Notes on Self-Publishing a Book

In this post I would like to share a few thoughts on self-publishing a book, in case anyone is considering that option. As I mentioned in my post on burnout, one of my goals was to publish a book on a subject other than cyber security. A friend from my Krav Maga school, Anna Wonsley, learned that...

The vulnerability of the Windows Azure Pack cloud platform arises from the lack of measures taken to protect the website structure. This allows attackers to execute cross-site scripting attacks with elevated privileges.

The vulnerability of the Windows Azure Pack cloud platform exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks with elevated privileges...

The vulnerability of the Microsoft SharePoint software lies in the lack of measures taken to protect the website structure, allowing attackers to execute cross-site scripting attacks with elevated privileges.

The vulnerability of the Microsoft SharePoint package exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks with elevated privileges, using a specially crafted request to the...

CVE-2018-20247

In Foxit Quick PDF Library all versions prior to 16.12, issue where loading a malformed or malicious PDF containing a recursive page tree structure using the LoadFromFile, LoadFromString or LoadFromStream functions results in a stack overflow...

CVE-2018-20424

Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the commonmemberwechatmp data structure via an ac=unbindmp request to plugin.php...

CVE-2018-20424

Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the commonmemberwechatmp data structure via an ac=unbindmp request to plugin.php...

CVE-2018-20424: Improper Input Validation

Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the commonmemberwechatmp data structure via an ac=unbindmp request to plugin.php...

CVE-2018-19134

In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue...

The vulnerability of IBM WebSphere Application Server application servers arises from the lack of measures taken to protect the structure of web pages. This allows attackers to inject malicious code into the loaded web pages.

The vulnerability of IBM WebSphere Application Server application servers exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to inject unauthorized code into the loaded web pages...

The vulnerability of the Wizard component in the microprogramming software of the RICOH MP C6003 multifunctional device allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Wizard /web/entry/en/address/adrsSetUserWizard.cgi component of the RICOH MP multifunctional device exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to compromise the...

The vulnerability of the IBM WebSphere Portal software arises from the lack of measures taken to protect the structure of the web page. This allows attackers to disclose user credentials during a secure session.

The vulnerability of the IBM WebSphere Portal software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to gain access to user credentials during a secure session, thereby allowing the insertion of arbitra...

The vulnerability of the IBM WebSphere Portal software arises from the lack of measures taken to protect the structure of the web page. This allows attackers to disclose user credentials during a secure session.

The vulnerability of the IBM WebSphere Portal software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to gain access to user credentials during a secure session, thereby allowing the insertion of arbitra...

The vulnerability of the IBM WebSphere Portal software arises from the lack of measures taken to protect the structure of the web page. This allows attackers to disclose user credentials during a secure session.

The vulnerability of the IBM WebSphere Portal software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to gain access to user credentials during a secure session, thereby allowing the insertion of arbitra...

The vulnerability of the Web Isolation software lies in its inability to protect the structure of web pages. This allows attackers to inject arbitrary code into the loaded web pages.

The vulnerability of the software for preventing web threats exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor, operating remotely, to inject arbitrary code into the loaded web page using a specially crafted URI...

The vulnerability of the Wizard component in the microprogramming software of the RICOH Aficio MP multifunctional device allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Wizard /web/entry/en/address/adrsSetUserWizard.cgi component of the RICOH Aficio MP multifunctional device exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality a...

A Chief Security Concern for Executive Teams

Virtually all companies like to say they take their customers' privacy and security seriously, make it a top priority, blah blah. But you'd be forgiven if you couldn't tell this by studying the executive leadership page of each company's Web site. That's because very few of the world's biggest...

CVE-2018-20168

Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service "physical address not valid" panic via a crafted application...

CVE-2018-20168: Improper Input Validation

Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service "physical address not valid" panic via a crafted application...

Grammarly Launches Public Bug Bounty Program

Online AI-based communications tool Grammarly is taking its private bug bounty program public in hopes of finding and fixing more vulnerabilities in its software. The company has run a private bug bounty program – which currently has 1,500 participants – in conjunction with HackerOne for over a...

The vulnerability in the web interface for controlling Cisco Registered Envelope Service allows a perpetrator to inject arbitrary code into the web page that is uploaded.

The vulnerability of the web interface for managing security information transmitted by the Cisco Registered Envelope Service is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the...