529 matches found
SUSE CVE-2016-6232
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ dot dot slash in a filename in an archive file, related to KNewsstuff downloads...
Threat Actors Turn to Sliver as Open Source Alternative to Popular C2 Frameworks
The legitimate command-and-control C2 framework known as Sliver is gaining more traction from threat actors as it emerges as an open source alternative to Cobalt Strike and Metasploit. The findings come from Cybereason, which detailed its inner workings in an exhaustive analysis last week. Sliver...
Guide: How MSSPs and vCISOs can extend their services into compliance readiness without increasing cost
Compliance services are emerging as one of the hottest areas of cybersecurity. While compliance used to be mainly the province of large enterprises, times have changed, and it is now a day-to-day concern for a growing number of small and medium businesses. Even when these organizations are not...
Search Made Easy: InsightIDR’s Secret Weapon for Efficiency and Efficacy
By Matt Heidet Matt is a Senior Information Security Engineer at a Regional Financial Institution. He is a Customer and Guest Blogger for Rapid7 Have you ever groaned when divvying up incidents from a pen-test amongst an overworked team? Or maybe you’ve struggled to present how you adhere to...
Path traversal
dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...
Common questions when evolving your VM program
Authored by Natalie Hurd Perhaps your organization is in the beginning stages of planning a digital transformation, and it’s time to start considering how the security team will adapt. Or maybe your digital transformation is well underway, and the security team is struggling to keep up with the...
Security Bulletin: Vulnerability in SSLv3 affects IBM Intelligent Operations Center and related products, and Integrated Information Core (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM HTTP Server and IBM WebSphere Application Server, used by the IBM products listed below. Vulnerability Details CVE ID :CVE-2014-3566...
Collaboration Drives Secure Cloud Innovation: Insights From AWS re:Inforce
This year's AWS re:Inforce conference brought together a wide range of organizations that are shaping the future of the cloud. Last week in Boston, cloud service providers CSPs, security vendors, and other leading organizations gathered to discuss how we can go about building cloud environments...
The vulnerability of the Tools and Frameworks component of the Oracle Commerce Guided Search system allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Tools and Frameworks component of the Oracle Commerce Guided Search system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through HTTP...
The vulnerability of the Tools and Frameworks component of the Oracle Commerce Guided Search search engine and the Oracle Commerce Experience Manager user environment management tool allows a perpetrator to gain access to data for reading purposes.
The vulnerability of the Tools and Frameworks component of the Oracle Commerce Guided Search search engine and the Oracle Commerce Experience Manager user environment management tool exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor t...
The vulnerability of the Tools and Frameworks component of the Oracle Commerce Guided Search search engine and the Oracle Commerce Experience Manager user environment management tool allows a perpetrator to gain access to and modify data.
The vulnerability of the Tools and Frameworks component of the Oracle Commerce Guided Search system, as well as the Oracle Commerce Experience Manager user environment management tool, exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to ga...
vulhub
This repository is an open-source collection of vulnerable web applications and environments for security research and training. It is maintained by phith0n and hosted on GitHub. The repository contains a variety of vulnerable applications, including web servers, databases, and other systems, to...
June 14, 2022-Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.6.2 for Windows Server 2008 SP2 (KB5014809)
June 14, 2022-Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.6.2 for Windows Server 2008 SP2 KB5014809 Applies to:Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 4.6.2 IMPORTANT Verify that you have installed the required updates listed in the How to...
Understanding compliance platform capabilities: black box automation has its limitations
Compliance is hard. It is not a "black box" of opaque inputs and outputs, where systems and data are hidden and where users are oblivious to their inner workings. There has yet to be a product made that can magically produce all the evidence sufficient for testing and verification across the wide...
LDAPFragger - Command And Control Tool That Enables Attackers To Route Cobalt Strike Beacon Data Over LDAP
LDAPFragger is a Command and Control tool that enables attackers to route Cobalt Strike beacon data over LDAP using user attributes. For background information, read the release blog: http://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes Dependencies and...
How to Secure Your SaaS Stack with a SaaS Security Posture Management Solution
Whether it’s Office 365, Salesforce, Slack, GitHub or Zoom, all SaaS apps include a host of security features designed to protect the business and its data. The job of ensuring that all the apps have proper security settings and are configured correctly falls on the security team. The challenge...
vulhub
This is an open-source collection of vulnerable web applications and environments, designed for security training and testing. The repository contains a variety of applications, including web servers, databases, and other services, each with its own set of vulnerabilities. The goal is to provide ...
Authentication flaw
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...
