It’s Everyone’s Job to Ensure Online Safety at Work

As part of our effort to support National Cyber Security Awareness Month I wanted to provide information on the need for everyone within a business to be aware of their role in keeping the organization safe from cyber attacks. Let’s discuss some of the areas where we see existing organizations...

CVE-2018-15436: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Webex Events Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based...

PT-2018-2139

Name of the Vulnerable Software and Affected Versions Cisco Webex Events Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center affected versions not specified Description The issue is related to insufficient validation of user-supplied input by the...

Running a security awareness program

So, you've finally convinced management of the need for security awareness training. What next? I’ve been performing security awareness training for around 10 years, and doing it full time here at PTP for the last 3 and a half years. From the thousands of sessions I have run I’ve found the most...

ZDResearch Advanced Web Hacking Training 2018 – Learn Online

Are you looking to master web hacking? Interested in a bug-hunting career? Do you want to land a job in cybersecurity? Are you already working as a security engineer, but want to further advance or refine your skills? If yes, read on. ZDResearch Advanced Web Hacking AWH course, including optional...

ZDResearch Advanced Web Hacking Training 2018 – Learn Online

Are you looking to master web hacking? Interested in a bug-hunting career? Do you want to land a job in cybersecurity? Are you already working as a security engineer, but want to further advance or refine your skills? If yes, read on. ZDResearch Advanced Web Hacking AWH course, including optional...

Kaizen Asset Manager and Training Mnager Code Execution Vulnerability

Kaizen Asset Manager and Training Mnager are both products of Kaizen Dubai.Kaizen Asset Manager is a suite of asset management software.Training Manager is a suite of company training management software. A security vulnerability exists in Kaizen Asset Manager Enterprise Edition and Training...

CISSP Certification Course — Become An IT Security Professional

If you dream of making it big in the IT security community, the CISSP certification is a necessary milestone. Certified Information Systems Security Professional CISSP is a globally recognised certification in the field of information security, which has become a gold standard of achievement that...

CISSP Certification Course — Become An IT Security Professional

If you dream of making it big in the IT security community, the CISSP certification is a necessary milestone. Certified Information Systems Security Professional CISSP is a globally recognised certification in the field of information security, which has become a gold standard of achievement that...

CVE-2018-16545

Kaizen Asset Manager Enterprise Edition and Training Manager Enterprise Edition allow a remote attacker to achieve arbitrary code execution via file impersonation. For example, a malicious dynamic-link library dll assumed the identity of a temporary tmp file isxdl.dll and an executable file assum...

Code injection

Kaizen Asset Manager Enterprise Edition and Training Manager Enterprise Edition allow a remote attacker to achieve arbitrary code execution via file impersonation. For example, a malicious dynamic-link library dll assumed the identity of a temporary tmp file isxdl.dll and an executable file assum...

CVE-2018-16545

Kaizen Asset Manager Enterprise Edition and Training Manager Enterprise Edition allow a remote attacker to achieve arbitrary code execution via file impersonation. For example, a malicious dynamic-link library dll assumed the identity of a temporary tmp file isxdl.dll and an executable file assum...

Stop Impersonations of Your CEO by Checking the Writing Style

If one of your employees receives an email that looks like it’s from the CEO asking to send sensitive data or to make a wire transfer, could that employee spot it as a fake based on how it is written? He or she may be so concerned with pleasing the CEO that they may urgently respond without a...

CVE-2018-16545

Kaizen Asset Manager Enterprise Edition and Training Manager Enterprise Edition allow a remote attacker to achieve arbitrary code execution via file impersonation. For example, a malicious dynamic-link library dll assumed the identity of a temporary tmp file isxdl.dll and an executable file assum...

CVE-2018-16545

CVE-2018-16545 affects Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition). The vulnerability allows a remote attacker to achieve arbitrary code execution via file impersonation, demonstrated by a malicious DLL (isxdl.dll) and a malicious executable (996E.temp) imp...

PT-2018-13622

Name of the Vulnerable Software and Affected Versions Kaizen Asset Manager Enterprise Edition affected versions not specified Kaizen Training Manager Enterprise Edition affected versions not specified Description The issue allows a remote attacker to achieve arbitrary code execution via file...

CVE-2018-16545: Incorrect Permission Assignment for Critical Resource

Kaizen Asset Manager Enterprise Edition and Training Manager Enterprise Edition allow a remote attacker to achieve arbitrary code execution via file impersonation. For example, a malicious dynamic-link library dll assumed the identity of a temporary tmp file isxdl.dll and an executable file assum...

Loki Bot: On a hunt for corporate passwords

Starting from early July, we have seen malicious spam activity that has targeted corporate mailboxes. The messages discovered so far contain an attachment with an .iso extension that Kaspersky Lab solutions detect as Loki Bot. The malware's key objective is to steal passwords from browsers,...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab

This repository is an offensive tool for a vulnerability environment. It is a Docker-Compose file for a vulnerability environment. The repository contains a .gitignore file, a README.md file, and several other files that are used to configure the environment. The .gitignore file contains a list o...

lufthansa-aviation-training.com XSS vulnerability

Open Bug Bounty ID: OBB-664700 Description| Value ---|--- Affected Website:| lufthansa-aviation-training.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...