10309 matches found
CVE-2018-10919
The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions...
Kerberos Tickets on Linux Red Teams
At FireEye Mandiant, we conduct numerous red team engagements within Windows Active Directory environments. Consequently, we frequently encounter Linux systems integrated within Active Directory environments. Compromising an individual domain-joined Linux system can provide useful data on its own...
Making it easier for your remote workforce to securely access all the apps they need, from anywhere
Since I published my last blog, Five identity priorities for 2020, COVID-19 has upended the way we work and socialize. Now that physical distancing has become essential to protect everyone’s health, more people than ever are going online to connect and get things done. As we all adjust to a new...
CVE-2019-19912
In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting XSS vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arbitrary scripts via an active script embedded in an SWF file...
Ninja - Open Source C2 Server Created For Stealth Red Team Operations
Ninja C2 is an Open source C2 server created by Purple Team to do stealthy computer and Active directoty enumeration without being detected by SIEM and AVs , Ninja still in beta version and when the stable version released it will contains many more stealthy techinques and anti-forensic to create...
Active Defense Bypass Vulnerability in the Core Component of SmartMass Endpoint Security
Wisdom Terminal Security, Wisdom Terminal Security is a computer system security and protection software newly developed in 2018. There is an active defense bypass vulnerability in the core component of Wise Terminal Security, which can be exploited by attackers to construct malformed PE samples...
KB4537813: Windows 7 and Windows Server 2008 R2 February 2020 Security Update
The remote Windows host is missing security update 4537813 or cumulative update 4537820. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who...
KB4537822: Windows Server 2008 February 2020 Security Update
The remote Windows host is missing security update 4537822 or cumulative update 4537810. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the Windows Common Log File System CLFS driver when it fails to properly handle objects in memory. ...
XenMobile - Moving from LDAP to LDAPS
I am planning to turn on LDAPS on our XenMobile servers in the DMZ. We are being sure to open port 636 from our firewall to allow proper LDAPS traffic to flow. I understand there is one additional step to be performed prior to making the switch. I believe I need to export the root certificate fro...
CVE-2020-10678
In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate privileges...
CVE-2020-10678
In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate privileges...
Design/Logic Flaw
In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate privileges...
CVE-2020-10678
In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate privileges...
Trend Micro Fixes Critical Flaws Under Attack
Trend Micro has released security updates patching five vulnerabilities in its endpoint security solutions, Apex One and OfficeScan XG for Windows. Specifically, Apex One 2019 and OfficeScan XG SP1 and XG are affected by four critical-severity and one high-severity flaws. Two of these...
Trend Micro Fixes Critical Flaws Under Attack
Trend Micro has released security updates patching five vulnerabilities in its endpoint security solutions, Apex One and OfficeScan XG for Windows. Specifically, Apex One 2019 and OfficeScan XG SP1 and XG are affected by four critical-severity and one high-severity flaws. Two of these...
Intel Active Management Technology, Intel Small Business Technology, and Intel Standard Manageability Escalation of Privilege
Summary: There is an escalation of privilege vulnerability in Intel® Active Management Technology AMT, Intel® Standard Manageability ISM, and Intel® Small Business Technology versions firmware versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 that can allow an unprivileged attacker to gain...
March 17, 2020—KB4541333 (OS Build 17134.1399)
None None...
shuffleDNS - Wrapper Around Massdns Written In Go That Allows You To Enumerate Valid Subdomains
shuffleDNS is a wrapper around massdns written in go that allows you to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard handling and easy input-output support. Based on the work on massdns project by @blechschmidt. Features Simple and modular code ba...
D Shield of Shenzhen DiYuan Technology Co., Ltd. suffers from webshell bypass vulnerability (CNVD-2020-23537)
D ShieldFirewall is an active defense protection software designed for IIS. D-Shield has a webshell bypass vulnerability, which can be exploited by attackers to bypass detection and gain access to the control privileges of the target server...
