Videos and Links from the Public-Interest Technology Track at the RSA Conference

Yesterday at the RSA Conference, I gave a keynote talk about the role of public-interest technologists in cybersecurity. Video here. I also hosted a one-day mini-track on the topic. We had six panels, and they were all great. If you missed it live, we have videos: How Public Interest Technologist...

Wallarm to Sponsor AppSec Cali

If you are a SecOps or DevOps professional on the west coast you can not miss the premier California application security event: AppSec California, January 22–25th in Santa Monica. Here are testimonials from the previous AppSec Cali events: “I'm looking forward to AppSecCali next week. Last year...

Nextcloud: Talk / spreed: Disclosure of Room names and participants for password protected rooms

CVSS ---- 5.3 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS isn't always as fine-grained as I'd like; personally, I would rate the issue somewhere between low and medium Description ----------- The API of the official spreed/talk extension reveals potentially sensitive information such...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I'm giving a book talk on Click Here to Kill Everybody at the Ford Foundation in New York City, on September 5, 2018. The Aspen Institute's Cybersecurity & Technology Program is holding a book launch for Click Here to Kill Everybod...

Security update for nextcloud (moderate)

This update for nextcloud to version 13.0.5 fixes the following issues: Security issues fixed: - CVE-2018-3780: Fixed a missing sanitization of search results for an autocomplete field that could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names,...

NextCloud Talk Cross-Site Scripting Vulnerability

NextCloud Talk is a local video conferencing and online chat solution from NextCloud Germany. The product supports video conferencing, online chat and online voice. A cross-site scripting vulnerability exists in versions prior to NextCloud Talk 3.2.5, which stems from the program failing to...

CVE-2018-3781

A missing sanitization of search results for an autocomplete field in NextCloud Talk 3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...

CVE-2018-3781

A missing sanitization of search results for an autocomplete field in NextCloud Talk 3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...

Cross site scripting

A missing sanitization of search results for an autocomplete field in NextCloud Talk 3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...

CVE-2018-3781

Nextcloud Talk

CVE-2018-3781: Improper Neutralization of Input During Web Page Generation

A missing sanitization of search results for an autocomplete field in NextCloud Talk 3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...

namknightswestside.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-595042 Description| Value ---|--- Affected Website:| namknightswestside.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

thebeckenhamgym.beckenham.towntalk.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-579426 Description| Value ---|--- Affected Website:| thebeckenhamgym.beckenham.towntalk.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

Human Factor Podcast: Jenny Radcliffe and Chris Boyd

A little while ago, I was invited to take part in Jenny Radcliffe's Human Factor Podcast. With 44 episodes strong and counting!, Jenny spends an hour or so talking at length with her guests who are professional investigators, security advocates, all-round educators, tireless consultant/conference...

keighleycollege30525.keighley.towntalk.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-555774 Description| Value ---|--- Affected Website:| keighleycollege30525.keighley.towntalk.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv...

irishclothingco.loughborough.towntalk.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-518878 Description| Value ---|--- Affected Website:| irishclothingco.loughborough.towntalk.co.uk Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

SteelCon: Mahkra ni Orroz

I recently gave a talk at Sheffield's SteelCon, a huge security event spread over a few days with no end of interesting activities taking place. My presentation, called Makhra ni Orroz, is a good 45 minutes of non stop talking and pictures and things. It's also a bit different in terms of what I...

Updated pidgin packages fix security vulnerability

A server controlled by an attacker can send an invalid XML that can trigger an out-of-bound memory access. This might lead to a crash or, in some extreme cases, to remote code execution in the client-side CVE-2017-2640. The pidgin package has been updated to version 2.12.0, which fixes this issue...

APT29 Domain Fronting With TOR

Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years. There has been considerable discussion about domain fronting following the release of a paper detailing these techniques...

[SECURITY] Fedora 24 Update: bitlbee-3.5.1-1.fc24

Bitlbee is an IRC to other chat networks gateway. Bitlbee can be used as an IRC server which forwards everything you say to people on other chat networks like XMPP/Jabber including Google Talk and Hipchat, MSN/Skype, AIM and ICQ, the Twitter microblogging network and all other Twitter API...