4493 matches found
CVE-2019-1003078
A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
CVE-2019-1003079
A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
CVE-2019-1003078
A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
Cross site request forgery (csrf)
A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
CVE-2019-1003079
CVE-2019-1003079 affects the Jenkins VMware Lab Manager Slaves Plugin. The root cause is a missing permission check in LabManager.DescriptorImpl#doTestConnection form validation, enabling attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Fields affec...
CVE-2019-1003078
A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
CVE-2019-1003078
The CVE-2019-1003078 entry involves Jenkins VMware Lab Manager Slaves Plugin. Affected component: LabManager.DescriptorImpl#doTestConnection form validation method. Root cause: cross-site request forgery (CSRF) vulnerability that allows an attacker to initiate a connection to a server specified b...
CVE-2019-1003078
A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
PT-2019-11369 · Vmware +1 · Jenkins Vmware Lab Manager Slaves Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins VMware Lab Manager Slaves Plugin affected versions not specified Description: A missing permission check in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate...
PT-2019-11368 · Jenkins · Jenkins Vmware Lab Manager Slaves Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins VMware Lab Manager Slaves Plugin affected versions not specified Description: A cross-site request forgery issue exists in the LabManager.DescriptorImpldoTestConnection form validation method, allowing attackers to initiate a connecti...
Bots and botnets in 2018
Due to the wide media coverage of incidents involving Mirai and other specialized botnets, their activities have become largely associated with DDoS attacks. Yet this is merely the tip of the iceberg, and botnets are used widely not only to carry out DDoS attacks, but to steal various user...
ShadowHammer: ASUS software updates exploited to distribute malware
By Waqas The victims of ShadowHammer malware attack are Windows users. Kaspersky Lab researchers have made a startling new revelation that the world’s leading computer maker ASUS’s live software update system was compromised by cybercriminals to install a backdoor, which affected ASUS customers...
Threat Groups SandCat, FruityArmor Exploiting Microsoft Win32k Flaw
A newly-patched Microsoft Win32k vulnerability is being exploited in the wild by at least two threat actors, including a recently discovered advanced persistent threat APT group dubbed SandCat. The exploited vulnerability CVE-2019-0797, rated important, was patched on Tuesday as part of Microsoft...
The fourth horseman: CVE-2019-0797 vulnerability
In February 2019, our Automatic Exploit Prevention AEP systems detected an attempt to exploit a vulnerability in the Microsoft Windows operating system. Further analysis of this event led to us discovering a zero-day vulnerability in win32k.sys. We reported it to Microsoft on February 22, 2019. T...
Patch Tuesday, March 2019 Edition
Microsoft on Tuesday pushed out software updates to fix more than five dozen security vulnerabilities in its Windows operating systems, Internet Explorer, Edge, Office and Sharepoint. If you abuse Microsoft products, it's time once again to start thinking about getting your patches on. Malware or...
Memory Corruption Vulnerability in Photo Lab Processing of psd Images
Photo Lab is a foreign photo viewing tool. A memory corruption vulnerability exists in Photo Lab's handling of psd images. An attacker can cause the program to crash by constructing a malformed psd image, which if successfully exploited can lead to arbitrary code execution...
Memory Corruption Vulnerability in Photo Lab Processing of phl Images
Photo Lab is a foreign photo viewing tool. A memory corruption vulnerability exists in Photo Lab's handling of phl images. An attacker can cause the program to crash by constructing a malformed phl image, which if successfully exploited can lead to arbitrary code execution...
Intel Modular Server System 10.18 CSRF Change Admin Password Exploit
Summary The Intel Modular Server System is a blade system manufactured by Intel using their own motherboards and processors. The Intel Modular Server System consists of an Intel Modular Server Chassis, up to six diskless Compute Blades, an integrated storage area network SAN, and three to five...
Microsoft Patches Two Win32k Bugs Under Active Attack
Microsoft released patches for two Win32k bugs actively under attack, along with fixes for four additional bugs that are publicly known, as part of its March Patch Tuesday security bulletin. The Win32k bugs are both elevation of privilege vulnerabilities, rated important, and tied to the way...
Spam and phishing in 2018
Numbers of the year The share of spam in mail traffic was 52.48%, which is 4.15 p.p. less than in 2017. The biggest source of spam this year was China 11.69%. 74.15% of spam emails were less than 2 KB in size. Malicious spam was detected most commonly with the Win32.CVE-2017-11882 verdict. The...