470 matches found
Cross site scripting
Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service a cloud-based service could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are du...
CVE-2017-12290
CVE-2017-12290 affects Cisco Registered Envelope Service web interface. The issue involves multiple XSS and URL-redirect vulnerabilities due to insufficient input validation, allowing unauthenticated, remote attackers to execute arbitrary script code or steal browser-based information by luring u...
CVE-2017-12320
Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service a cloud-based service could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are du...
CVE-2017-12291
The CVE-2017-12291 issue affects Cisco’s Cloud-based Cisco Registered Envelope Service web interface. The vulnerability set stems from insufficient validation of user-supplied input in the web-based management UI, enabling an unauthenticated, remote attacker to perform cross-site scripting (XSS) ...
CVE-2017-12291
Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service a cloud-based service could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are du...
CVE-2017-12321
Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service a cloud-based service could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are du...
CVE-2017-12292
Cisco Registered Envelope Service (cloud-based) web interface contains multiple cross-site scripting (XSS) vulnerabilities due to insufficient validation of user-supplied input. An unauthenticated, remote attacker could lure a user via a malicious link or crafted HTTP request to execute arbitrary...
CVE-2017-12320
Cisco Registered Envelope Service (web interface) contains multiple XSS vulnerabilities due to insufficient input validation. An unauthenticated, remote attacker could entice a user to click a crafted link or send a request to execute arbitrary script in the user’s browser or access browser-based...
CVE-2017-12292
Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service a cloud-based service could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are du...
CVE-2017-12323
The CVE-2017-12323 set concerns the Cisco Registered Envelope Service web interface. The connected documents confirm there are multiple XSS and redirect vulnerabilities in the service’s web UI due to insufficient validation of user-supplied input. Affected component: Cisco Registered Envelope Ser...
Implementing the CIS 20 Critical Security Controls: Slash Risk of Cyber Attacks by 85%
If a CISO needed to cut cyber attack risk by 85%, how would this security chief go about accomplishing that? Would the CISO even know where to begin? It’s safe to say that such a mandate would be considered daunting, and maybe even overwhelming. CISOs are scrambling to protect IT infrastructures...
Threatpost News Wrap Podcast for Nov. 10
Threatpost editors Mike Mimoso and Tom Spring discuss the week’s information security news, including Chris Valasek’s and Charlie Miller’s return to the security speaking rounds, a phony WhatsApp download pulled from Google Play, a deep dive into the recent cloud-based storage leaks, and the rece...
Carbon Black’s Vision for the Predictive Security Cloud
Earlier today, during a keynote address at Cb Connect, I unveiled our vision for the Cb Predictive Security Cloud™️. The first of its kind, the Cb Predictive Security Cloud is an extensible, cloud-based cyber security platform that helps anticipate and prevent future and unknown cyberattacks. The...
Gary McGraw on BSIMM8 and Software Security
Software security pioneer Gary McGraw talks to Mike Mimoso about the latest iteration of the Building Security In Maturity Model BSIMM report. BSIMM is a snapshot of how some of the world’s biggest tech companies and enterprises are handling secure development practices. Gary talks about some of...
Memory Corruption Vulnerability in 360 Antivirus
360 Antivirus is a free cloud-based security antivirus program. 360 Antivirus suffers from a memory corruption vulnerability. An attacker could exploit this vulnerability to cause the scanning engine to terminate, resulting in a denial of service...
The vulnerability of the rzpnk.sys driver, a IOCTL handler for configuring a cloud-based system, allows a hacker to open a descriptor for arbitrary processes.
The vulnerability of the rzpnk.sys driver, a IOCTL handler for configuring a cloud-based system, is related to deficiencies in access control for the ZwOpenProcess procedure. Exploiting this vulnerability allows a malicious actor to open a descriptor for an arbitrary process remotely...
FAQ: XenMobile Licensing Model
Question: What is difference between XenMobile MDM edition Licenses and Enterprise Edition Licenses? Answer: XenMobile MDM Edition Citrix XenMobile MDM edition is licensed under a per-user or per-device model. User licensing is based on how many unique users have registered devices on the...
New Dridex Phishing Campaign Delivers Fake Accounting Invoices
A new variant of the banking trojan Dridex is part of a sophisticated phishing attack targeting users of the cloud-based accounting firm Xero. The global campaign is the latest in what security experts at Trustwave said is a wave of phishing attacks against Xero and other financial and accounting...
An Established Solution for Mobile Threats
As much as smartphones and applications have evolved over the years, so has mobile malware. We’re seeing an increasing number of threats—from mobile ransomware and auto-clicking adware to dangerous backdoors that can compromise your privacy. And there are also legitimate personal applications tha...
Vision Critical Information Disclosure Vulnerability
Vision Critical is a cloud-based intelligent user management communication platform from Vision Critical Canada. A security vulnerability exists in versions of Vision Critical prior to 2014-05-30. An attacker could exploit the vulnerability to read arbitrary files...