COSCO incident. Phishing frenzy and exploding goods?

If you haven’t seen the coverage, COSCO the world’s 4th largest shipping line has had a ransomware outbreak. Sounds terribly familiar, doesn’t it. One wonders why on earth they didn’t carry out a thorough review after the Maersk incident, so as to be rather better prepared. Phishing time Breaches...

Improper validation of data passed to JSON encoder (NC-SA-2018-006)

Improper validation of input allowed an attacker to not have their actions logged to the audit log...

WAScan v0.2.1 - Web Application Scanner

WAScan Web Application Scanner is a Open Source web application security scanner. It is designed to find various vulnerabilities using "black-box" method, that means it won't study the source code of web applications but will work like a fuzzer, scanning the pages of the deployed web application,...

Security Bulletin: Users of Helm with IBM Cloud Private can elevate their privileges (CVE-2018-1714)

Summary Users of Helm with IBM Cloud Private can elevate their privileges Vulnerability Details CVEID: CVE-2018-1714 DESCRIPTION: Any user who is authorized to deploy a Helm chart in IBM Cloud Private 2.1.0 can install an unsafe Helm Chart that can run with privileges greater than the Helm user i...

WordPress Strong Testimonials 2.31.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Advisory Title: WordPress Strong Testimonials Plugin Multiple XSS Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Strong Testimonials plugin Language: PHP Version: 2.31.4 and below Vendor Status:...

Open-AudIT Community 'Groups Page' Cross Site Scripting Vulnerability

Open-AudIT is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Snazzy Maps 1.1.3 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Advisory Title: WordPress Snazzy Maps Plugin Multiple XSS Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Snazzy Maps plugin Language: PHP Version: 1.1.3 and below Vendor Status: Vendor contacted, no...

XClarity Administrator (LXCA) API Vulnerabilities - US

Lenovo Security Advisory: LEN-22168 Potential Impact: Privilege escalation Severity: Critical Scope of Impact: Lenovo-specific CVE Identifier: CVE-2018-9064, CVE-2018-9065, CVE-2018-9066 Summary Description: A Lenovo internal product security audit has led to the discovery of access control...

Open-Audit Cross-Site Scripting Vulnerability (CNVD-2018-14230)

Open-AudIT is a network discovery and auditing program. The program intelligently scans networks and network devices and provides status reports.Open-AudIT Community is its community version. A cross-site scripting vulnerability exists in the Groups page in Open-Audit Community version 2.2.6. A...

WordPress Snazzy Maps 1.1.3 Cross Site Scripting

DefenseCode ThunderScan SAST Advisory: WordPress Snazzy Maps Plugin Multiple XSS Security Vulnerabilities Advisory ID: DC-2018-05-006 Advisory Title: WordPress Snazzy Maps Plugin Multiple XSS Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Snazzy Maps...

CVE-2018-14493

Cross-site scripting XSS vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name...

Cross site scripting

Cross-site scripting XSS vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name...

CVE-2018-14493

Cross-site scripting XSS vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name...

CVE-2018-14493

Cross-site scripting XSS vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name...

CVE-2018-14493

CVE-2018-14493: Open-AudIT Community 2.2.6 has a cross-site scripting (XSS) vulnerability in the Groups Page that allows injection of arbitrary script or HTML via the group name. The issue affects the Community edition and is detailed across multiple references (Open-AudIT 2.2.6 XSS). According t...

On Financial Fraud

There are some good lessons in this article on financial fraud: That's how we got it so wrong. We were looking for incidental breaches of technical regulations, not systematic crime. And the thing is, that's normal. The nature of fraud is that it works outside your field of vision, subverting the...

July 24, 2018—KB4338827 (OS Build 15063.1235)

None None...

Unable to join second StoreFront server after upgrade, with error "Error getting replication keys"

Follow are the symptoms: 1 StoreFront join operation fails with following error: 2 If we enable Audit for logon failure and success, you will observer following event on the Joiner: Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: XXXXXXXXXXXXXXXXXXX Event ID: 4625 Task...

Open-AudIT Community 2.1.1 - Cross-Site Scripting Vulnerability

Exploit for multiple platform in category web applications Exploit Title: Open-AudIT Community - 2.1.1 - Cross Site Scripting Vulnerability Google Dork:NA Exploit Author: Ranjeet Jaiswal Vendor Homepage: https://opmantek.com/ Software Link:http://dl-openaudit.opmantek.com/OAE-Win-x8664-...

CVE-2018-3071

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Audit Log. Supported versions that are affected are 5.7.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attack...