Microsoft to remove WoSign and StartCom certificates in Windows 10

Microsoft has concluded that the Chinese Certificate Authorities CAs WoSign and StartCom have failed to maintain the standards required by our Trusted Root Program. Observed unacceptable security practices include back-dating SHA-1 certificates, mis-issuances of certificates, accidental certifica...

Liferay Portal CE Cross-Site Scripting Vulnerability

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses EJB as well as JMS and other technologies , and can be used as a Web publishing and sharing workspaces , enterprise collaboration platforms , social networks and so on. A cross-site scripting vulnerability exists ...

The MSRC 2017 list of “Top 100” security researchers

Security researchers play an essential role in Microsoft’s security strategy and are key to community-based defense. To show our appreciation for their hard work and partnership, each year at BlackHat North America, the Microsoft Security Response Center highlights contributions of these...

[SECURITY] Fedora 24 Update: rt-4.2.13-2.fc24

RT is an enterprise-grade ticketing system which enables a group of people to intelligently and efficiently manage tasks, issues, and requests submitt ed by a community of users...

[SECURITY] Fedora 26 Update: rt-4.4.1-9.fc26

RT is an enterprise-grade ticketing system which enables a group of people to intelligently and efficiently manage tasks, issues, and requests submitt ed by a community of users...

Further Advances the State of Cyber Threat Information Sharing into Cyber Threat Management and Response

Healthcare organizations HCOs are not immune to large-scale cyberattacks, as evident by the most recent attacks WannaCry and Petya. In fact, HCOs are an attractive target for hackers because of the immense amount of personally identifiable information housed in their systems. The industry is wide...

Faraday v2.6 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time , letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...

CVE-2017-11438

GitLab Community Edition CE and Enterprise Edition EE before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...

CVE-2017-11438

GitLab Community Edition CE and Enterprise Edition EE before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...

CVE-2017-11438

GitLab Community Edition CE and Enterprise Edition EE before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...

CVE-2017-11438

Removed by vendor...

Nmap 7.60 - Free Security Scanner For Network Exploration & Security Audits

Nmap "Network Mapper" is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets...

Will The Real Security Community Please Stand Up

Threatpost Op-Ed is a regular feature where experts contribute essays and commentary on what’s happening in security and privacy. Black Hat 2017 was a vocabulary lesson for white-hats, and yes, words matter. Words such as nihilism, empathy and inclusion have to matter, because what you’re doing n...

Moderate: Red Hat Security Advisory: libreoffice security and bug fix update

An update for libreoffice is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

dddcommunity.org XSS vulnerability

Vulnerable URL: http://dddcommunity.org/library/frameworks-architecture/!prettyPhoto/0,%3Ca%20onclick=%22alert%27OPENBUGBOUNTY%27;%22%3E/ Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 30.10.2017 Vulnerability type:| XSS Vulnerability status:|...

openSUSE Security Update : mysql-community-server (openSUSE-2017-866)

This update for mysql-community-server to version 5.6.37 fixes security issues and bugs. The following vulnerabilities were fixed : - CVE-2017-3633: Memcached unspecified vulnerability boo1049394 - CVE-2017-3634: DML unspecified vulnerability boo1049396 - CVE-2017-3635: C API unspecified...

Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science

Many attackers continue to leverage PowerShell as a part of their malware ecosystem, mostly delivered and executed by malicious binaries and documents. Of malware that uses PowerShell, the most prevalent use is the garden-variety stager: an executable or document macro that launches PowerShell to...

Rapid7 acquires Komand for security orchestration and automation

Today, Rapid7 announced the acquisition of Komand, an orchestration and automation solution for both security and IT teams. You can read the formal announcement here, but I wanted to share a little bit about why Im so excited about this acquisition. Komand has been bold. Theyve been unafraid to...

LogicalDoc Community Edition XXE Vulnerability

LogicalDoc CommunityEdition is a document management system developed using Java technology . The system has Lucene full-text search index and automatic import and other functions . An XML injection vulnerability exists in LogicalDoc CommunityEdition 7.5.3 and earlier versions. No details of the...

Buffer overflow

The Simple Network Management Protocol SNMP subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to...