12749 matches found
5 principles driving a customer-obsessed identity strategy at Microsoft
The cloud era has fundamentally changed the way businesses must think about security. For a long time, we built security around the perimeter. But today, the boundaryless landscape demands that we start with the individual. In our journey with customers co-designing our products and services,...
Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection
While Windows Defender Antivirus makes catching 5 billion threats on devices every month look easy, multiple advanced detection and prevention technologies work under the hood to make this happen. Windows Defender Antivirus is the next-generation protection component of Microsoft Defender Advance...
Simplify - Generic Android Deobfuscator
Simplify virtually executes an app to understand its behavior and then tries to optimize the code so that it behaves identically but is easier for a human to understand. Each optimization type is simple and generic, so it doesn't matter what the specific type of obfuscation is used. Before and...
CVE-2018-17388
CVE-2018-17388 affects Twilio WEB To Fax Machine System 1.0. The issue is an SQL Injection vulnerability in login_check.php (email/password parameters) and in add_email.php/edit_content.php (id parameter). The cited CVE indicates attacker-controlled input leads to SQL query manipulation, with pot...
Data, Surveillance, and the AI Arms Race
According to foreign policy experts and the defense establishment, the United States is caught in an artificial intelligence arms race with China -- one with serious implications for national security. The conventional version of this story suggests that the United States is at a disadvantage...
Security News This Week: Telegram Says China Is Behind DDoS
Voting machine security gets a boost, Have I Been Pwned is for sale, and more of the week's top security news...
CVE-2019-0711
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual...
A Top Voting-Machine Firm Calls for Paper Ballots
The long-awaited shift from paperless ballots could make elections more secure...
Windows Hyper-V Denial of Service Vulnerability
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual...
Ubuntu 18.04 - lxd Privilege Escalation
Ubuntu 18.04 - lxd Privilege Escalation !/usr/bin/env bash ---------------------------------- Authors: Marcelo Vazquez S4vitar Victor Lasa vowkin ---------------------------------- Step 1: Download build-alpine = wget https://raw.githubusercontent.com/saghul/lxd-alpine-builder/master/build-alpine...
CVE-2019-6452
Kyocera Command Center RX TASKalfa4501i and TASKalfa5052ci allows remote attackers to abuse the Test button in the machine address book to obtain a cleartext FTP or SMB password...
Directory traversal
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files which now include path-checking code for symlinks, it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could...
VMware WorkStation 12.5.3 - Virtual Machine Escape
VMware Escape Exploit VMware Escape Exploit before VMware WorkStation 12.5.3 Host Target: Win10 x64 Compiler: VS2013 Test on VMware 12.5.2 build-4638234 Known issues Failing to heap manipulation causes host process crash. About 50% successful rate Not quite elaborate because I'm not good at doing...
It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign
This blog was authored by Danny Adamitis, David Maynor and Kendall McKay. Executive summary Cisco Talos recently identified a series of documents that we believe are part of a coordinated series of cyber attacks that we are calling the "Frankenstein" campaign. We assess that the attackers carried...
JDK: Read beyond the end of bytecode array causing JVM crash
In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load...
Windows 10 v2004, 20H2, 21H1, 21H2 & 22H2 – Citrix Known Issues
Microsoft releases software updates for Windows 10 twice a year through the Semi-Annual Channel. Microsoft released its Semi-Annual Channel 'May 2020 update' v2004 in May 2020,'October 2020 update'20H2 in October 2020, 'May 2021 update' 21H1 in May 2021, 'November 2021 update' 21H2 and '2022...
Learning to Rank Strings Output for Speedier Malware Analysis
Reverse engineers, forensic investigators, and incident responders have an arsenal of tools at their disposal to dissect malicious software binaries. When performing malware analysis, they successively apply these tools in order to gradually gather clues about a binary’s function, design detectio...
Q&A with Ashley Fidler, Chief Product Officer at eSentire: Women in Cybersecurity
In a few short weeks, Carbon Black will be hosting our annual user conference, CBConnect19, in sunny San Diego. This year, we’re bringing together a group of powerhouse women from across a variety of industries for our annual Women in Cybersecurity Panel to share their knowledge and experience fr...
EquityPandit 1.0 - Password Disclosure
Exploit title: EquityPandit v1.0 - Insecure Logging Date:27/05/2019 Exploit Author: ManhNho Software name: "EquityPandit" Software link: https://play.google.com/store/apps/details?id=com.yieldnotion.equitypandit Version: 1.0 Category: Android apps Description: - Sometimes developers keeps sensiti...