Microsoft Windows: Configure Connected User Experiences and Telemetry

With this policy setting, you can forward Connected User Experience and Telemetry requests to a proxy server. If you enable this policy setting, you can specify the FQDN or IP address of the destination device within your organization SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptio...

Picking Apart Remcos Botnet-In-A-Box

This blog post was authored by Edmund Brumaghin and Holger Unterbrink with contributions from Eric Kuhla and Lilia Gonzalez Medina. Overview Cisco Talos has recently observed multiple campaigns using the Remcos remote access tool RAT that is offered for sale by a company called Breaking Security...

VMWare Player 12.5.9 Privilege Escalation / Denial Of Service

Hi @ll, the executable installer of VMware Player 12.5.9, published in January 2018, available from , is vulnerable. JFTR: VMware Player 12.5.9 is the last version which runs on 32-bit Windows, and the last to support older CPUs. Although running with administrative privileges its embedded...

WindowsSpyBlocker - Block Spying And Tracking On Windows

WindowsSpyBlocker is an application written in Go and delivered as a single executable to block spying and tracking on Windows systems. The initial approach of this application is to capture and analyze network traffic based on a set of tools. It is open for everyone and if you want to contribute...

Citrix Provisioning 7.x Data Collection

Note This Document covers Citrix Provisioning, formerly Provisioning Services,data Collection ONLY. Links Wireshark -https://www.wireshark.org Enable Promiscuous Mode – http://support.citrix.com/article/CTX139171 Citrix Telemetry Service - https://docs.citrix.com/en-us/provisioning/1912-...

Microsoft Windows: Authenticated Proxy usage (Connected User Experience and Telemetry)

This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatical...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM WebSphere MQ Telemetry (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM WebSphere MQ Telemetry MQXR service. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the...

Security Bulletin: A security vulnerability has been identified in WebSphere MQ Telemetry shipped with WebSphere Remote Server (CVE-2014-4263, CVE-2014-4244, CVE-2015-0410, CVE-2014-6593)

Summary WebSphere MQ Telemetry is shipped as a component of WebSphere Remote Server. Information about a security vulnerability affecting WebSphere MQ Telemetry has been published in a security bulletin. Vulnerability Details For vulnerability details, see the security bulletin Multiple...

Security Bulletin: IBM WebSphere MQ Telemetry Component - Potential authentication bypass vulnerability when using the JAASConfig property (CVE-2014-6116)

Summary IBM WebSphere MQ contains a vulnerability in which authentication is bypassed by MQTT clients with the "JAASConfig" configuration property set. Vulnerability Details CVE ID: CVE-2014-6116 IBM WebSphere MQ contains a vulnerability in which authentication is bypassed by MQTT clients with th...

MQTT Denial of Service Vulnerability

MQTT is an open source MQTT protocol client for node.js and browsers written in JavaScript . A denial of service vulnerability exists in MQTT versions prior to 3.4.6 and 4.0.x prior to 4.0.5. An attacker can exploit this vulnerability to cause an application crash with the help of specially craft...

DARKSURGEON - A Windows Packer Project To Empower Incident Response, Digital Forensics, Malware Analysis, And Network Defense

DARKSURGEON is a Windows packer project to empower incident response, digital forensics, malware analysis, and network defense. DARKSURGEON has three stated goals: Accelerate incident response, digital forensics, malware analysis, and network defense with a preconfigured Windows 10 environment...

From the ground up to the cloud: Microsoft’s Intelligent Security supporting CISOs’ cloud transformation

Its no secret that Microsoft has embraced the cloud in a big wayfrom enterprise solutions like Microsoft Azure to Office 365 and Windows. But a recent research report by Forrester focuses on an equally important shift in our approach to securityintegrating workforce and cloud security in ways tha...

Martem TELEM-GW6/GWM Denial of Service Vulnerability

Martem specializes in providing remote control systems for monitoring and controlling distribution networks, and its customers include distribution companies as well as industrial and transportation companies that own their own power grids. A denial of service vulnerability exists in the Martem...

Windows Packer Project for Defenders: DARKSURGEON

Darksurgeon is a Windows packer project to empower incident response, digital forensics, malware analysis, and network defense. Darksurgeon has three stated goals: Accelerate incident response, digital forensics, malware analysis, and network defense with a preconfigured Windows 10 environment...

CVE-2017-9657

Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the central monitoring station is possible. In this state, the central monitoring station can indicate the MX40 is not connected or associated to the central monitor,...

CVE-2017-9657

Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the central monitoring station is possible. In this state, the central monitoring station can indicate the MX40 is not connected or associated to the central monitor,...

ALPINE-CVE-2017-7651

In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol...

Microsoft Windows 10: Send file samples when further analysis is required

This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. Possible settings: - 0: Always prompt - 1: Send safe samples automatically - 2: Never send - 3: Send all samples automatically OpenVAS Vulnerability Test $Id:...

Microsoft Windows 10: Allow Telemetry

This policy setting determines the amount of Windows diagnostic data sent to Microsoft. A value of 0 Security will send minimal data to Microsoft to keep Windows secure. Windows security components such as Malicious Software Removal Tool MSRT and Windows Defender may send data to Microsoft at thi...

Microsoft Office: Turn on privacy setting in Office Telemetry Agent

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013privacysettingofficetelemetryagent.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Turn on privacy setting in Office Telemetry Agent Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...