5787 matches found
CVE-2019-11553
In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage users in an organization can impersonate a user with web restore permission. When requesting the token to do a web restore, an administrator with permission to manage a user coul...
CVE-2019-11553
Code42 for Enterprise up to version 6.8.4 is affected by CVE-2019-11553. An administrator who can manage users in an organization, but lacks web restore permission, can impersonate a user who has web restore permission by requesting that user’s token during a web-restore operation. This requires ...
Facing the cold chills
Have you ever felt the cold chill in your spine when the “fix engine” light comes on in your car? How about when one of your children turns pale and gets their first fever? It’s a feeling of helplessness and concern regarding what could be wrong. Then there’s the feeling of relief that comes with...
ps69.org Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-895670 Security Researcher Gh05tPT Helped patch 6878 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting ps69.org website and its...
Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques
By Danny Adamitis with contributions from Paul Rascagneres. Executive summary After several months of activity, the actors behind the "Sea Turtle" DNS hijacking campaign are not slowing down. Cisco Talos recently discovered new details that suggest they regrouped after we published our initial...
The Logic of a Classic Advanced Persistent Threat Attack
By David Balaban Story of an Advanced Persistent Threat attack against a large corporation that started with a series of blank emails. Advanced persistent threats APTs are increasingly targeting enterprise networks nowadays. This article highlights a recent attack against a large, well-protected...
Fishwrap Campaign Sways Social Media Users with Old News
An influence operation that recycles old news about terror incidents and re-publishes them as if they were new is making the rounds on social media, according to Recorded Future analysis. The technique, which the researchers have dubbed Fishwrap since it repurposes old news, is also using a speci...
CVE-2019-12794
An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...
CVE-2019-12794
An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...
Design/Logic Flaw
An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...
CVE-2019-12794
The CVE concerns MISP 2.4.108 where organization admins can reset credentials for site admins, enabling credential abuse when host organizations create lower-privilege admins. An org admin could manually set a site admin password or use the site admin’s API key to impersonate them, with abuse res...
CVE-2019-12794
An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...
Video game portrayals of hacking: NITE Team 4
Note: The developers of NITE Team 4 granted the blog author access to the game plus DLC content. A little while ago, an online acquaintance of mine asked if a new video game based on hacking called NITE Team 4 was in any way realistic, or “doable” in terms of the types of hacking it portrayed...
CVE-2019-7107
creationtimestamp| type| source ---|---|--- 2019-05-23 16:48:29+00:00| seen| https://t.me/cvemitreorg/205...
Crosslinked - LinkedIn Enumeration Tool To Extract Valid Employee Names From An Organization Through Search Engine Scraping
CrossLinked simplifies the processes of searching LinkedIn to collect valid employee names when performing password spraying or another security testing against an organization. Using similar search engine scraping capabilities found in tools like subscraper and pymeta, CrossLinked will find vali...
WEBINAR: How to Get Enterprise Cyber Security for your Mid-Sized Organization
High-quality cybersecurity posture is typically regarded as the exclusive domain of the large and heavy resourced enterprises – those who can afford a multi-product security stack and a skilled security team to operate it. This implies a grave risk to all organizations who are not part of this...
CVE-2019-5946
creationtimestamp| type| source ---|---|--- 2019-05-17 16:51:32+00:00| seen| https://t.me/cvemitreorg/41...
Cross-Site Scripting (XSS)
Foreman is vulnerable to cross-site scripting XSS attacks. A remote attacker could exploit a flaw in the web interface component. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface...
Privilege Escalation
Red Hat Satellite is vulnerable to privilege escalation vulnerability. This is because the Satellite 6 does not properly enforce access controls on certain resources. Remote authenticated users with unlimited filters could bypass organization and location restrictions and read or modify data for ...
