Microsoft Outlook Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially crafted email messages. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or...

SEI Issues Advice on Ransomware

The Software Engineering Institute SEI of Carnegie Mellon University has released a blog post on best practices for preventing and responding to ransomware. This common malware captures, encrypts, and holds your data to extort a ransom. SEI’s top recommendation to thwart ransomware attacks is to...

Best Practices for Configuring JIRA Security

h5. Issue Summary Can a documentation containing a collection of best practices for securing a JIRA instance be created similar to this one|https://confluence.atlassian.com/doc/best-practices-for-configuring-confluence-security-216433533.html/?ga=2.68524696.801198909.1495105182-524443449.14914597...

Alerton Webtalk 2.5 / 3.3 Hash Disclosure / CSRF / Command Injection Vulnerabilities

Exploit for multiple platform in category web applications Security Issues in Alerton Webtalk ================================== Introduction ------------ Vulnerabilities were identified in the Alerton Webtalk Software supplied by Alerton. This software is used for the management of building...

DDoS of Past, Present and Future

The pervasiveness of technology has meant automation of tasks, allowing better productivity, with more time to do more. However, the dark side of technology would be that enterprises and individuals alike are vulnerable to cybercrimes, compromise of identities, loss of data and subject to malicio...

Symantec Endpoint Protection Clients Local Elevation of Privilege, CSV Formula Injection

SUMMARY Symantec has released updates to address security issues reported in both Symantec Endpoint Protection 12.1 and Symantec Endpoint Protection 14.0 Windows clients. AFFECTED PRODUCTS Symantec Endpoint Protection SEP --- CVE | Affected Versions | Remediation CVE-2016-9093 CVE-2016-9094 | Pri...

mongoaudit - A Powerful MongoDB Auditing and Pentesting Tool

mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. Installing with pip This is the recommended installation method in case you have python and pip . pip install mongoaudit Alternative installer Use this if and only...

MongoDB Security Audit: mongoaudit

MongoDB Security Audit mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. It is widely known that there are quite a few holes in MongoDB’s default configuration settings. This fact, combined with abundant lazy syst...

Server Message Block (SMB) Protocol Version 1 Enabled

The remote Windows host supports Server Message Block Protocol version 1 SMBv1. Microsoft recommends that users discontinue the use of SMBv1 due to the lack of security features that were included in later SMB versions. Additionally, the Shadow Brokers group reportedly has an exploit that affects...

Q&A: Web Application Security Scanning with Netsparker

Q&A with Huseyin Tufekcilerli, the lead developer of Netsparker Desktop web application security scanner More than 70% of all cyber breaches involve web applications, and almost 90% organizations believe their application security programs need to be improved. Web application security has risen t...

Information about LenovoEMC devices may be disclosed if the device has an Internet-accessible management interface

Lenovo Security Advisory: LEN-3846 Potential Impact: Disclosure of information about device Severity:Low Summary: An unauthenticated user may be able to view device information about the LenovoEMC device if the management interface accessible over the internet. Even with this vunerability, no dat...

OpenSSH Vulnerability

Palo Alto Networks makes use of a the OpenSSH tool. CVE-2016-6210 was recently confirmed to be applicable to the version in use by PAN-OS. Ref 100977/CVE-2016-6210. To exploit this vulnerability, an attacker would have to guess usernames defined as system administrators on the firewall. This issu...

Symantec Messaging Gateway Security Update

SUMMARY Symantec has addressed a directory traversal issue in Symantec Messaging Gateway caused by insufficient sanitization of user-supplied input. This issue could allow unauthorized access to files or directories. AFFECTED PRODUCTS Symantec Messaging Gateway SMG --- CVE | Affected Versions |...

Recommended Settings and Best Practices for Generic Implementation of a NetScaler Appliance

Recommended Settings for a Generic Implementation of a NetScaler Appliance The following sections contain the recommended settings for a generic implementation of some features of a NetScaler appliance: Modes Features Global System Settings HTTP Parameters SNMP Alarms Network Interfaces General...

DHS Announces Intent to Publish IoT Security Framework

CAMBRIDGE, Ma.—The Department of Homeland Security today formally announced its plan to develop a set of strategic principles for the Internet of Things, saying such a framework is necessary to protect the nation’s critical infrastructure from cyber threats. In a brief talk at the Internet of...

HTTPS best practices: pshtt

HTTPS best practices “pshtt” is the sound you make when you feel mildly astonished. pshtt “pushed” is a tool to scan domains for HTTPS best practices. It saves its results to a CSV or JSON. pshtt was developed to push organizations— especially large ones like the US Federal Government — to adopt...

Cisco Videoscape Session Resource Manager Denial of Service Vulnerability

A vulnerability in system resource management in the Cisco Videoscape Session Resource Manager VSRM could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition because the device unexpectedly restarts. The vulnerability occurs because the VSRM is not installed usi...

[SECURITY] Fedora 23 Update: php-zendframework-zendxml-1.0.2-2.fc23

An utility component for XML usage and best practices in PHP...

Target Device has Poor Performance and/or High Retries When Booting to a vDisk in Private Mode

When installing software in private mode it takes a very long time. Booting devices in Standard Mode works as expected Any maintenance version is very slow Best practices are put in place with Large send offloaddisabled on the target and PVS server anddisabled spanning tree on the switch vDisk is...

Linux Foundation Badge Program Boost Open Source Security

The Linux Foundation says a new Core Infrastructure Initiative CII Best Practices Badge program launched Tuesday will help companies interested in adopting open source technologies evaluate projects based on security, quality and stability. The CII Best Practices Badge does not issue certificates...