Disabling automatic password change for nonpersistent desktops

Computers use their machine account password for authentication with Active Directory. By default, computers are configured to change their machine account passwords every 30 days. This setting affects nonpersistent desktops in the following ways: 1. When you deploy the nonpersistent desktop, the...

Ubiquiti Inc.: Reflected XSS

Due to the lack of sanitisation in the commend area, with a especially crafted message, is possible to execute a XSS with the "preview" function. If a draft is save, is possible to exploit this bug using as and stored-XSS. The "New Discussion" page on the Spanish and Portuguese forums have a...

CVE-2017-1672

IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 133639...

Akamaizing Your Dev & QA Environments

Over the last few months, I've been talking to many development and test teams who deliver their sites and applications through the Akamai Intelligent Platform. One common challenge they face is how to test their Akamai delivery configurations on the Internet against their private development and...

CVE-2017-16689

A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 to 7.22, 7.45, 7.49, can be established to a different client or a different user on the same system, although no explicit Trusted/Trusting...

Fedora 25 : ca-certificates (2017-7f8abb1866)

This is a cumulative update to the Mozilla CA certificates trust list version 2.20, which has been published as part of Mozilla NSS 3.34.1. It also includes the changes that were previously released as version 2.18 as part of NSS 3.34. For additional details, please refer to the release notes of...

trust.sproutit.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-432216 Description| Value ---|--- Affected Website:| trust.sproutit.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

Ruby on Rails: ActionController::Parameters .each returns an unsafe hash

Rails 5.1.4 The goal of ActionController::Parameters's permit method strong parameters is to prevent accidental trust in the parameters sent by the client. We can therefore not simply create a hash of all the parameters in the params without permitting them first. When we really want to do this...

How the EU intends to battle fake news

Last week the European Union issued a press release to announce their next steps against fake news. These steps will be the launch of a public consultation and the setup of a high-level expert group representing academics, online platforms, news media, and civil society organizations. The first...

When you shouldn’t trust a trusted root certificate

Root certificates are the cornerstone of authentication and security in software and on the Internet. They're issued by a certified authority CA and, essentially, verify that the software/website owner is who they say they are. We have talked about certificates in general before, but a recent eve...

openstack-aodh: Aodh can be used to launder Keystone trusts

A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious us...

Moderate: Red Hat Security Advisory: openstack-aodh security update

An update for openstack-aodh is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

tdcanadatrust.com XSS vulnerability

Vulnerable URL: https://www.tdcanadatrust.com/search/index.jsp?query=toto%22%3E%0D%3Ciframe%20src=%22javascrip%09t:aler%09tdocument.domain%22%3E%0d%3C!--%20=en=tdtdcttdcben Details: Description| Value ---|--- Patched:| Yes, at 29.11.2017 Latest check for patch:| 29.11.2017 08:43 GMT Vulnerability...

Infogram: XSS when Shared

Introduction XSS on an embedded piece of code that, when shared, may make it seem as if it was infogram.com that was doing the malicious act. Proof of Concept 1. Create an account 2. Create a project titled "scriptalert1;" 3. Click on share Here's an example of the share embedded code:...

CVE-2017-15882

The London Trust Media Private Internet Access PIA application before 1.3.3.1 for Android allows remote attackers to cause a denial of service application crash via a large VPN server-list file...

Design/Logic Flaw

The London Trust Media Private Internet Access PIA application before 1.3.3.1 for Android allows remote attackers to cause a denial of service application crash via a large VPN server-list file...

CVE-2017-15882

The CVE-2017-15882 entry concerns the Private Internet Access (PIA) Android client prior to version 1.3.3.1. A remote attacker could cause a denial of service (application crash) by presenting the app with a very large VPN server-list file. The issue is tied to processing the server-list file (no...

CVE-2017-15882

The London Trust Media Private Internet Access PIA application before 1.3.3.1 for Android allows remote attackers to cause a denial of service application crash via a large VPN server-list file...

X (Formerly Twitter): OS Command Execution on User's PC via CSV Injection

Summary: Twitter is vulnerable to CSV Injection. If an attacker can successfully exploit this, then they will compromise the PC of the user. The injection point is via a tweet on the main twitter.com site while the retrieval point is via the “Export Data” option on the analytics site. Description...

Introducing Windows Defender Application Control

Application control is a crucial line of defense for protecting enterprises given today’s threat landscape, and it has an inherent advantage over traditional antivirus solutions. Specifically, application control flips the model from one where all applications are assumed trustworthy by default t...