6747 matches found
Hacker Discloses New Unpatched Windows Zero-Day Exploit On Twitter
A security researcher with Twitter alias SandboxEscaper today released proof-of-concept PoC exploit for a new zero-day vulnerability affecting Microsoft's Windows operating system. SandboxEscaper is the same researcher who previously publicly dropped exploits for two Windows zero-day...
U.S. Dept Of Defense: [██████] Cross-origin resource sharing misconfiguration (CORS)
Hi! In this report I want to describe High level bug which can seriously compromise a user account. If I am authorize on this site, I can steal user's sessions, some personal information or do some action. Steps for reproduce 1 Send this request GET...
Tackling phishing with signal-sharing and machine learning
Across services in Microsoft Threat Protection, the correlation of security signals enhances the comprehensive and integrated security for identities, endpoints, user data, cloud apps, and infrastructure. Our industry-leading visibility into the entire attack chain translates to enriched protecti...
Threatpost Poll: Do You Hate Facebook?
Facebook is under fire again after a bombshell report went live, claiming it has had broad data-sharing arrangements with Amazon, Apple, Netflix and others for years. We’re wondering if this changes how you use Facebook in your everyday life. An exhaustive investigation in the New York Times on...
CVE-2018-17195
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle MiTM attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access,...
CVE-2018-17195
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle MiTM attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access,...
Cross site request forgery (csrf)
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle MiTM attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access,...
CVE-2018-17195
Apache NiFi template upload API is vulnerable to CSRF due to missing CORS filtering on the template/upload endpoint. The issue allows cross-origin requests that can lead to unauthorized operations when combined with a MiTM/ARP-spoofing scenario. Affected versions include NiFi 1.0.0 through 1.7.1 ...
CVE-2018-17195
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle MiTM attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access,...
Facebook Fights Back on Secret Data-Sharing Partnerships
UPDATE Facebook is hitting back after a new report on Tuesday said that the company struck broad data-sharing partnerships with more than 150 companies, including Apple, Amazon and Netflix, exempting them from its normal data privacy terms and conditions. An exhaustive investigation in the New Yo...
ctdb, libsmbclient, libwbclient, samba security update
CentOS Errata and Security Advisory CESA-2018:3056 An update for samba is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
[SECURITY] Fedora 28 Update: python-notebook-5.5.0-6.fc28
The Jupyter Notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text. The Notebook has support for multiple programming languages, sharing, and interactive widgets...
MiniShare Buffer Overflow Vulnerability
MiniShare is a file sharing system. A buffer overflow vulnerability exists in MiniShare version 1.4.1. An attacker can exploit this vulnerability by sending a long HTTP POST request to execute arbitrary code...
WordPress Social Sharing Plugin – Kiwi plugin <= 2.0.10 - Update Any Option (bypass) vulnerability
Bypass update any option vulnerability found in WordPress Social Sharing Plugin – Kiwi plugin versions = 2.0.10. Solution Update the WordPress Social Sharing Plugin – Kiwi plugin to the latest available version at least 2.0.11...
[SECURITY] Fedora 29 Update: python-notebook-5.7.2-1.fc29
The Jupyter Notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text. The Notebook has support for multiple programming languages, sharing, and interactive widgets...
Virtuozzo 6 : libsmbclient / libsmbclient-devel / samba / etc (VZLSA-2017-2789)
An update for samba is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
[SECURITY] Fedora 28 Update: virtualbox-guest-additions-5.2.22-1.fc28
VirtualBox is a powerful x86 and AMD64/Intel64 virtualization product for enterprise as well as home use. This package contains the VirtualBox Guest Additions which support better integration of VirtualBox guests with the Host, including file sharing, clipboard sharing and Seamless mode...
[SECURITY] Fedora 29 Update: virtualbox-guest-additions-5.2.22-1.fc29
VirtualBox is a powerful x86 and AMD64/Intel64 virtualization product for enterprise as well as home use. This package contains the VirtualBox Guest Additions which support better integration of VirtualBox guests with the Host, including file sharing, clipboard sharing and Seamless mode...
Partner Perspectives: Collaborate and Consolidate with King & Union and Carbon Black
Peter Prizio Jr. is the Senior Product Manager for King & Union. One of the biggest challenges facing security organizations today is dealing with the overwhelming number of alerts received each and every day. A staggering 27 percent of IT professionals report receiving more than one million aler...