Threat Source newsletter (Sept. 12, 2019)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. You’ve heard it a million times: Always patch. But in case you needed another example that it’s important, Cisco Incident Response took ...

Watchbog and the Importance of Patching

By Luke DuCharme and Paul Lee. What Happened? Cisco Incident Response CSIRS recently responded to an incident involving the Watchbog cryptomining botnet. The attackers were able to exploit CVE-2018-1000861 to gain a foothold and install the Watchbog malware on the affected systems. This Linux-bas...

www3.pe.senac.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-968500 Security Researcher naldron Helped patch 13 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting www3.pe.senac.br website and its users. Following...

tararuabreedingcentre.co.nz Cross Site Scripting vulnerability

Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting tararuabreedingcentre.co.nz website and its users. Following...

secure7.userservices.net Cross Site Scripting vulnerability

Security Researcher metamorfosec Helped patch 1944 vulnerabilities Received 9 Coordinated Disclosure badges Received 31 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting secure7.userservices.net website and its users...

optimizely.com Cross Site Scripting vulnerability

Security Researcher Th3plumb3r Helped patch 52 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting optimizely.com website and its users. Following coordinated and responsible...

patch security update

CentOS Errata and Security Advisory CESA-2019:2033 An update for patch is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

web.uconn.edu Cross Site Scripting vulnerability

Security Researcher Gh05tPT Helped patch 6836 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting web.uconn.edu website and its users. Following coordinat...

EulerOS 2.0 SP5 : patch (EulerOS-SA-2019-1801)

According to the versions of the patch package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrar...

sivtr.ru Open Redirect vulnerability

Security Researcher Disst Helped patch 864 vulnerabilities Received 3 Coordinated Disclosure badges Received 3 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting sivtr.ru website and its users. Following coordinated and...

Apache Security Advisories Red Flag Wrong Versions in Patching Gaffe

Researchers have pinpointed errors in two dozen Apache Struts security advisories, which warn users of vulnerabilities in the popular open-source web app development framework. They say that the security advisories listed incorrect versions impacted by the vulnerabilities. The concern from this...

grandhotelnizza.it Cross Site Scripting vulnerability

Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting grandhotelnizza.it website and its users. Following...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft

Overview of CVE-2017-11882 In terms of vulnerability exploit...

klein-hcsd-iu5.enadmin.org Cross Site Scripting vulnerability

Security Researcher Gh05tPT Helped patch 6844 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting klein-hcsd-iu5.enadmin.org website and its users...

Windows Remote Desktop Vulnerabilities (Seven Monkeys) – How to Detect and Patch

In the August 2019 Patch Tuesday release, Microsoft disclosed 7 RDP Vulnerabilities, out of which 4 are labeled as critical and 3 as important. All the critical vulnerabilities exist in Remote Desktop Services – formerly known as Terminal Services – and do not require authentication or user...

journals.library.columbia.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-930785 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

hixon.cz Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-928475 Security Researcher metamorfosec Helped patch 1970 vulnerabilities Received 9 Coordinated Disclosure badges Received 31 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting hixon.cz website and i...

franckliu.misscoquines.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-926931 Security Researcher Track2 Helped patch 214 vulnerabilities Received 2 Coordinated Disclosure badges Received 1 recommendations , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting franckliu.misscoquines.com...

Security Bulletin: Information disclosure in WebSphere Application Server Admin Console in IBM Cloud (CVE-2019-4269)

Summary There is an information disclosure in the Admin Console of WebSphere Application Server. Vulnerability Details CVEID: CVE-2019-4269 DESCRIPTION: IBM WebSphere Application Server Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes...

netmoms.de Cross Site Scripting vulnerability

Security Researcher rajeshappsec Helped patch 111 vulnerabilities Received 4 Coordinated Disclosure badges Received 17 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting netmoms.de website and its users. Following coordinate...