5787 matches found
Kostebek - Reconnaissance Tool Which Uses Firms Trademark Information To Discover Their Domains
The Kostebek is a reconnaissance tool which uses firms' trademark information to discover their domains. Installation Tested on Kali Linux 2018.2, Ubuntu 16.04 sudo apt-get -y install python3-pip pip3 install -r requirements.txt download latest version of Chromedriver and configure your driver-pa...
Is your org structure threatening your IT security infrastructure?
In a hyper-competitive environment, keeping up with customer usability demands often means adopting a hyper-agile development process. It’s a dangerous devil’s bargain. Security gets left on the cutting room floor in pursuit of highly responsive, first-to-market, code-to-customer feature flow...
[SECURITY] Fedora 30 Update: gnome-books-3.32.0-3.fc30
Books is a simple application to access and organize your e-books on GNOME. It is meant to be a simple and elegant replacement for using a file manager to deal with e-books...
CVE-2019-0032
A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper...
Sophisticated 'TajMahal APT Framework' Remained Undetected for 5 Years
Cybersecurity researchers yesterday unveiled the existence of a highly sophisticated spyware framework that has been in operation for at least last 5 years—but remained undetected until recently. DubbedTajMahal by researchers at Kaspersky Lab, the APT framework is a high-tech modular-based malwar...
Cybercriminals Have a Heyday with WinRAR Bug in Fresh Campaigns
A recently discovered vulnerability in the WinRAR file archival utility has been exploited in a slew of new campaigns, including one with a never-before-seen payload. The flurry of activity shows no sign of waning as cybercriminals continue to find success exploiting the bug. The campaigns take...
CyberAegis Aether Competition Team Reflects Bright Future for Young Women in STEM & Cybersecurity
I am always excited to get involved in conversations around getting more young women into STEM earlier. Recently, I was able to catch up with the members of the CyberAegis Aether team, an all-girls, middle school cybersecurity competition team. Here is what they had to say: Tell us a little bit...
CVE-2018-2009
IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure vulnerability in the consumer API. Any registered user can obtain a list of all other users in all other orgs, including email id/names, etc. IBM X-Force ID: 155148...
How a Dedicated Focus on Clarity Can Relieve Disorganization, Distraction and Confusion in Infosec
clar·i·ty /ˈklerədē/ noun the quality of being coherent and intelligible. "For the sake of clarity, each of these strategies is dealt with separately" 1. synonyms: | lucidity, lucidness, clearness, perspicuity, intelligibility, comprehensibility, coherence;More ---|--- It’s been three years on th...
Input validation
TitanHQ SpamTitan before 7.01 has Improper input validation. This allows internal attackers to bypass the anti-spam filter to send malicious emails to an entire organization by modifying the URL requests sent to the application...
CVE-2018-15136
TitanHQ SpamTitan before 7.01 has Improper input validation. This allows internal attackers to bypass the anti-spam filter to send malicious emails to an entire organization by modifying the URL requests sent to the application...
Microsoft’s Cyber Defense Operations Center shares best practices
Today, a single breach, physical or virtual, can cause millions of dollars of damage to an organization and potentially billions in financial losses to the global economy. Each week seems to bring a new disclosure of a cybersecurity breach somewhere in the world. As we look at the current state o...
How to Secure Your Mid-Size Organization From the Next Cyber Attack
If you are responsible for the cybersecurity of a medium-sized company, you may assume your organization is too small to be targeted. Well, think again. While the major headlines tend to focus on large enterprises getting breached – such as Sony, Equifax, or Target the actual reality is that smal...
Privilege Escalation
ansible is vulnerable to privilege escalation attacks. The vulnerability exists as Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their...
Cross-site Scripting (XSS)
spacewalk-schema is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as a cross-site scripting XSS flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attack...
Authorization Bypass
foreman is vulnerable to authorization bypass. An unspecified vulnerability allows authenticated users to bypass organization and location restrictions to read, edit or delete organizations or locations...
Procedure to migrate a Cloud Connect tenant to vCloud Director
Challenge SPs who have vCloud Director deployed in their infrastructure can expose vCloud Director resources as cloud hosts for tenant VM replicas. This article describes a procedure of migrating existing tenants to vCloud Director. Solution On the Tenant side: 1. Delete all Cloud Backup and...
CVE-2018-20226
An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...