CVE-2017-1168

IBM Rational Engineering Lifecycle Manager 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2017-1168

CVE-2017-1168 affects IBM Rational Engineering Lifecycle Manager (RELM) 4.0.3–4.0.7, 5.0–5.0.2, and 6.0–6.0.3. A cross-site scripting vulnerability in the Web UI allows embedding arbitrary JavaScript, potentially leading to credentials disclosure in a trusted session. The IBM advisory provides fi...

CVE-2017-1168: Improper Neutralization of Input During Web Page Generation

IBM Rational Engineering Lifecycle Manager 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Huawei Y6 Pro AEE extension module information leak leaks

Huawei Y6 Pro is a smartphone from Chinese company Huawei Huawei. An information disclosure vulnerability exists in Huawei Y6 Pro phones using the AEE extension module of the MTK platform. Due to improper authorization of specific processes, an attacker may trick users into installing a malicious...

Engineering Firm Leaks Data on Dell, SBC and Oracle

A Texas-based firm called Power Quality Engineering publicly exposed sensitive electrical infrastructure data on the public internet. Firms impacted by the leak were Dell Technologies, SBC, Freescale, Oracle, Texas Instruments and the City of Austin. Chris Vickery, cyber risk analyst at security...

The Windows Malware Analysis Distribution: flare-vm

FLARE VM is a freely available and open sourced Windows-based security distribution designed for reverse engineers, malware analysts, incident responders, forensicators, and penetration testers. Inspired by open-source Linux-based security distributions like Kali Linux, REMnux and others, FLARE V...

Links in phishing-like emails lead to tech support scam

Note: Our Tech support scams FAQ page has the latest info on this type of threat, including scammer tactics, fake error messages, and the latest scammer hotlines. You can also read our latest blog, New tech support scam launches communication or phone call app. Tech support scams continue to...

Hacking Slot Machines by Reverse-Engineering the Random Number Generators

Interesting story: The venture is built on Alex's talent for reverse engineering the algorithms -- known as pseudorandom number generators, or PRNGs -- that govern how slot machine games behave. Armed with this knowledge, he can predict when certain games are likeliest to spit out money­insight...

CVE-2017-7928

An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories SEL SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The device does not properly enforce access control while configured for NAT port forwarding, which may...

CVE-2017-7928

An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories SEL SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The device does not properly enforce access control while configured for NAT port forwarding, which may...

CVE-2017-7928

An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories SEL SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The device does not properly enforce access control while configured for NAT port forwarding, which may...

Legal Robot: Code injection

A security researcher discovered that they were able to inject potentially malicious code into Legal Robot's newly created Roadmap page through improper input sanitization when submitting a new Idea for consideration by the community. A limited-scope attack was possible since the input sanitizati...

WakaTime: Impersonation of Wakatime user using Invitation functionality.

Hi wakatime team, I have found a vulnerability in your leaderboard invitation functionality which can be used to trick the victims on the name of wakatime. Anyone can sign up with any email id and use the leadersboard invitation to invite anyone. This loophole can be leveraged for impersonation o...

Vulnerability Spotlight: Kakadu SDK Vulnerabilities

Vulnerabilities discovered by Aleksandar Nikolic and Tyler Bohan of Cisco Talos.Today, Talos is disclosing multiple vulnerabilities that have been identified in the Kakadu JPEG 2000 SDK. The vulnerabilities manifest in a way that could be exploited if a user opens a specifically crafted JPEG 2000...

IC3 Releases Alert on Gift Card Scams

The Internet Crime Complaint Center IC3 has released an alert warning consumers of music gift card scams. This type of scam targets victims, gains their confidence, and tricks them into providing gift card information. To stay safer online, review the IC3 alert on Online Scammers Require Payment...

Schneider Electric Trio TView

CVSS v3 10.0 ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available. Vendor: Schneider Electric Equipment: Trio TView Vulnerabilities: Multiple Vulnerabilities for Java Runtime Environment AFFECTED PRODUCTS The following versions of Schneider Electric Trio TView...

APT Group Uses Catfish Technique To Ensnare Victims

LAS VEGAS–Meet Mia Ash, a 20-something London-based photographer, amateur model, social media butterfly with a keen interest in tech-savvy guys with ties to the oil and gas industry. You guessed it. Mia Ash doesn’t exist. Ash, according to Dell SecureWorks Counter Threat Unit, is a virtual person...

SteelCon: Mahkra ni Orroz

I recently gave a talk at Sheffield's SteelCon, a huge security event spread over a few days with no end of interesting activities taking place. My presentation, called Makhra ni Orroz, is a good 45 minutes of non stop talking and pictures and things. It's also a bit different in terms of what I...

FLARE VM: The Windows Malware Analysis Distribution You’ve Always Needed!

As a reverse engineer on the FLARE Team I rely on a customized Virtual Machine VM to perform malware analysis. The Virtual Machine is a Windows installation with numerous tweaks and tools to aid my analysis. Unfortunately trying to maintain a custom VM like this is very laborious: tools frequentl...

Legal Robot: Token leakage by referrer header & analytics

A security researcher discovered that sensitive information, like password reset tokens could still be leaked to analytics services like Google Analytics or via the Referer sic header. Even though tokens were immediately invalidated, we decided to re-engineer the process to eliminate any...