openssh: scp client improper directory name validation

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side...

Tips to Accelerating PCI Data Security Standard Projects with Deep Security as a Service

Does your organization need to meet PCI DSS requirements? Are you struggling with multiple security tools? Or stretching your already overstretched team to prepare for an audit? Time to hit the accelerator with Trend Micro! If your applications deal with credit or payment card data, you need to g...

Google Android Framework Multiple Security Vulnerabilities

Description Google Android is prone to the following security vulnerabilities: 1. Multiple privilege-escalation vulnerabilities 2. Multiple information-disclosure vulnerabilities An attacker can exploit these issues to gain elevated privileges or gain access to sensitive information; this may...

Cisco Talos helps CISOs get back to basics with advisory series

At Cisco Talos, we try to build detections for every threat we see to provide customers with a portfolio capable of identifying and stopping threats at various stages of an attack's lifecycle. Deploying the best suite of layered security tools is an integral part of protecting an organization. Bu...

5 Places Where Hackers Are Stealthily Stealing Your Data In 2019

Skyrocketing data breaches bring incalculable losses to organizations and can cost cybersecurity executives their jobs. Here we examine the top five places in 2019 where cybercriminals are stealing corporate and government data without ever getting noticed and then learn how to avoid falling vict...

Xen CVE-2019-18425 Privilege Escalation Vulnerability

Description Xen is prone to a privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges, obtain sensitive information or cause denial-of-service conditions. Technologies Affected Citrix Hypervisor 8.0 Citrix XenServer 7.0 Citrix XenServer 7.1 LTSR CU2 Citr...

Xen CVE-2019-18424 Privilege Escalation Vulnerability

Description Xen is prone to a privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges on the affected system. Technologies Affected Citrix Hypervisor 8.0 Citrix XenServer 7.0 Citrix XenServer 7.1 LTSR CU2 Citrix XenServer 7.6 Xen Xen 3.2.0 Xen Xen 3.2.1...

CVE-2019-4329

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209...

Input validation

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209...

The vulnerability of Check Point Security Gateway’s security gateway allows attackers to circumvent existing access restrictions and carry out spear-phishing attacks.

The vulnerability of Check Point Security Gateway relates to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions and carry out spear-phishing attacks...

CVE-2019-4329

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209...

CVE-2019-4329

CVE-2019-4329 affects IBM Security Guardium Big Data Intelligence (SonarG) 4.0. The issue arises from incomplete blacklisting in input validation, enabling bypass of application controls and potential impact to system integrity. Public sources (IBM advisory) confirm affected version 4.0 and provi...

Firefox DNS over HTTPS (DoH) and Enterprise Threat Protector

Recursive DNS communications are normally unencrypted between a client and a resolver. In an effort to improve user privacy and address security concerns, Mozilla announced it would begin enabling DNS over HTTPS DoH by default in its Firefox browser. However, Mozilla recognized it would be...

UniCredit Bank Suffers 'Data Incident' Exposing 3 Million Italian Customer Records

UniCredit, an Italian global banking and financial services company, announced today that it suffered a security incident that leaked some personal information belonging to at least 3 million of its domestic customers. Officially founded in 1870, UniCredit is Italy's biggest banking and financial...

Cisco Finesse Appliance Directory Read Information Disclosure Vulnerability (Cisco-SA-20130812-CVE-2013-3457)

According to its self-reported version, the Cisco Finesse appliance is affected by an information disclosure vulnerability due to insufficient access controls. An unauthenticated, remote attacker can exploit this, via a URL point to the open directory, to disclose potentially sensitive informatio...

PT-2019-14903 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized id variable in the file appaccess controlsaccess control nodes.php, which is reflected in HTML. This leads to a cross-site scripting XSS issue, allowi...

PT-2019-3598 · Oracle · Oracle Hospitality Res 3700

Name of the Vulnerable Software and Affected Versions: Oracle Hospitality RES 3700 version 5.7 Description: The issue is related to insufficient access controls in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. It allows a remote attacker to gain full control...

Open-Xchange OX App Suite SSRF / XSS / Information Disclosure / Access Controls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs appsuite, dovecot, powerdns at HackerOne. Yours sincerely...

X (Formerly Twitter): [Bypass fixed #664038 and #519059] Application settings change settings that have been set by the user

I have reported this bug in report 681361 so that you make a FULL fix, but you refused considered duplicate and I have to wait for report 664038 to be resolved, now I come again to report the bug. The settings for "protected tweets" that have been set from another application accidentally change...

CVE-2017-2664

CloudForms lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails applications portion of CloudForms to escalate privileges...