Moderate: Red Hat Security Advisory: openstack-aodh security update

An update for openstack-aodh is now available for Red Hat OpenStack Platform 11.0 Ocata. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Gojdue Variant Eludes Microsoft, Google Cloud Protection, Researchers Say

Researchers have identified a new ransomware strain that went undetected by built-in anti-malware protection used by cloud heavyweights Microsoft and Google as recently as January. According to researchers at the cloud service firm Bitglass, both Google Drive and Microsoft Office 365’s SharePoint...

as-immobilier.fr XSS vulnerability

Open Bug Bounty ID: OBB-554286 Description| Value ---|--- Affected Website:| as-immobilier.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-1196

Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the "runuser" to overwrite and...

PT-2018-17450

Name of the Vulnerable Software and Affected Versions Kaspersky Secure Mail Gateway version 1.1 Description The issue is related to configuration file injection, which can lead to code execution as root. Recommendations For Kaspersky Secure Mail Gateway version 1.1, update to a version that fixes...

ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)

Exploit for multiple platform in category web applications Multiple vulnerabilities in ManageEngine EventLog Analyzer Discovered by Pedro Ribeiro email protected, Agile Information Security ========================================================================== Disclosure: 05/11/2014 / Last...

CVE-2017-1000433: Improper Authentication

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password...

Two Sides App has an override access vulnerability

Two Sides APP is an emotional, psychological and fun social software launched by Beijing Two Sides Network Technology Co. Two Sides APP 3.0.28 Android version has an override access vulnerability, after logging in to the system, an attacker can log in to other users' systems and perform...

UBUNTU-CVE-2017-17855

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars...

Romanian Police Arrest 5 People for Spreading CTB Locker and Cerber Ransomware

Romanian police have arrested five individuals suspected of infecting tens of thousands of computers across Europe and the United States in recent years by spreading two infamous ransomware families—Cerber and CTB Locker. Under Operation Bakovia—a major global police operation conducted by Europo...

wildPwn - Brute forcer and shell deployer for WildFly (JBoss AS)

WildFly, formerly known as JBoss AS, or simply JBoss, is an application server authored by JBoss, now developed by Red Hat. WildFly is written in Java, and implements the Java Platform, Enterprise Edition Java EE specification. It runs on multiple platforms. WildFly is free and open-source...

12 Threats of Christmas

We've all heard the old classic, "The 12 Days of Christmas." While we all enjoy a good song about a partridge in a pear tree, Trend Micro has updated this seasonal standby, counting down the top threats to be aware of heading into 2018, from least to most pressing. Let's look at the vulnerabiliti...

PT-2017-3361

Name of the Vulnerable Software and Affected Versions Western Digital MyCloud PR4100 version 2.30.172 Description An issue in the web administration component allows for multipart upload functionality to be accessible without authentication. This is specifically related to the...

PT-2017-12499

Name of the Vulnerable Software and Affected Versions Cisco NX-OS System Software affected versions not specified Description A vulnerability in the patch installation process of Cisco NX-OS System Software could allow an authenticated, local attacker to write a file to arbitrary locations. This ...

Moderate: Red Hat Security Advisory: openstack-aodh security update

An update for openstack-aodh is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2017-11876

Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delet...

Excerpts from The Ransomware Economy: Projections

Carbon Black recently published an investigative report on the Dark Web marketplace for ransomware. This is the final excerpt from that report, which you can find here. For more information about the rise of ransomware, and what you can do about it, check out the Ransomware Epidemic: Stop Bad...

as-1.co.jp XSS vulnerability

Vulnerable URL: http://www.as-1.co.jp/rental/detail.php?id=13'" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 78254 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|---...

as-seen-on-tv-compare.com XSS vulnerability

Open Bug Bounty ID: OBB-382583 Description| Value ---|--- Affected Website:| as-seen-on-tv-compare.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventi...

ALPINE-CVE-2017-16227

The aspathput function in bgpd/bgpaspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service session drop via BGP UPDATE messages, because ASPATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message...