Patched Facebook Vulnerability Could Have Exposed Private Information About You and Your Friends

In a previous blog we highlighted a vulnerability in Chrome that allowed bad actors to steal Facebook users’ personal information; and, while digging around for bugs, thought it prudent to see if there were any more loopholes that bad actors might be able to exploit. What popped up was a bug that...

Cross-Site Scripting in morris.js

Affected versions of morris.js are vulnerable to cross-site scripting attacks in labels that appear when hovering over a particular point on a generated graph. The text content of these labels is not escaped, so if control over the labels is obtained, script can be injected. The script will run o...

GHSA-FWX5-5FQJ-JV98 Cross-Site Scripting in morris.js

Affected versions of morris.js are vulnerable to cross-site scripting attacks in labels that appear when hovering over a particular point on a generated graph. The text content of these labels is not escaped, so if control over the labels is obtained, script can be injected. The script will run o...

Making it real—harnessing data gravity to build the next gen SOC

This post was coauthored by Diana Kelley, Cybersecurity Field CTO, andSin John,EMEA Chief Security Advisor, Cybersecurity Solutions Group. In our first blog, Diana and I talked about the concept of data gravity and how it could, conceptually, help organizations take a more cloud-ready approach to...

Get deeper into security at Microsoft Ignite 2018

This year at Microsoft Ignite, we will be making some exciting announcementsfrom new capabilities for identity management and information protection to powerful artificial intelligence AI innovations that can help you stay ahead of an often overwhelming surge in threats and security alerts. Join ...

Active Directory Privilege Relationships: BloodHound

BloodHound is a single page Javascript web application, built on top of Linkurious , compiled with Electron , with a Neo4j database fed by a PowerShell ingestor . BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attacks c...

Subdomain Enumeration Tool: Amass

Amass is the subdomain enumeration tool with the greatest number of disparate data sources that performs analysis of the resolved names in order to deliver the largest number of quality results. Amass performs scraping of data sources, recursive brute forcing, crawling of web archives, permuting...

@jamie452/open-graph-scraper (2.3.2), bind-rest (>=1.4.0, <=1.4.6) +2 more potentially affected by CVE-2017-16098 via charset (1.0.0)

charset NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on charset and may be impacted: - @jamie452/open-graph-scraper 2.3.2 - bind-rest =1.4.0, =2.2.2, =2.5.4 - request-url-open-graph 1.1.2 Source cves: CVE-2017-16098 Source advisory:...

Protecting the modern workplace from a wide range of undesirable software

Security is a fundamental component of the trusted and productive Windows experience that we deliver to customers through modern platforms like Windows 10 and Windows 10 in S mode. As we build intelligent security technologies that protect the modern workplace, we aim to always ensure that...

metascrape npm module cross-site scripting vulnerability

The metascrape npm module is a library for grabbing metadata from articles on the web. A cross-site scripting vulnerability in the metascrape npm module version 3.9.2 and earlier, which stems from the program's failure to filter HTML, can be exploited by a remote attacker to execute and inject...

CVE-2018-3773

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

Cross site scripting

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

CVE-2018-3773

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

CVE-2018-3773

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

CVE-2018-3773

CVE-2018-3773 describes a stored XSS in Open Graph metadata read by the metascrape/metascraper npm tooling. Technical details across connected records show that the vulnerability affects metascrape versions up to 3.9.2 and metascraper versions up to 5.2.x (with Node advisories citing 5.3.0 as the...

CVE-2018-3773

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the "metascrape" npm module = 3.9.2...

PT-2018-16191 · Npm · Metascrape

Name of the Vulnerable Software and Affected Versions: metascraper versions prior to 5.2.0 metascrape npm module versions = 3.9.2 Description: The issue is related to a stored Cross-Site Scripting vulnerability in Open Graph meta properties. It affects the metascrape npm module and metascraper...

CVE-2018-3773: Improper Neutralization of Input During Web Page Generation

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

Jumpstart your Microsoft Graph Security API integration with the new JavaScript sample app

The Microsoft Graph Security API, which launched this spring, is a unified REST API for integrating data and intelligence from Microsoft products, services, and partners. Using Microsoft Graph, developers can easily build applications that consolidate and correlate security alerts from multiple...

Hawkeye Keylogger – Reborn v8: An in-depth campaign analysis

Much of cybercrime today is fueled by underground markets where malware and cybercriminal services are available for purchase. These markets in the deep web commoditize malware operations. Even novice cybercriminals can buy malware toolkits and other services they might need for malware campaigns...