Logic flaw vulnerabilities in the public resources trading e-service system

Beijing Zhulong Information Technology Co., Ltd. is a high-tech enterprise focusing on the field of electronic bidding and procurement. A logic flaw vulnerability exists in the public resource transaction electronic service system. Attackers can utilize the vulnerability to bypass the...

4 Steps to Container Lifecycle Security

Containers and Kubernetes have revolutionized developing, deploying, and scaling applications and infrastructure. Learn best practices for security across the container lifecycle, so you can guard your containers against attack...

Improve error handling in commits page and REST endpoint

Adding a trail "%27" at the commits page URL in Bitbucket causes the application to output the error below. !screenshot-1.png|thumbnail! This error is improper error handling as it shows the path to the git executable in the server as well as it exceeds the limits of the error page and does not...

Huawei Data Communication: Configuring the Function of Checking DHCP Renewal Packet Attacks

This function is used to prevent attackers from attacking the DHCP server by sending forged DHCP packets for extending the lease. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Inside Microsoft Threat Protection: Correlating and consolidating attacks into incidents

Cybersecurity incidents are never contained to just one of your organization’s assets. Most attacks involve multiple elements across domains, including email, endpoints, identities, and applications. To rapidly understand and address incidents, your Security Operations Center SOC analysts need to...

OPENSUSE-SU-2020:0694-1 Security update for openconnect

This update for openconnect fixes the following issues: Security issue fixed: - CVE-2020-12105: Fixed the improper handling of negative return values from X509check function calls that might have allowed MITM attacks bsc1170452. This update was imported from the SUSE:SLE-15:Update update project...

Default configuration

Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker c...

SUSE-SU-2019:2820-2 Security update for dbus-1

This update for dbus-1 fixes the following issues: Security issue fixed: - CVE-2019-12749: Fixed an implementation flaw in DBUSCOOKIESHA1 which could have allowed local attackers to bypass authentication bsc1137832...

Input validation

The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a cssheroaction=editpage request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in th...

OPENSUSE-SU-2019:2268-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: OpenSSL Security Advisory 10 September 2019 CVE-2019-1547: Added ECGROUPsetgenerator side channel attack avoidance. bsc1150003 CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key bsc1150250 In addition fix...

How to Guide Users to Better Passwords by Learning from Attackers

If you’re human, you’ve probably re-used a password or two. In fact, the majority of internet users between the ages of 18-65 have done so, and the younger you are, the more likely it is that you use just one password for all of your accounts. Article written by: Chris LaConte, Chief Strategy...

OPENSUSE-SU-2019:1760-1 Security update for python-Twisted

This update for python-Twisted fixes the following issue: Security issue fixed: - CVE-2019-12387: Fixed an improper sanitization of URIs or HTTP which could have allowed attackers to perfrom CRLF attacks bsc1137825. This update was imported from the SUSE:SLE-15:Update update project...

Rockstar Games: Dom based xss on /reddeadredemption2/br/videos

In this report, the researcher identified a DOM-based XSS vulnerability affecting localized versions of the Red Dead Redemption 2 video viewer on our website, e.g. www.rockstargames.com/reddeadredemption2/br/videos. This affected all major modern browsers, and could have been used for cookie or...

Detecting bots using Content Security Policy (CSP) headers

Bots are noisy, like really. And dangerous as well, especially if they can do crawling and increase usage by legitimate operations like items catalog retrieve in the case of e-commerce. I mean, we have a lot of reasons to do not like bots and count this problem as a cybersecurity threat, which...

SUSE-SU-2018:3247-1 Security update for MozillaThunderbird

This update for MozillaThunderbird to version 60.2.1 fixes the following issues: Update to Thunderbird 60.2.1: Calendar: Default values for the first day of the week and working days are now derived from the selected datetime formatting locale Calendar: Switch to a Photon-style icon set for all...

Rockstar Games: Stored XSS on profile page via Steam display name

The researcher was able to demonstrate a XSS vulnerability by using their Steam nickname as the payload vector. This was due to insufficient filtering on Linked Account name fields. We pushed out an update that replaces suspicious Linked Account names with a generic string in order to prevent...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

SUSE-SU-2017:1675-1 Security update for xorg-x11-server

This update for xorg-x11-server provides the following fixes: - Remove unused function with use-after-free issue. bsc1025035 - Use arc4random to generate cookies. bsc1025084 - Prevent timing attack against MIT cookie. bsc1025029, CVE-2017-2624 - XDrawArc performance improvement. bsc1019649 -...

PT-2018-39: Cross-Site Scripting in SAP Business Warehouse Universal Data Integration

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in SAP Business Warehouse Universal Data Integration. A cross-site scripting XSS vulnerability in SAP Business Warehouse Universal Data Integration, due to insufficient encoding of user input, allow...

Decompression Bomb Testing

Decompression Bomb Testing A decompression bomb is a file designed to crash or render useless the program or system reading it, i.e. a denial of service. The files in this project can be used to test whether an application is vulnerable to this type of attack. A zip bomb, also known as a zip of...