CVE-2014-2297

CVE-2014-2297 concerns multiple Cross-Site Scripting (XSS) vulnerabilities in the WordPress plugin VideoWhisper Live Streaming Integration (version 4.29.6 mentioned in the CVE description). Attackers can inject arbitrary script/HTML by manipulating the n parameter to ls/htmlchat.php or the bgcolo...

Integrate Security Checks with RIPS CLI

Getting started Installation The installation of rips-cli is described in detail in our documentation. You can download the PHAR build of our CLI tool into your bin directory and make it executable with the following commands: 1 2 sudo wget...

[SECURITY] Fedora 26 Update: php-7.1.15-1.fc26

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Lutron Quantum BACnet Integration Sensitive Information Disclosure Vulnerability

Lutron Quantum BACnet Integration is a lighting control system from Lutron Electronics, USA. A security vulnerability exists in Lutron Quantum BACnet Integration version 2.0 using firmware version 3.2.243. A remote attacker can exploit the vulnerability by sending a /DbXmlInfo.xml request to obta...

Value of Integrations Highlighted At Fortinet’s Accelerate 18 Conference

Changing the hearts and minds of security teams is no easy task. Everyone has been told for so long how to protect their environment, and more importantly how to buy the various tools needed to enable that protection. Collectively we’ve adopted the unintentional job of assuming all these things...

[SECURITY] Fedora 26 Update: torbrowser-launcher-0.2.9-1.fc26

Tor Browser Launcher is intended to make Tor Browser easier to install and use for GNU/Linux users. You install torbrowser-launcher from your distribution's package manager and it handles everything else: Downloads and installs the most recent version of Tor Browser in your lan guage and for your...

CVE-2018-7276

The CVE-2018-7276 issue affects Lutron Quantum BACnet Integration 2.0 devices (firmware 3.2.243). The vulnerability is an information disclosure: a remote attacker can obtain potentially sensitive data via a /DbXmlInfo.xml request, demonstrated by access to Latitude/Longitude coordinates. Sources...

Integrate Security Testing into PhpStorm

New State-of-the-Art Reduces Costs Typically, application security testing is performed after the source code was already committed to the source code repository. For example, a security scan is manually performed before deployment, or continuous integration is used that automatically tests the...

Integrate Your Ticketing System into Database Security to Prevent DBA Privilege Abuse

Many of the recent high-profile data security breaches were made by trusted insiders. They are often database administrators DBAs who are highly privileged and trusted insiders with access to sensitive data. In this blog post, I will discuss the inherent risk introduced by highly privileged...

Moderate: Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.4 security update

An update is now available for Red Hat JBoss Data Virtualization. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

[SECURITY] Fedora 27 Update: tomcat-native-1.2.16-1.fc27

Tomcat can use the Apache Portable Runtime to provide superior scalability, performance, and better integration with native server technologies. The Apache Portable Runtime is a highly portable library that is at the heart of Apache HTTP Server 2.x. APR has many uses, including access to advanced...

[SECURITY] Fedora 26 Update: tomcat-native-1.2.16-1.fc26

Tomcat can use the Apache Portable Runtime to provide superior scalability, performance, and better integration with native server technologies. The Apache Portable Runtime is a highly portable library that is at the heart of Apache HTTP Server 2.x. APR has many uses, including access to advanced...

Reverse Split Tunnel Use Case in XenMobile Server and NetScaler Integration

This article describes Reverse Split Tunnel use case in XenMobile Server and NetScaler, and its configuration steps...

Snapchat: Publicly accessible Continuous Integration Tool

@apfeifer27 found an internal Continuous-Integration instance, which disclosed internal source code and credentials for some of our instances...

IDAsec - IDA plugin for reverse-engineering and dynamic interactions with the Binsec platform

IDA plugin for reverse-engineering and dynamic interactions with the Binsec platform Features Decoding an instruction in DBA IR Loading execution traces generated by Pinsec Triggering analyzes on Binsec and retrieving results Dependencies protobuf ZMQ capstone for trace disassembly graphviz to dr...

CloudBees Jenkins Maven Plugin Man-in-the-Middle Attack Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , the tool is mainly used to monitor the order of repetitive work . Maven Plugin is one of the Maven framework plug-in . A security vulnerability...

CloudBees Jenkins Information Disclosure Vulnerability (CNVD-2018-03332)

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . A...

[SECURITY] Fedora 27 Update: clamav-0.99.3-1.fc27

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

CVE-2018-6360

mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdlhook.lua. For example, an av://lavfi:ladspa=file= UR...

electron-prebuilt-compile (1.8.1) potentially affected by CVE-2018-1000006 via electron (1.8.1)

electron NPM version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - electron-prebuilt-compile 1.8.1 Source cves: CVE-2018-1000006 Source advisory: OSV:GHSA-W222-53C6-C86P...