Top 5 Essential Features of Effective Cybersecurity for Web Apps

There's hardly any business nowadays that don't use computers and connect to the Internet. Companies maintain an online presence through their official websites, blogs, and social media pages. People use online services to conduct day to day activities like banking. And of course, there are many...

Unspecified Vulnerability in Ivanti Workspace Control

Ivanti Workspace Control RES One Workspace is a set of workspace control software from Ivanti, USA. The software includes features such as user management, application management and report management. A security vulnerability exists in Ivanti Workspace Control versions prior to 10.3.180.0. A loc...

CVE-2019-19675

In Ivanti Workspace Control before 10.3.180.0. a locally authenticated user with low privileges can bypass Managed Application Security by leveraging an unspecified attack vector in Workspace Preferences, when it is enabled. As a result, the attacker can start applications that should be blocked...

Authentication flaw

In Ivanti Workspace Control before 10.3.180.0. a locally authenticated user with low privileges can bypass Managed Application Security by leveraging an unspecified attack vector in Workspace Preferences, when it is enabled. As a result, the attacker can start applications that should be blocked...

CVE-2019-19675

In Ivanti Workspace Control before 10.3.180.0. a locally authenticated user with low privileges can bypass Managed Application Security by leveraging an unspecified attack vector in Workspace Preferences, when it is enabled. As a result, the attacker can start applications that should be blocked...

The authentication system’s vulnerability for web applications related to incorrect authorization allows attackers to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of the authentication system for web applications provided by LemonLDAP::NG stems from improper authorization conditions. This occurs when the relay party using OIDC has weaker access control rules than the target RP, and there is no URI filtering. Exploiting this vulnerability...

Telerik UI for ASP.NET AJAX RadChart Path Traversal Vulnerability

Telerik UI for ASP.NET AJAX is an HTML editor. RadChart is one of the charting components. A path traversal vulnerability exists in RadChart in Telerik UI for ASP.NET AJAX. The vulnerability stems from a failure of a network system or product to properly filter special elements in the path of a...

GitLab Doles Out Half a Million Bucks to White Hats

GitLab has awarded a total of $565,650 in security bug bounties to 171 researchers who reported valid vulnerabilities in the past year — and has announced the winners of its latest hacking contest. GitLab, which started out as a web-based Git repository manager before moving into the DevOps...

CVE-2019-13943

CVE-2019-13943 affects Siemens EN100 Ethernet Module variants (DNP3, IEC61850

CVE-2019-19018

TitanHQ WebTitan (before 5.18) is affected. The issue exposes a database configuration file under /include/dbconfig.ini via the web administration interface, revealing which database backend the web application uses. The vulnerability is a information disclosure in the admin interface. Exploitati...

CVE-2019-14906

A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. A heap-based buffer overflow flaw, in SDL while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application tha...

peoplewithpets.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1021475 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting peoplewithpets.com websit...

CVE-2019-18793

CVE-2019-18793 affects Parallels Plesk Panel 9.5 with a stored/reflected XSS in target/locales/tr-TR/help/index.htm? via the fileName parameter. The issue is a cross-site scripting flaw in that specific page, allowing injected script to be treated as part of the web page. Several connected source...

centerpetrova.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1012078 Security Researcher g0bl1nsec Helped patch 3741 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting centerpetrova.com website...

Microsoft Cloud Security solutions provide comprehensive cross-cloud protection

The infrastructure, data, and apps built and run in the cloud are the foundational building blocks for a modern business. No matter where you are in your cloud journey, you likely utilize every layer of the cloud—from infrastructure as a service IaaS to platform as a service PaaS to software as a...

Denial Of Service (DoS)

markdown-it is vulnerable to denial of service. The parsing of a malicious string such as multiple results in quadratic processing time, which could potentially be abused to cause a denial of service condition in the application...

Further enhancing security from Microsoft, not just for Microsoft

Legacy infrastructure. Bolted-on security solutions. Application sprawl. Multi-cloud environments. Company data stored across devices and apps. IT and security resource constraints. Uncertainty of where and when the next attack or leak will come, including from the inside. These are just a few of...

Intelligent Security System SecurOS Enterprise 10.2 - 'SecurosCtrlService' Unquoted Service Path

Exploit Title: Intelligent Security System SecurOS Enterprise 10.2 - 'SecurosCtrlService' Unquoted Service Path Discovery Date: 2019-10-28 Exploit Author: Alberto Vargas Vendor Homepage: https://www.issivs.com/product-detail/secure-os-enterprise/ Software Link:...

Part-DB 0.4 Authentication Bypass

Exploit Title: Part-DB 0.4 - Authentication Bypass Date: 2019-10-26 Author: Marvoloo Vendor Homepage: https://github.com/Part-DB/Part-DB/ Software Link: https://github.com/Part-DB/Part-DB/archive/master.zip Version: 0.4 Tested on: Linux CVE : N/A Discription: Easy authentication bypass...

Amazon Linux 2 : SDL2 (ALAS-2019-1318)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer SDL 2.0.9. There is an out-of-bounds read in the function SDLInvalidateMap at video/SDLpixels.c.CVE-2019-12222 A heap-based buffer overflow was discovered in SDL in the SDLBlitCopy function, that was called while copying an existing...