The vulnerability of the McAfee Advanced Threat Defense software’s database storage mechanism allows a malicious actor to gain unauthorized access to the root password.

The vulnerability of the McAfee Advanced Threat Defense software’s database storage component is related to insufficient protection for registration data. Exploiting this vulnerability could allow an attacker to obtain unauthorized access to the root password...

D Shield suffers from a webshell bypass vulnerability ( CNVD-2020-04310).

D-Shield is a proactive defense software designed specifically for IIS to prevent websites and servers from being compromised with internal and external protection. D-Shield suffers from a webshell bypass vulnerability, which can be exploited by attackers to bypass D-Shield and gain access to the...

U.S. Dept Of Defense: Reflected Xss

hello security team i found reflected XSS in this subdomain https://███ POC:- 1-go in subdomain 2-go here https://███████/en/embeddedAuthRedirect.html?auth=javascript:alert"xElkomy" 3-Done Image:- ███████ xElkomy Impact reflected cross-site scripting XSS operation with JavaScript, which runs in t...

CVE-2019-13750

Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page...

Cisco ASA Firepower Version

The remote host is running the Cisco Adaptive Security Appliance ASA operating system with the Firepower eXtensible Operating System FXOS or Firepower Threat Defense FTD. It is possible to read the ASA FXOS or FTD version number by connecting to the device via SSH. C Tenable Network Security, Inc...

CVE-2019-13750

Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page...

UBUNTU-CVE-2019-13750

Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page...

CVE-2019-13750

Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page...

Input validation

Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page...

CVE-2019-13750

CVE-2019-13750 affects Google Chrome (Chromium) where the SQLite component used by Chrome allowed insufficient data validation, enabling a remote attacker to bypass defense-in-depth via a crafted HTML page. Affected product: Chrome/Chromium with the SQLite library integrated; root cause: data val...

CVE-2019-13750

Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page...

CVE-2019-13750

Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page...

Improve cyber supply chain risk management with Microsoft Azure

For years, Microsoft has tracked threat actors exploiting federal cyber supply chain vulnerabilities. Supply chain attacks target software developers, systems integrators, and technology companies. Tactics often include obtaining source code, build processes, or update mechanisms to compromise...

The vulnerability of the Lua interpreter implemented in Cisco Adaptive Security Appliance (ASA) and Configure Firepower Threat Defense (FTD) hardware network devices allows attackers to escalate their privileges and execute arbitrary code.

The vulnerability of the Lua interpreter implemented in Cisco Adaptive Security Appliance ASA and Configure Firepower Threat Defense FTD hardware-based network devices relates to the execution of operations beyond the buffer memory boundaries. Exploiting this vulnerability allows a malicious acto...

Reliable Controls LicenseManager

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Reliable Controls Equipment: LicenseManager Vulnerability: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to crash the system, view sensitive...

Smart TVs: The Cyberthreat Lurking in Your Living Room, Feds Warn

Black Friday and Cyber Monday sales of smart TVs are likely prodigious this Thanksgiving weekend – but consumers need to be aware of the hole they can punch in home cyber-defenses. That’s the word from the FBI, which warned that smart TVs, which hook up to the internet to allow users to access ap...

Manipulating Machine Learning Systems by Manipulating Training Data

Interesting research: "TrojDRL: Trojan Attacks on Deep Reinforcement Learning Agents": Abstract:: Recent work has identified that classification models implemented as neural networks are vulnerable to data-poisoning and Trojan attacks at training time. In this work, we show that these training-ti...

U.S. Dept Of Defense: Unprotected ██████ and Test site API Exposes Documents, Credentials, and Emails in ██████████ Proposal System

Summary: The test/integration API of the █████ web services is publicly exposed: disclosing documents, emails, and credentials to what appears to be the Seaport Bid proposal system. Because I did not attempt any exploitation outside of that necessary to deem this a reportable issue, it is not cle...

ID Thieves Turn to Snail Mail as Juicy Target for Financial Crimes

As it gets harder for cybercriminals to bypass business email compromise BEC defenses, some hackers are switching from email scams to real-mail cons. Researchers at Flashpoint said they are monitoring hacker forums where criminals are swapping tips on a growing ID theft and financial crime area,...

Cisco Firepower Threat Defense RCE (cisco-sa-20191112-asa-ftd-lua-rce)

A remote code execution vulnerability exists in the Lua interpreter of Cisco Firepower Threat Defense FTD software due to insufficient restrictions on the allowed Lua function calls within the context of user-supplied Lua scripts. An authenticated, remote attacker can exploit this to bypass...