CVE-2019-17331

The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and includi...

CVE-2019-17331

The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and includi...

Cross site scripting

The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and includi...

CVE-2019-17331 TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities

The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and includi...

CVE-2019-17331

The CVE-2019-17331 issue affects TIBCO EBX Add-ons Data Exchange Web Interface. Affected versions are EBX Add-ons

TIBCO Security Advisory: November 12, 2019 - TIBCO EBX Add-on -2019-17331

TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities Original release date: November 12,2019 Last revised: CVE-2019-17331 Source: TIBCO Software Inc. TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities Original release date: November 12, 2019 Last revised: -...

The vulnerability of the Data Exchange Layer Platform, a messaging application between applications, and the Threat Intelligence Exchange Server, related to the lack of protection for operational data, allows access to confidential information.

The vulnerability of the Data Exchange Layer Platform, a messaging application between applications, and the Threat Intelligence Exchange Server, a threat protection system, is related to the lack of protection for operational data. Exploiting this vulnerability can allow attackers to gain access...

Cisco Unified Intelligence Center Remote File Injection Vulnerability

Cisco Unified Intelligence Center is the United States Cisco Cisco company's set of Web-based reporting platform. The platform provides reports related to business data and call center data presentation capabilities. A remote file injection vulnerability exists in Cisco Unified Intelligence Cente...

McAfee DXL Platform and McAfee TIE Server Information Disclosure Vulnerability

McAfee DXL Platform and McAfee TIE Server are both products of McAfee, Inc. McAfee DXL Platform is a data exchange layer platform. McAfee TIE Server is a network threat defense server. An information disclosure vulnerability exists in McAfee DXL Platform version 5.0.1 HF2 prior to version 5.x,...

The vulnerability of the Microsoft Team Foundation Server software, related to errors in the authentication process, allows a violator to execute arbitrary commands.

The vulnerability of the Microsoft Team Foundation Server TFS exists due to the lack of basic authentication when exchanging data between the software platform and the search service. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Design/Logic Flaw

An issue was discovered in the Daimler Mercedes-Benz Me app 2.11.0-846 for iOS. The encrypted Connected Vehicle API data exchange between the app and a server might be intercepted. The app can be used to operate the Remote Parking Pilot, unlock the vehicle, or obtain sensitive information such as...

CVE-2018-18071

The CVE concerns Daimler Mercedes-Benz Me app for iOS (version 2.11.0-846). The issue is the encrypted Connected Vehicle API data exchange between the app and its server, which could be intercepted. This could allow misuse of the Remote Parking Pilot, vehicle unlocks, or access to sensitive data ...

Adwind Dodges AV via DDE

This blog post is authored by Paul Rascagneres, Vitor Ventura and with the contribution of Tomislav Pericin and Robert Perica from ReversingLabs. Introduction Cisco Talos, along with fellow cybersecurity firm ReversingLabs, recently discovered a new spam campaign that is spreading the Adwind 3.0...

Think You’ve Got Your Credit Freezes Covered? Think Again.

I spent a few days last week speaking at and attending a conference on responding to identity theft. The forum was held in Florida, one of the major epicenters for identity fraud complaints in United States. One gripe I heard from several presenters was that identity thieves increasingly are...

Effectively Detecting Low Throughput and Malicious DNS Exfiltration

In a previous blog post, we described how the DNS protocol, mainly designed for hostname to IP addresses resolution, can be abused for arbitrary data exchange. Based on throughput i.e., bytes per hour, we distinguish between two classes of data exchange over the DNS protocol. The first of the two...

WebRTC - Private IP Leakage Exploit

Exploit for multiple platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Private IP Leakage to WebPage using WebRTC Function.", 'Description' = %q This module...

MOSQUITO Attack Allows Air-Gapped Computers to Covertly Exchange Data

The team of security researchers—who last month demonstrated how attackers could steal data from air-gapped computers protected inside a Faraday cage—are back with its new research showing how two or more air-gapped PCs placed in the same room can covertly exchange data via ultrasonic waves...

Covert Data Channel in TLS Dodges Network Perimeter Protection

Researchers have released a proof-of-concept framework for a new covert channel for data exchange using the Transport Layer Security TLS protocol. The method exploits the public key certificate standard X.509 and could allow for post-intrusion C2 communication and data exfiltration to go unnotice...

Microsoft Office Vulnerabilities Used to Distribute Zyklon Malware in Recent Campaign

Introduction FireEye researchers recently observed threat actors leveraging relatively new vulnerabilities in Microsoft Office to spread Zyklon HTTP malware. Zyklon has been observed in the wild since early 2016 and provides myriad sophisticated capabilities. Zyklon is a publicly available,...

Microsoft Patch Tuesday - December 2017

Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 34 new vulnerabilities with 21 of them rated critical and 13 of them rated important. These vulnerabilities...