cell phone app, scan the code for the bike offline, and also realize GPS positioning, real-time billing, online payment and other...

Fedora 29 : 6:kdelibs / kde-settings (2019-39d23c7a94)

This update fixes CVE-2019-14744 kconfig arbitrary shell code execution in the compatibility library kdelibs 4 used by legacy applications not yet ported to KDE Frameworks 5. The included kde-settings update removes obsolete settings that conflict with the security fix and are no longer needed se...

CVE-2019-13406

A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication...

The Myth of Consumer-Grade Security

The Department of Justice wants access to encrypted consumer devices but promises not to infiltrate business products or affect critical infrastructure. Yet that's not possible, because there is no longer any difference between those categories of devices. Consumer devices are critical...

Update for Windows 7 SP1 and Windows Server 2008 R2 SP1: August 16, 2019

Update for Windows 7 SP1 and Windows Server 2008 R2 SP1: August 16, 2019 Summary This non-security update for Windows 7 SP1 and Windows Server 2008 R2 SP1 includes the quality improvements from KB4512486 released August 16, 2019, in addition to these key changes: Addresses an issue in which the...

Three Common Email Security Mistakes That MSPs Make

MSPs can generate recurring revenue by being proactive about educating customers about email threats and how to defeat them—if they avoid three common mistakes. Businesses have come to rely on cloud email and file-sharing applications for communication and productivity. But, too often, they assum...