Welcoming a more diverse workforce into cybersecurity: expanding the pipeline

Despite much focus on increasing the number of women in cybersecurity, as an industry we are still falling short. For many companies the problem starts with the tech pipeline—there just aren’t enough resumes from qualified female candidates. But I think the real problem is that our definition of...

Increasing Female Leadership in Technology

The lack of women in technology is a well-documented issue. In the United States, women account for only about 25% of computer and mathematical occupations, and only about 16% of engineering jobs. Worse still, women hold only 5% of leadership positions in the tech industry. Clearly the industry h...

SUSE-SU-2019:1990-1 Security update for cronie

This update for cronie fixes the following issues: Security issues fixed: - CVE-2019-9704: Fixed an insufficient check in the return value of calloc which could allow a local user to create Denial of Service by crashing the deamon bsc1128937. - CVE-2019-9705: Fixed an implementation vulnerability...

Qualys Cloud Platform 2.36 New Features

This release of the Qualys Cloud Platform version 2.36 includes updates and new features for AssetView Cloud Assets and Cloud Agents and Web Application Scanning, highlights as follows. AssetView Rules for Cloud Assets and Cloud Agents Rule-Based Method to Purge/Uninstall Cloud Assets and Cloud...

wmga.bluegolf.com XSS vulnerability

Open Bug Bounty ID: OBB-664267 Description| Value ---|--- Affected Website:| wmga.bluegolf.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

[SECURITY] Fedora 28 Update: drupal7-backup_migrate-3.5-1.fc28

Back up and restore your Drupal MySQL database, code, and files or migrate a site between environments. Backup and Migrate supports gzip, bzip and zip compression as well as automatic scheduled backups. With Backup and Migrate you can dump some or all of your database tables to a file download or...

Authentication flaw

Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified vectors...

CVE-2018-0566

Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via unspecified vectors...

CVE-2018-0528

Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified vectors...

nmtshipping.com XSS vulnerability

Open Bug Bounty ID: OBB-635742 Description| Value ---|--- Affected Website:| nmtshipping.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cybozu Office Browsing Restriction Bypass Vulnerability (CNVD-2018-15528)

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. A browsing restriction bypass vulnerability exists in Cybozu Office versions 10.0.0 through 10.8.0. An attacker can use this vulnerability to bypass authentication and gain unauthorized access to schedules...

Cybozu Office Browsing Restriction Bypass Vulnerability

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. A browsing restriction bypass vulnerability exists in Cybozu Office versions 10.0.0 through 10.7.0. An attacker can use this vulnerability to bypass authentication and view schedules that they are not authorized to...

Two NSA Algorithms Rejected by the ISO

The ISO has rejected two symmetric encryption algorithms: SIMON and SPECK. These algorithms were both designed by the NSA and made public in 2013. They are optimized for small and low-cost processors like IoT devices. The risk of using NSA-designed ciphers, of course, is that they include...

Code injection

dataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for purposes such as sending e-mail messages or making outbound connections to FTP servers for uploading data...

CVE-2017-11349

dataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for purposes such as sending e-mail messages or making outbound connections to FTP servers for uploading data...

pacebus.com XSS vulnerability

Vulnerable URL: http://www.pacebus.com/sub/schedules/searchresults.asp?TYPE=range=1"...

issaquahbaseball.com XSS vulnerability

Vulnerable URL: http://www.issaquahbaseball.com/schedules.asp?schedule=1"...

dacc.edu XSS vulnerability

Vulnerable URL: https://www.dacc.edu/assets/pdfs/schedules/flipbook/bookContent.swf?currentHTMLURL=data:text/html;base64,PHNjcmlwdD5hbGVydCgnT1BFTiBCVUdCT1VOVFknKTwvc2NyaXB0Pg== Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

Analyzing Cyber Insurance Policies

There's a really interesting new paper analyzing over 100 different cyber insurance policies. From the abstract: In this research paper, we seek to answer fundamental questions concerning the current state of the cyber insurance market. Specifically, by collecting over 100 full insurance policies...

baumschool.org XSS vulnerability

Open Bug Bounty ID: OBB-200110 Description| Value ---|--- Affected Website:| baumschool.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...