PT-2021-2516 · Tor +4 · Tor +4

Name of the Vulnerable Software and Affected Versions: Tor versions prior to 0.4.5.7 Description: The issue allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target. This is related to an error in the resource consumption control mechanism of the Tor browser'...

Defending Democracies Against Information Attacks

To better understand influence attacks, we proposed an approach that models democracy itself as an information system and explains how democracies are vulnerable to certain forms of information attacks that autocracies naturally resist. Our model combines ideas from both international security an...

Practical advice for earning higher Microsoft bounty awards

This year at the Nullcon International Security Conference I shared practical advice for how security researchers can maximize the impact of their security vulnerability submissions and earn higher bounty awards under the Microsoft Bounty Program. For those who couldn’t be there, I had two core...

BBC Inside Out. Consumer advice for the ‘smart’ homeowner

We were recently asked to demonstrate security flaws in a smart home for the BBC Inside Out TV show. We’ve done this before, so what was different? This home was by far the most connected we had looked at. Typically, homes have a few smart devices; a smart thermostat, CCTV, maybe a doorbell and...

CVE-2018-17192

CVE-2018-17192 affects Apache NiFi where the X-Frame-Options headers were inconsistently applied on HTTP responses, leading to duplicate or missing security headers and potential clickjacking. The issue is documented across multiple sources, with mitigations indicating that a fix was applied in N...

Your Personal Data is Already Stolen

In an excellent blog post, Brian Krebs makes clear something I have been saying for a while: Likewise for individuals, it pays to accept two unfortunate and harsh realities: Reality 1: Bad guys already have access to personal data points that you may believe should be secret but which nevertheles...

Humble Bundle alerts customers to subscription reveal bug

You’ll want to check your mailbox if you have a Humble Bundle account, as they’re notifying some customers of a bug used to gather subscriber information. Click to enlarge The mail reads as follows: Hello, Last week, we discovered someone using a bug in our code to access limited non-personal...

Consumer Advice: Kids GPS tracker watch security

Parents are advised to rethink using GPS tracking watches for their children as a result of serious security concerns. Tracker watches can be worn by children and report their position to their parents via a mobile app. They are designed to increase child safety: you always know where your child...

online.advice.co.th XSS vulnerability

Open Bug Bounty ID: OBB-681619 Description| Value ---|--- Affected Website:| online.advice.co.th Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Threat Outbreak Alert RuleID33412: Email Messages Distributing Malicious Software on August 13, 2018

Medium Alert ID: 58692 First Published: 2018 August 14 17:55 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33412 may contain the following files: Name |...

How to Solve the Developer vs. Cybersecurity Team Battle

There is an ongoing tension between developers and security teams in many organizations. On one hand, developers face mounting pressure to build rich, feature-driven applications on nearly impossible timelines to remain competitive. On the other hand, security teams face rising pressures of their...

Threat Outbreak Alert RuleID33050: Email Messages Distributing Malicious Software on June 25, 2018

Medium Alert ID: 58291 First Published: 2018 June 25 19:17 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33050 may contain the following files: Name | Siz...

Security Bulletin: IBM Emptoris Sourcing is affected by open redirect vulnerability (CVE-2016-0329).

Summary IBM Emptoris Sourcing product-help system contains an open redirect vulnerability. Vulnerability Details CVEID: CVE-2016-0329 DESCRIPTION: IBM Emptoris Sourcing could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit...

Threat Outbreak Alert RuleID32965: Email Messages Distributing Malicious Software on June 13, 2018

Medium Alert ID: 58166 First Published: 2018 June 13 16:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32965 may contain the following files: Name | Siz...

Software Advice 1.0 Cross Site Scripting

Exploit Title: Reflected XSS at Software Advice Date: 27.05.2018 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.softwareadvice.com/ Software Link: Software Advice Website Version: 1.0 Tested on: Kali Linux Reflected XSS Payload : '-confirmIsmail Tasdelen-' HTTP REQUEST HEADER :...

Threat Outbreak Alert RuleID32715: Email Messages Distributing Malicious Software on May 8, 2018

Medium Alert ID: 57823 First Published: 2018 May 8 16:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32715 may contain the following files: Name | Size ...

Threat Outbreak Alert RuleID32372: Email Messages Distributing Malicious Software on April 4, 2018

Medium Alert ID: 57399 First Published: 2018 April 4 22:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32372 may contain the following files: Name | Siz...

citizensadvicebroxbourne.org XSS vulnerability

Open Bug Bounty ID: OBB-591569 Description| Value ---|--- Affected Website:| citizensadvicebroxbourne.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

citizensadvicebroxbourne.org XSS vulnerability

Open Bug Bounty ID: OBB-579766 Description| Value ---|--- Affected Website:| citizensadvicebroxbourne.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Threat Outbreak Alert RuleID31677: Email Messages Distributing Malicious Software on December 20, 2017

Medium Alert ID: 56310 First Published: 2017 December 20 21:00 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31677 may contain the following files: Name |...