No More Tears: WannaCry Highlights Importance of Prompt Vulnerability Detection, Remediation

It didn’t have to happen. That’s the simple yet profound lesson from WannaCry’s ransomware rampage that has infected 300,000-plus systems in more than 150 countries, disrupting critical operations across industries, including healthcare, government, transportation and finance. If vulnerable syste...

Senate's Use of Signal A Good First Step, Experts Say

On Tuesday the United States Senate made it official and approved the use of encrypted messaging app Signal by staffers. Encryption advocates applauded the measure, but say more needs to be done to protect “civic” infrastructure critical to democracy. “The move to secure communications...

For GDPR Readiness, You Need Visibility into Your IT Assets

The looming deadline for complying with the EU’s General Data Protection Regulation GDPR is shining the spotlight on a foundational InfoSec best practice: A comprehensive IT asset inventory. The reason: GDPR places strict requirements on the way a business handles the personally identifiable...

Cross-origin Resource Sharing (CORS) Globally Enabled By Default

webpack-dev-middleware enables cross-origin resource sharing CORS by default. This allows malicious websites to access assets of a web application...

OSINT Gathering Tool: Inquisitor

OSINT Gathering Tool Inquisitor is a simple for gathering information on companies and organizations through the use of Open Source Intelligence OSINT sources. The key features of Inquisitor include: 1. The ability to cascade the ownership label of an asset e.g. if a Registrant Name is known to...

The vulnerability of the Mac OS X operating system allows attackers to increase their privileges and alter the loaded mobile activities.

The vulnerability of the Mac OS X operating system’s Assets component is related to deficiencies in access control. Exploiting this vulnerability allows an attacker acting locally to enhance their privileges and modify the loaded mobile activity using uncertain vectors...

Design/Logic Flaw

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Assets" component, which allows local users to bypass intended permission restrictions and change a downloaded mobile asset via unspecified vectors...

CVE-2016-7628

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Assets" component, which allows local users to bypass intended permission restrictions and change a downloaded mobile asset via unspecified vectors...

Legal Robot: Legal Robot AWS S3 Bucket Directory Listing

A security researcher found an AWS S3 bucket serving public resources intentionally. The files in this bucket were static assets like logos and marketing assets. We later removed this bucket altogether and therefore re-opened and marked this report as Resolved...

Apple macOS Sierra Assets Component File Download Vulnerability

Apple macOS Sierra is a specialized operating system developed by Apple for Mac computers.Assets is one of the library components that supports multiple image selection. A security vulnerability exists in the Assets component of Apple macOS Sierra versions prior to 10.12.2. An attacker could...

Mac OS X 10.x < 10.12.2 Multiple Vulnerabilities

Binary data 9840.prm...

macOS 10.12.x < 10.12.2 Multiple Vulnerabilities

The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apachemodphp - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia...

CVE-2016-7884

Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks...

CVE-2016-7884

Adobe Experience Manager (AEM) versions 6.1 and earlier are affected by an input validation issue in the DAM create assets flow that could enable cross-site scripting. The problem is described in the CVE entry as an input validation flaw leading to XSS. The connected documents confirm the affecte...

About the security content of macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite

About the security content of macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite This document describes the security content of macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite. About Apple security...

Cross-site scripting vulnerability in WordPress plugin debts-assets-networth-dan

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin debts-assets-networth-dan, which allows an attacker to construct malicious web pages and trick...

ManageEngine ServiceDesk Plus 9.2 Build 9207 Information Disclosure Vulnerability

Exploit for jsp platform in category web applications Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2 Build 9207 Other versions...

Design/Logic Flaw

The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates...

Apple iOS < 10 Multiple Vulnerabilities (BlueBorne)

Binary data appleios100check.nbin...

Locky Targets Hospitals In Massive Wave Of Ransomware Attacks

A massive Locky ransomware campaign spotted this month targets primarily the healthcare sector and is delivered in phishing campaigns. The payload, researchers at FireEye said, is dropped via .DOCM attachments, which are macro-enabled Office 2007 Word documents. Especially hard hit are hospitals ...