CVE-2019-17085

XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent...

Design/Logic Flaw

XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent...

CVE-2019-17085

The CVE-2019-17085 entry describes an XXE vulnerability in Micro Focus Operations Agent affecting versions 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, and 12.11. The issue is an XXE attack vector within the Operations Agent (vulnerability type: XXE). The connected documents corroborate...

CVE-2019-17085

XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent...

PT-2019-14941

Name of the Vulnerable Software and Affected Versions Micro Focus Operations Agent versions 12.0 through 12.06, 12.10, 12.11 Description The issue concerns an XXE attack vulnerability. This vulnerability could be exploited to perform an XXE attack on the Operations Agent. Recommendations For...

CVE-2019-17085: Improper Restriction of XML External Entity Reference

XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent...

This Week in Security News: APT33 Botnets Used for Extreme Narrow Targeting and Microsoft’s Patch Tuesday Arrives with A Patch for An IE Zero-Day

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the APT33 threat group that is using live C&C servers for extremely narrow targeting. Also, read about Trend Micro’s complete...

News Wrap: Voice Assistant Laser Hack, Twitter Insider Threats, Data Breach Fine Fails

Threatpost editors break down the top news stories for the week ended Nov. 8. The hot stories of the week include: Despite trillions of dollars in data-breach fine payouts, each year the number of compromised companies and individuals with private data exposed rise – a Threatpost feature looks at...

Dell RSA BSAFE Micro Edition Suite and RSA BSAFE Crypto-C Micro Edition Information Disclosure Vulnerabilities

The Dell RSA BSAFE Micro Edition Suite and the RSA BSAFE Crypto-C Micro Edition are both encryption toolkits from Dell USA. An information disclosure vulnerability exists in Dell RSA BSAFE Crypto-C Micro Edition and Dell RSA BSAFE Micro Edition Suite. The vulnerability stems from errors such as...

Dell RSA BSAFE Micro Edition Suite and RSA BSAFE Crypto-C Micro Edition Buffer Overflow Vulnerabilities

The Dell RSA BSAFE Micro Edition Suite and the RSA BSAFE Crypto-C Micro Edition are both encryption toolkits from Dell USA. A buffer overflow vulnerability exists in Dell RSA BSAFE Crypto-C Micro Edition and RSA BSAFE Micro Edition Suite. The vulnerability originates when a networked system or...

Dell RSA BSAFE Micro Edition Suite Information Disclosure Vulnerability

Dell RSA BSAFE Micro Edition Suite is an encryption toolkit from Dell USA. An information disclosure vulnerability exists in Dell RSA BSAFE Micro Edition Suite. The vulnerability stems from an error in configuration or other errors in the operation of a networked system or product. An attacker...

Rogue TrendMicro Employee Sold Customer Data to Tech Support Scammers

Do you always uncomfortable trusting companies with your data? If so, you're not alone. While companies do much to protect themselves from external threats, insiders always pose the highest risk to a company's data. Unfortunately, when we say companies can't eliminate insider threat completely,...

Fuji Electric V-Server

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Fuji Electric Equipment: V-Server Vulnerability: Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the device being accessed; several heap-based buffer overflows...

Rogue Trend Micro Employee Sold Customer Data for 68K Accounts

Trend Micro said that a rogue employee sold the data of 68,000 customers to a malicious third party, who then used that data to target customers with scam calls. The employee, who gained unauthorized access to a customer-support database, has since been terminated. Trend Micro said that the...

Multiple Trend Micro Products Multiple Security Vulnerabilities

Description Multiple Trend Micro Products are prone to the following security vulnerabilities: 1. An information-disclosure vulnerability 2. An arbitrary file-deletion vulnerability An attacker can exploit this issue to obtain sensitive information or delete arbitrary files from the affected...

Tips to Accelerating PCI Data Security Standard Projects with Deep Security as a Service

Does your organization need to meet PCI DSS requirements? Are you struggling with multiple security tools? Or stretching your already overstretched team to prepare for an audit? Time to hit the accelerator with Trend Micro! If your applications deal with credit or payment card data, you need to g...

Micro Focus (HPE) Data Protector - SUID Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Micro Focus HPE Data Protector SUID Privilege Escalation', 'Description' = %q This module exploits the trusted $PATH environment variable of the...

Micro Focus (HPE) Data Protector SUID Privilege Escalation Exploit

This Metasploit module exploits the trusted $PATH environment variable of the SUID binary omniresolve in Micro Focus HPE Data Protector versions A.10.40 and below. The omniresolve executable calls the oracleasm binary using a relative path and the trusted environment $PATH, which allows an attack...

This Week in Security News: Pwn2Own Adds Industrial Control Systems to Hacking Contest and Cyber Crooks Target ESports

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Among news from this week, learn about Pwn2Own’s new hacking contest that will take place in Miami next year. Also, as October was Cybersecurity...

Micro Focus (HPE) Data Protector SUID Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Micro Focus HPE Data Protector SUID Privilege Escalation', 'Description' = %q This module exploits the trusted $PATH environment variable of the...