CVE-2020-10678

CVE-2020-10678 affects Octopus Deploy prior to 2020.1.5 when running with on-premises Active Directory linked to the Octopus server. The issue is an authenticated user privilege-escalation bug described across multiple sources (Red Hat, CNVD, NVD, etc.). The connected documents identify the affec...

SQL Injection Vulnerability in joyplus-cms ad***_vo***_to***.php File

joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . joyplus-cms advoto.php file contains a SQL...

Advanced Ads < 1.17.4 - Authenticated Reflected XSS via Admin Dashboard

The Advanced Ads – Ad Manager & AdSense WordPress plugin was affected by an Authenticated Reflected XSS via Admin Dashboard security vulnerability...

Trojan Raids Android Users' Cookie Jars

Everyone loves cookies – including cybercriminals. Their tastes however can run to a different sort of cookie, as evidenced by a fresh strain of Android malware that may be implanted prior to users purchasing a device. Appropriately dubbed “Cookiethief” by the Kaspersky researchers who discovered...

Trojan Raids Android Users' Cookie Jars

Everyone loves cookies – including cybercriminals. Their tastes however can run to a different sort of cookie, as evidenced by a fresh strain of Android malware that may be implanted prior to users purchasing a device. Appropriately dubbed “Cookiethief” by the Kaspersky researchers who discovered...

CVE-2020-10532

The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI...

CVE-2020-10532

The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI...

CVE-2020-10532

CVE-2020-10532 affects WatchGuard Fireware (AD Helper) prior to 5.8.5.10317. A remote attacker can obtain cleartext passwords via the /domains/list URI, as described in multiple connected sources. The vulnerability is due to how the AD Helper handles credential data, enabling plaintext password d...

CVE-2020-10532

The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI...

Work remotely, stay secure—guidance for CISOs

With many employees suddenly working from home, there are things an organization and employees can do to help remain productive without increasing cybersecurity risk. While employees in this new remote work situation will be thinking about how to stay in touch with colleagues and coworkers using...

Empower Firstline Workers with Azure AD and YubiKey passwordless authentication

At the end of February, Microsoft announced the FIDO2 passwordless support for hybrid environments. The integration of FIDO2-based YubiKeys and Azure Active Directory Azure AD is a game changer. It combines the ubiquity of Azure AD, the usability of YubiKey, and the security of both solutions to...

WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure

WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure Exploit: WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure Author: RedTeam Pentesting GmbH Date: 2020-03-11 Vendor: https://www.watchguard.com Software link:...

WatchGuard Fireware AD Helper 5.8.5.10317 Credential Disclosure

Exploit: WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure Author: RedTeam Pentesting GmbH Date: 2020-03-11 Vendor: https://www.watchguard.com Software link: https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdradhelperc.html CVE:...

SQL Injection Vulnerability in Joyplus CMS ad***_ap***.php File

Joyplus CMS Joy Video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . Joyplus CMS adap.php file has a SQL injection...

WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure Vulnerability

Exploit for java platform in category web applications Exploit: WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure Author: RedTeam Pentesting GmbH Vendor: https://www.watchguard.com Software link:...

SQL injection vulnerability in the P_sh*** parameter of the pr***_ad***.php page of the Ship 100 virtual goods auto-shipment system

Shipping 100 Virtual Goods Autoship System is a virtual goods autoship system/article pay to read system. Shipping 100 virtual goods auto-shipment system prad.php page Psh parameter SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

Quick wins—single sign-on (SSO) and Multi-Factor Authentication (MFA)

With Multi-Factor Authentication MFA and single sign-on SSO being a few of the most effective countermeasures against modern threats, organizations should consider a Cloud Identity as a Service IDaaS, and MFA solution, like Azure Active Directory AD. Here are seven benefits: 1. Azure AD is simple...

The Case for Limiting Your Browser Extensions

Last week, KrebsOnSecurity reported to health insurance provider Blue Shield of California that its Web site was flagged by multiple security products as serving malicious content. Blue Shield quickly removed the unauthorized code. An investigation determined it was injected by a browser extensio...

EulerOS 2.0 SP5 : samba (EulerOS-SA-2020-1131)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with 'log level = 3' or...

Google Bans 600 Android Apps from Play Store for Serving Disruptive Ads

Google has banned nearly 600 Android apps from the Play Store for bombarding users with disruptive ads and violating its advertising guidelines. The company categorizes disruptive ads as "ads that are displayed to users in unexpected ways, including impairing or interfering with the usability of...