Getting Better Together in Cybersecurity

As the wheels lift up on my latest flight I am left reflecting on another year in infosec. We are moving toward “something” and some days I can’t figure out if that something is disaster or safety. The tea leaves become hard to read with the cyber war that has been raging over into the mainstream...

Akamai India's StandTall Program

Diversity and Inclusion is a mission-critical goal at Akamai. In support of this goal, the India Learning and Development team in collaboration with the Women's Forum India employee resource group, launched an initiative that aims to foster a culture of...

Cisco Prime Collaboration Assurance Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

[SECURITY] Fedora 28 Update: tomcat-8.5.32-1.fc28

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

Security Competition Infrastructure Automation Framework: Laforge

Laforge enables rapid development of infrastructure for the purpose of information security competitions. Using a simple and intuitive configuration language, Laforge manages a dependency graph and state management and allows for highly productive remote collaboration. The Laforge engine uses a...

10 Endpoint Security Problems Solved by the Cloud – Getting The Help You Need

Last week we looked at how the cloud helps you respond quickly to threats. This week, we’re going to examine why the cloud outperforms traditional AV when it comes to getting the help you need. It's You vs. Them Once upon a time, viruses were produced by individual hackers who were more intereste...

Partner Perspectives: Attivo + Carbon Black Integration Delivers Advanced, Continuous Threat Management and Response

Joseph Salazar is the Technical Deception Officer for Attivo Networks. Cyber attackers have repeatedly proven that they can gain access to the networks of even the most security-savvy organizations. Whether the attacker finds their way in through the use of stolen credentials, zero-day...

Cisco Prime Collaboration Provisioning Denial of Service Vulnerability

Cisco Prime Collaboration Provisioning is the United States Cisco Cisco company's set of Web-based next-generation communications services software. The software provides IP communication service features for IP telephony, voice mail and unified communications environments. A security vulnerabili...

CVE-2018-0391

A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this...

Input validation

A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this...

CVE-2018-0391

The CVE-2018-0391 issue affects Cisco Prime Collaboration Provisioning (PCP) prior to 12.3, with the root cause being insufficient validation of a password-change request in the authentication flow. A remote attacker could cause the targeted device to become inoperable, resulting in a DoS conditi...

CVE-2018-0391

A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this...

CVE-2018-0391

A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this...

Cisco Prime Collaboration Provisioning Unauthorized Password Change Denial of Service Vulnerability

A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this...

Cisco Releases Security Update

Cisco has released a security update to address a vulnerability in Cisco Prime Collaboration Provisioning. A remote attacker could exploit this vulnerability to cause a denial-of-service condition. NCCIC encourages users and administrators to review the Cisco Security Advisory and apply the...

PT-2018-1529

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning versions 12.2 and prior Description A vulnerability in the password change function could allow an authenticated, remote attacker to cause the system to become inoperable due to insufficient validation of...

CVE-2018-0391: Improper Authorization

A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this...

Chaturbate: CSS Injection on /embed/ via bgcolor parameter leaks user's CSRF token and allows for XSS

Hi there, There's a CSS injection here: https://chaturbate.com/embed/admin/?bgcolor=%7D%7Bbackground:red&tour=nvfS&disablesound=0&campaign=iNSGX body, divmain, div.content, div.block, div.section margin: 0px; padding: 0px; body min-width:800px; div.content width: 100%; body background:...

Be like a Moomin: How to establish trust between competitors so we can fight cybercrime

Do you know the Moomins? They're a tight-knit, happy, collaborative cartoon family. I'd never heard of them until I was lucky enough to spend a few days at the Microsoft offices in Helsinki, Finland. The Moomin keychain in the photo was a gift from the Finnish CISO. As I did a little research int...

Xinhuo Collaboration Office v1.7.8 has an arbitrary file download vulnerability

Xinhuo Co-operation Office System is an open source and cross-platform office system. Xinhao Collaboration Office System v1.7.8 has an arbitrary file download vulnerability, which can be exploited by attackers to download sensitive files...