Cross-site Scripting (XSS)

jenkins is vulnerable to cross-site scripting. The vulnerability exists through the Monitoring plugin...

Veeam Management Pack 8.0 Update 6 cumulative patch for Veeam Backup & Replication monitoring

Challenge Veeam Management Pack 8.0 Update 6 cumulative patch for Veeam Backup & Replication monitoring. Cause Veeam Support has received quite enough customer feedback on issues related to MP for Veeam Backup & Replication provided as part of Veeam Management Pack for System Center. For example,...

CVE-2018-5179

A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all versions prior to Firefox 60...

CVE-2018-5179

Removed by vendor...

Citrix ADC GSLB MEP vs Monitors

What is a GSLB Service? A GSLB service is usually a representation of a load balancing or content switching virtual server, although it can represent any type of virtual server or 3rd party load balancer. The GSLB service identifies the service’s IP address, port number, and service type, and...

Ross Video DashBoard 8.5.1 - Insecure Permissions Vulnerability

Ross Video DashBoard version 8.5.1 suffers from an elevation of privileges vulnerability which can be used by a simple authenticated user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the 'M' flag Modify or 'C' flag Chan...

Casino Goes All In and Wins Big with Imperva Security

There’s no good time to be hit by ransom-seeking DDoS attackers. For one casino-entertainment provider, the timing was particularly bad — right before one of its largest online poker events in 2016. The casino, which generates multiple billions in revenue per year, leveraged Imperva’s emergency...

Monitoring AWS Golden AMI Pipelines with Slack

If your company uses Slack and is looking for ways to easily monitor activities in its AWS Golden AMI Pipeline, you can use AWS native services to send messages into a Slack channel. This can give your teams better visibility into the approval process for the candidate AMIs that they submit, as...

Debian DLA-1757-1 : cacti security update

It was discovered that there were a number of cross-site scripting vulnerabilities XSS in cacti, a web-based front-end for the RRDTool monitoring tool. For Debian 8 'Jessie', this issue has been fixed in cacti version 0.8.8b+dfsg-8+deb8u7. We recommend that you upgrade your cacti packages. NOTE:...

Wipro Confirms Hack and Supply Chain Attacks on Customers

IT systems consulting behemoth Wipro Ltd. has confirmed that its network was hacked and used for mounting attacks on its customers. After multiple unnamed sources independently told Brian Krebs that a “multi-month intrusion” occurred and is likely the work of an advanced persistent threat APT act...

Malspam Campaigns Distribute HawkEye Keylogger, Post Ownership Change

The HawkEye malware kit and information-stealer has been spotted in a newfound slew of campaigns after a recent ownership change. While the keylogger has been in continuous development since 2013, in December a thread on a hacking site noted an ownership change, after which posts on hacking forum...

NagiosXI Privilege Mobilization Vulnerability

Nagios XI is a network monitoring software that provides network, server and application monitoring solutions for organizations. NagiosXI suffers from a boost vulnerability that can be exploited by an attacker to gain root privileges...

CVE-2019-0278

Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration Messaging System, fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure...

CVE-2019-0278

Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration Messaging System, fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure...

Information disclosure

Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration Messaging System, fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure...

CVE-2019-0278

Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration Messaging System, fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure...

CVE-2019-0278

The CVE-2019-0278 entry relates to SAP NetWeaver Process Integration’s Monitoring Servlet, where under certain conditions an attacker can view the names of database tables used by the application, leading to information disclosure. Affected versions include 7.10–7.11, 7.20, 7.30, 7.31, 7.40, and ...

Yahoo Offers $117.5M Settlement in Data Breach Lawsuit

Yahoo is offering to cough up $117.5 million to settle a lawsuit regarding its massive data breaches that compromised the personal information of three billion users. The new $117.5 million settlement, filed Tuesday in the U.S. District Court in San Jose, comes after the internet company’s first...

Mysql-Magic - Dump Mysql Client Password From Memory

The mysql client read the password, then write this for some malloc'ed memory, and free it, but just because a chunk was freed doesn't mean it will be used again, to ensure that your programs not keep sensitive information in memory you must overwrite the memory. The main goal is get the password...

Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application Server

Summary The following security issues have been identified in the WebSphere Application Server included as part of IBM Tivoli Monitoring ITM portal server. Vulnerability Details CVEID: CVE-2018-1904 DESCRIPTION: IBM WebSphere Application Server could allow remote attackers to execute arbitrary Ja...