5857 matches found
November 22, 2017 – Morning Cyber Coffee Headlines – “Thanksgiving Week” Edition
Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! November 22, 2017 - Headlines Carbon Black in the News: Holiday season scams:...
MyTy 5.1.7 Cross Site Scripting
COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: MyTy Vendor: Finlane GmbH CSNC ID: CSNC-2017-030 CVE ID: - Subject: Reflected Cross-Site Scripting XSS Risk: High Effect: Remotely exploitable Author: Nicolas Heiniger Date: 21.11.2017 Introduction:...
Password Recovery Platform: Wavecrack
A user-friendly Web interface to share an hashcat cracking box among multiple users with some pre-defined options. Outline This Web application can be used to launch asynchronous password cracks with hashcat . The interface tries to be as user-friendly as possible and facilitates the password...
CVE-2017-11402
An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. Design flaws in OPC classic and in custom netfilter modules allow an attacker to remotely activate rules on the firewall and to connect to any TCP port of a protected asset, thus bypassing the...
SimpleWall - Simple tool to configure Windows Filtering Platform (WFP)
Simple tool to configure Windows Filtering Platform WFP which can configure network activity on your computer. The lightweight application is less than a megabyte, and it is compatible with Windows Vista and higher operating systems. You can download either the installer or portable version. For...
Siemens SCALANCE W1750D, M800, S615, and RUGGEDCOM RM1224 (Update C)
1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: Siemens --------- Begin Update C Part 1 of 3 -------- Equipment: SCALANCE W1750D, M800, S615, and RUGGEDCOM RM1224 --------- End Update C Part 1 of 3 -------- Vulnerabilities: Resource...
White House Releases VEP Disclosure Rules
The U.S. government took steps toward offering more transparency into the Vulnerabilities Equities Process. On Wednesday it released of the “Vulnerabilities Equities Policy and Process” PDF charter that outlines how the government will disclose cyber security flaws and when it will keep them...
Unspecified vulnerability in MediaWiki language converter (CNVD-2017-35260)
MediaWiki is a free and free web-based wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers, which can be used to deploy internal knowledge management and content management systems. language converter is one of the language converters. A security vulnerabilit...
CVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules...
Design/Logic Flaw
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules...
DEBIAN-CVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules...
CVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules...
CVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules...
CVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules...
CVE-2017-8815
CVE-2017-8815 affects MediaWiki’s language converter: unsafe attribute injection via glossary rules in versions before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2. This metadata is supported by multiple advisories (Debian DSA-4036, Arch ASA-2017-11-20, Mageia/MEDIAWiki notes). Impact d...
Description of the security update for SharePoint Server 2016: November 14, 2017
None None...
IT threat evolution Q3 2017
Targeted attacks and malware campaigns Re-enter the dragon In July, we reported on the recent activities of a targeted attack group called 'Spring Dragon' also known as LotusBlossom, whose activities data back to 2012. Spring Dragon makes extensive use of spear-phishing and watering-hole attacks...
SUSE-SU-2017:2932-1 Security update for SuSEfirewall2
This update for SuSEfirewall2 fixes the following issues: - CVE-2017-15638: Fixed a security issue with too open implicit portmapper rules bsc1064127: A source net restriction for rpc services was not taken into account for the implicitly added rules for port 111, making the portmap service...
SUSE-SU-2017:2923-1 Security update for SuSEfirewall2
This update for SuSEfirewall2 fixes the following issues: - CVE-2017-15638: Fixed a security issue with too open implicit portmapper rules bsc1064127: A source net restriction for rpc services was not taken into account for the implicitly added rules for port 111, making the portmap service...
Cisco Application Policy Infrastructure Controller Enterprise Module Unauthorized Access Vulnerability
Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM is a suite of Cisco applications that provide policy-based automated configuration of end-to-end infrastructure controllers. An unauthorized access vulnerability vulnerability exists in the firewall configuration in Cisc...