Ghost Blog 0.11.3 Cross Site Scripting

===== Tempest Security Intelligence - ADV-9/2017 ======================== Persistent Cross-Site Scripting XSS in Ghost ------------------------------------------------------- Author: - Patrick Costa Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents...

Ghost Blog 0.11.3 Cross Site Scripting Vulnerability

Tempest Security Intelligence Advisory ADV-9/2017 - Ghost Blog version 0.11.3 suffers from a persistent cross site scripting vulnerability. Persistent Cross-Site Scripting XSS in Ghost ------------------------------------------------------- Author: - Patrick Costa Tempest Security Intelligence -...

Oracle E-Business Suite Remote Security Vulnerability (CNVD-2017-00653)

Oracle E-Business Suite E-Business Suite is a fully integrated set of Oracle's global business management software. Oracle Customer Intelligence is one of the Web-based customer information viewer, customer data analyzer and customer performance monitor components. A remote vulnerability exists i...

Oracle E-Business Multiple Vulnerabilities (January 2017 CPU)

The version of Oracle E-Business installed on the remote host is missing the January 2017 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple unspecified vulnerabilities in multiple components and subcomponents, the most severe of which can allow an unauthenticated, remote...

Tinfoleak v2.0 - Get detailed information about a Twitter user activity

Are you interested in OSINT tools? Tinfoleak is the best OSINT tool for Twitter, and is open-source! The new version includes a lot of new and improved features: Search by coordinates Geolocated users Tagged users User conversations Identification in other social networks More powerful and flexib...

Andrew Macpherson on Intelligence Gathering with Maltego

Ryan Naraine talks with Operations Manager at Paterva Andrew Macpherson who outlines the details of the “Digital Intelligence Gathering using Maltego” course being offered at the SAS 2017 and talks about the benefits for data mining by pen testers, malware analysts and law enforcement agencies...

White House Approves New Rules for Sharing of Raw Intelligence Data

President Obama last week approved a change in the way the National Security Agency shares raw signals intelligence data with the rest of the U.S. intelligence community, a shift that privacy experts worry will erode the civil liberties of Americans. An unclassified document released by the Offic...

APT28: At the Center of the Storm

On Jan. 6, 2017, the U.S. Director of National Intelligence released its Intelligence Community Assessment: Assessing Russian Activities and Intentions in Recent US Elections. Still, questions persist about Russian involvement. Did the Russian government direct the group responsible for the...

U.S. Intelligence Report Due Next Week on Election Hack

The various branches of the U.S. intelligence community said they will next week deliver a joint report that corroborates claims that Russian intelligence attempted to influence the 2016 presidential election. Outgoing Director of National Intelligence James R. Clapper also confirmed to a U.S...

Telegram Desktop 0.10.1 DLL Hijacking Vulnerability

Tempest Security Intelligence Advisory ADV-6/2016 - Telegram Desktop version 0.10.1 is vulnerable to dll hijacking as it tries to load "COMBASE.dll" without supplying the absolute path, thus relying upon the presence of such dll on the system directory. Unsafe DLL search path in Telegram Desktop...

Audacity 2.1.2 DLL Hijacking Vulnerability

Tempest Security Intelligence Advisory ADV-7/2016 - Audacity version 2.1.2 is vulnerable to dll hijacking as it tries to load avformat-55.dll without supplying the absolute path, thus relying upon the presence of such dll on the system directory. This behavior results in an exploitable dll...

Atlassian Confluence < 5.10.6 - Persistent Cross-Site Scripting

===== Tempest Security Intelligence - ADV-3/2016 CVE-2016-6283 ============== Persisted Cross-Site Scripting XSS in Confluence Jira Software ---------------------------------------------------------------- Authors: - Jodson Santos - [email protected] Tempest Security Intelligence -...

Obama Expels 35 Russian Spies Over Election Hacking; Russia Responds With Duck Meme

The United States has expelled 35 Russian spies in response to Russia's alleged interference in last month's presidential election, further escalating tensions between the countries. The US state department has declared 35 diplomatic intelligence officials from the Russian embassy in Washington D...

GRIZZLY STEPPE - Russian Malicious Cyber Activity

The Department of Homeland Security DHS has released a Joint Analysis Report JAR that details Russian malicious cyber activity, designated as GRIZZLY STEPPE. This activity by Russian civilian and military intelligence services RIS is part of an ongoing campaign of cyber-enabled operations directe...

SAP BusinessObjects BI Platform Remote Command Execution Vulnerability

SAP BusinessObjects BI Platform is the German SAP SAP company's set of business intelligence BI solution platform. A remote command execution vulnerability exists in SAP BusinessObjects BI Platform, which can be exploited by an attacker to execute arbitrary commands with elevated privileges, and ...

President Obama Orders 'Full Review' of Possible Russian hacking in US Election

In his final month in office, President Barack Obama has ordered U.S. intelligence agencies to conduct a "full review" of pre-election cyber attacks against Democratic Party organizations that many believe affected the outcome of the 2016 presidential election. The United States intelligence...

Microsoft Shares Telemetry Data Collected from Windows 10 Users with 3rd-Party

Cyber security is a major challenge in today's world, as cyber attacks have become more automated and difficult to detect, where traditional cyber security practices and systems are no longer sufficient to protect businesses, governments, and other organizations. In past few years, Artificial...

Gang Up on the Problem, Not Each Other

Threatpost Op-Ed is a regular feature where experts contribute essays and commentary on what’s happening in security and privacy. Today’s contributor is Katherine Carpenter. The imaginary world in which an artificial intelligence can kill a person by adjusting the insulin from his pump to a deadl...

IBM Opens Attack Simulation Test Center

CAMBRIDGE, Ma. – IBM cut the ribbon on its new global security headquarters Wednesday that will also serve as command center for its just announced X-Force Incident Response and Intelligence Services. The centerpiece of the new 153,000-sqft facility is the company’s Cyber Range which IBM bills as...

Malicious Host Intelligence: hostintel

Malicious Host Intelligence This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. Th...