4371 matches found
Server side request forgery (ssrf)
An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7...
CVE-2019-18355
An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7...
DEBIAN-CVE-2019-18277
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request...
CVE-2019-18277
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request...
UBUNTU-CVE-2019-18277
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request...
zulip stored credentials in plain text
zulip stored a credential unencrypted in its global configuration file jenkins.plugins.zulip.ZulipNotifier.xml, as well as in the legacy configuration file hudson.plugins.humbug.HumbugNotifier.xml on the Jenkins controller. This credential could be viewed by users with access to the Jenkins...
Adopting a Risk-Based Approach to Cybersecurity in the Financial Services Industry
Today’s financial organizations face many different risks in volatile and uncertain business environments, but the ever-present threat of cyberattacks and data breaches is now impossible to ignore. For this reason, managing these cyber-risks now has to simply be considered one of the many costs o...
TOPMeeting SQL Injection Vulnerability
TOPMeeting is a video conferencing solution. A SQL injection vulnerability exists in versions prior to TOPMeeting 8.8 2019/08/19. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit the vulnerability to...
Unspecified Vulnerability in Oracle Solaris (CNVD-2019-38536)
Oracle Solaris is a Unix-like operating system. An unspecified vulnerability exists in the SMF services & legacy daemons component of Oracle Solaris 11. An attacker can exploit this vulnerability to unauthorized update, insert, or delete certain Oracle Solaris accessible data and cause a partial...
Oracle Solaris Critical Patch Update : oct2019_SRU11_4_13_4_0
This Solaris system is missing necessary patches to address critical security updates : - Vulnerability in the Oracle Solaris product of Oracle Systems component: SMF services & legacy daemons. The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged...
CVE-2019-2961
Vulnerability in the Oracle Solaris product of Oracle Systems component: SMF services & legacy daemons. The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Orac...
Design/Logic Flaw
Vulnerability in the Oracle Solaris product of Oracle Systems component: SMF services & legacy daemons. The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Orac...
CVE-2019-2961
Vulnerability in the Oracle Solaris product of Oracle Systems component: SMF services & legacy daemons. The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Orac...
Checkrain fake iOS jailbreak leads to click fraud
By Warren Mercer and Paul Rascagneres. Introduction Attackers are capitalizing on the recent discovery of a new vulnerability that exists across legacy iOS hardware. Cisco Talos recently discovered a malicious actor using a fake website that claims to give iPhone users the ability to jailbreak...
What The Actual WAF!?
InfoSec Family, we need to talk!! Every so often, there is a technological shift in the information security industry. Sometimes it is due to new cyberattack discovery, aka a Zero-day. Many times, the catalyst is legacy technology. When a legacy technology no longer adequately responds to the...
F5 Networks BIG-IP : BIG-IP APM client for Windows vulnerability (K10015187)
Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy...
TLS version enforcement capabilities now available per certificate binding on Windows Server 2019
At Microsoft, we often develop new security features to meet the specific needs of our own products and online services. This is a story about how we solved a very important problem and are sharing the solution with customers. As engineers worldwide work to eliminate their own dependencies on TLS...
Why Should CISOs Care About XDR?
We have been collectively saying in our industry for the last 15-20 years that a layered approach to your security stack is a “best practice,” but as with all best practices, these are ideals rather than reality for so many charged with protecting their organizations. The vast majority of CISOs a...
