Introducing the Cognitive Attack Loop and the 3 Phases of Cybercriminal Behavior

We have a fundamental saying at Carbon Black: “Cybersecurity is all about the data.” I love this saying. In understanding the data, we can better understand behaviors. And, in better understanding behaviors, we can better understand attackers. Much like a detective in the physical world pieces...

CVE-2019-14407

CVE-2019-14407 affects cPanel before 78.0.2, where internal data is disclosed to OpenID providers (SEC-415). Public sources (NVD, Red Hat, CNVD) confirm that versions prior to 78.0.2 are affected and describe an information-disclosure vulnerability tied to configuration/operation errors. The prac...

Security Bulletin: Rational Insight - Jazz Reporting Service report results can be viewed without user log-in (CVE-2014-6115)

Summary A security vulnerability exists in the Jazz Reporting Service JRS that is shipped with Rational Insight. Vulnerability Details Security vulnerabilities have been discovered and reported in Jazz Reporting Service. CVEID: CVE-2014-6115 Description: A Jazz Reporting Service JRS report URL ca...

Liberapay: CSRF token manipulation in every possible form submits. NO server side Validation

Web Application is generating CSRFtoken values inside cookies which is not a best practice for web applications the revelation of cookies can reveal CSRF Tokens as well. Authenticity tokens should be kept separate from cookies and should be isolated to change operations in the account only...

Security feature bypass

A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory...

CVE-2016-10519

The CVE-2016-10519 entry describes a vulnerability in bittorrent-dht before 5.1.3 where an attacker can send a crafted sequence of messages to a listening peer to cause disclosure of internal memory. Affected component: bittorrent-dht (Node.js implementation). Root cause: insecure handling of mes...

Command injection

When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing...

Suspended Sentence for Mirai Botmaster Daniel Kaye

Last month, KrebsOnSecurity identified U.K. citizen Daniel Kaye as the likely real-life identity behind a hacker responsible for clumsily wielding a powerful botnet built on Mirai, a malware strain that enslaves poorly secured Internet of Things IoT devices for use in large-scale online attacks...

Debian DLA-927-1 : fop security update

In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full...

Ian Dunn: Potentially vulnerable version of Apache software in and default files on https://iandunn.name/

Hi, The underlying web server for https://iandunn.name/ is not configured to hide the version of Apache in place. As a result, when attempts are made for the following files, a verbose response is received revealing the underlying Apache version. It should be noted that the underlying software...

Gratipay: don't store CSRF tokens in cookies

Your web application generates CSRF token values inside cookies which is not a best practice for web applications as revelation of cookies can reveal CSRF Tokens as well. Authenticity tokens should be kept separate from cookies and should be isolated to change operations in the account only. More...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update

Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

DSA-3331-1 subversion - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3331-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Personal.Net Portal - Multiple Vulnerabilities

No description provided by source. ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ ''' Abysssec Inc Public Advisory Title : Personal.Net Portal Multiple Vulnerabilities Affected Version : Personal.Net Portal Version 2.8.1...

Left 4 Dead Stats 1.1 - SQL Injection Vulnerability

---------------------------------- Left 4 Dead Stats SQL Injection Vulnerability Author: Sora Contact: vhr95zw at hotmail dot com Website: http://greyhathackers.wordpress.com/ Google Dork: In your dreams, script kiddies. VULNERABILITY DESCRIPTION: Left 4 Dead Stats suffers from a remote SQL...

Coalition Calls For Net Reset in June

A new alliance composed of privacy and digital rights advocates are encouraging internet users to block mass surveillance and fight back against the National Security Agency on June 5. The coalition, dubbed Reset the Net is hoping to carry out its goal through the further implementation of SSL,...

OpenSSL Fixes TLS Vulnerability

The maintainers of the OpenSSL library, one of the more widely deployed cryptographic libraries on the Web, have fixed a serious vulnerability that could have resulted in the revelation of 64 KB of memory to any client or server that was connected. The details of the vulnerability, fixed in versi...

Dexter, Project Hook Point of Sale Malware Still Prevalent

While the Target data breach may be in the rear view mirror, research this week shows it’s clear that many attackers are still using point of sale malware, namely Dexter and Project Hook, in active attacks. Researchers at Arbor Networks’ Security Engineering & Response Team ASERT looked at severa...

Always Outmanned, Always Outgunned

We were warned. Over and over again. Not just by privacy advocates and by security experts and by civil liberties organizations and by the guy on the corner in the tin foil hat shouting about the government intercepting his brain waves. We were warned by some of the very people charged with...