App Layering 2.x/3.x: Best Practices

A consolidation of the various layering best practices to apply in the OS and App layers. For App Layering 4.x Best Practices, please refer here:https://support.citrix.com/article/CTX225952 Operating System Layer Have one Operating System layer per Operating System Windows 7 32-bit, Windows 7...

Infogram: User Enumeration

Vulnerability:- -User enumeration is possible through forgot password feature. steps to reproduce:- -Go to the above selected domain and go to forgot password. -You can submit a mail address and check whether it is existing in your database or not. Remediation:- -It should display like "if that...

EMC NetWorker Buffer Overflow Vulnerability

EMC NetWorker Server contains a buffer overflow vulnerability that could potentially be exploited by malicious users to compromise the affected system. Versions prior to 8.2.4.9, 9.0.x all supported versions, prior to 9.1.1.3, and prior to 9.2.0.4 are affected. EMC NetWorker Buffer Overflow...

October 16, 2017 – Morning Cyber Coffee Headlines – “National Boss Day” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 16, 2017 - Headlines Carbon Black in the News: Ransomware market...

Inflection: No password confirmation on changing primary email address

Users may change the primary email address associated with their account without being required to confirm their password again. The security researcher reporting this proposed that we add a password confirmation field when performing an email change. After considering the issue, we don't intend ...

Achieve Continuous Security and Compliance with the CIS Critical Security Controls

For InfoSec pros, it’s easy to get overwhelmed by the constant noise from cybersecurity industry players — vendors, research firms, consultants, industry groups, government regulators and media outlets. A good antidote for this hyperactive chatter is to refocus on foundational InfoSec practices...

Best Practices for Deployment of CITRIX SD-WAN

To configure the management access of SDWAN in a secure manner. https://docs.netscaler.com/en-us/citrix-sd-wan Citrix SD-WAN editions are typically deployed in an enterprise private network. We recommend that you deploy the Citrix SD-WAN solution wherein the management IPs are accessible only fro...

NetScaler 10.1, 10.5, 11.0, 11.1 and 12.0 Builds Temporarily Offline

Citrix SD-WAN, formerly NetScaler SD-WAN UPDATE: New builds are now available. Please seehttps://support.citrix.com/article/CTX227928 for more information. Original article text: Due to an issue found in the builds, NetScaler 10.1, 10.5, 11.0, 11.1 and 12.0 builds are not available for download...

Tor Project Brings Security Slider Feature to Android App Orfox

Tor Project developers recently bolstered Orfox, a Tor Browser for Android devices, to help privacy-conscious mobile browsers better customize their security. Tor Project developers partnered with the Guardian Project to release the first iteration of the app last December. It’s essentially an...

Legal Robot: No notification of change email feature

A security researcher suggested that we add a notification when a user changes their email - thanks @gujjuboy10x00! Thanks @danrubins for quick response and adding new feature. as discussed with @danrubins , they just wanted to add some security features and security best practices , so i suggest...

FCC Promotes Best Practices for SS7 Communications

The Federal Communications Commission FCC has released a public notice encouraging communications service providers to voluntarily use security best practices recommended by the Communications Security, Reliability, and Interoperability Council CSRIC, a federal advisory committee to the FCC. Thes...

Call for Papers: Qualys Security Conference 2017

Our annual user conference, QSC17, is quickly approaching and we are looking for customer presentations that showcase hot topics related to security and best practices via case studies leveraging the use of Qualys technologies. If you would like to be considered as a presenter, please send a...

Exploit for CVE-2017-8464

CVE-2017-8464-exp-generator this tool can generate a exp for c...

Considerations When Creating a Platform Layer in Citrix App Layering 4-x or higher

The objective of this article is to inform Citrix customers and partners about the best practices when creating a Platform Layer in Citrix App Layering 4.x. The Platform Layer is used to install drivers and software specific to a particular platform like PVS or MCS. The Platform Layer enables App...

AWS CIS Benchmark Tool: Prowler

Tool based on AWS-CLI commands for AWS account hardening, following guidelines of the CIS Amazon Web Services Foundations Benchmark 1.1 . It covers hardening and security best practices for all regions related to: Identity and Access Management 24 checks Logging 8 checks Monitoring 15 checks...

Microsoft Outlook Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially crafted email messages. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or...

SEI Issues Advice on Ransomware

The Software Engineering Institute SEI of Carnegie Mellon University has released a blog post on best practices for preventing and responding to ransomware. This common malware captures, encrypts, and holds your data to extort a ransom. SEI’s top recommendation to thwart ransomware attacks is to...

Best Practices for Configuring JIRA Security

h5. Issue Summary Can a documentation containing a collection of best practices for securing a JIRA instance be created similar to this one|https://confluence.atlassian.com/doc/best-practices-for-configuring-confluence-security-216433533.html/?ga=2.68524696.801198909.1495105182-524443449.14914597...

Alerton Webtalk 2.5 / 3.3 Hash Disclosure / CSRF / Command Injection Vulnerabilities

Exploit for multiple platform in category web applications Security Issues in Alerton Webtalk ================================== Introduction ------------ Vulnerabilities were identified in the Alerton Webtalk Software supplied by Alerton. This software is used for the management of building...

DDoS of Past, Present and Future

The pervasiveness of technology has meant automation of tasks, allowing better productivity, with more time to do more. However, the dark side of technology would be that enterprises and individuals alike are vulnerable to cybercrimes, compromise of identities, loss of data and subject to malicio...