CVE-2019-14749

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV aka Formula injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and...

CVE-2019-10099

CVE-2019-10099 affects Apache Spark deployments running versions prior to 2.3.3. In certain scenarios, Spark could write user data to local disk unencrypted despite spark.io.encryption.enabled=true. The issue encompasses cached blocks written to disk (controlled by spark.maxRemoteBlockSizeFetchTo...

Sponsored Podcast: The Operationalization of Data With a Purpose

Security, intel and fraud teams are swimming in data. Data is not the problem, but operationalizing and making use of the data we have is. This podcast is sponsored by SpyCloud Taking this one step further is making use of the data with a purpose, specifically, to interrupt the criminal lifecycle...

Nation-State Actors Go All-In on Mobile Malware

APTs, including a range of nation-state groups operating in China, North Korea, Pakistan and Russia, are shifting their malware development focus to target mobile users for intelligence gathering, financial gain and disruption of national rivals. That’s according to CrowdStrike’s Mobile Threat...

Windows Server 2008 End of Support: Are you Prepared?

On July 14th, 2015, Microsoft’s widely deployed Windows Server 2003 reached end of life after nearly 12 years of support. For millions of enterprise servers, this meant the end of security updates, leaving the door open to serious security risks. Now, we are fast approaching the end of life of...

IRS Reminds Tax Professionals: Create a Data Security Plan

The Internal Revenue Service IRS has issued a news release reminding professional tax preparers that they are required by law to have a written data security plan. Creating and maintaining a data security plan ensures that tax professionals are reviewing their data security protections and...

CVE-2019-2843

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications subcomponent: Infrastructure. Supported versions that are affected are 12.0.1, 12.0.3, 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0 and 14.1.0. Easily exploitable vulnerability allows low...

CVE-2019-2818

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 11.0.3 and 12.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful...

CVE-2019-2786

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

CVE-2019-13098

The CVE describes a password disclosure in TronLink Wallet 2.2.0 where the user password is logged during CreateWalletTwoActivity, allowing other authenticated apps/users with access to the device log (Logcat) to read it. The issue is tied to logging sensitive data and, on Android versions before...

Web Ofisi Platinum E-Ticaret 5 - q SQL Injection

Web Ofisi Platinum E-Ticaret 5 - q SQL Injection Exploit Title: Web Ofisi Platinum E-Ticaret 5 - 'q' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/platinum-e-ticaret-v5.html Demo Site: http://demobul.net/eticaretv5/ Version: v5 Tested on:...

CVE-2019-3741

Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 store a password in plaintext inside the Unity Data Collection bundle (logs). A local authenticated attacker with access to this bundle can use the exposed password to gain access with the compromised user’s privileges. The documents do ...

CVE-2019-1010084

CVE-2019-1010084 affects Dancer::Plugin::SimpleCRUD

Google Home Captures Porn and More, Unbeknownst to Users

Google Home smart speakers and the Google Assistant virtual assistant have been caught eavesdropping without permission — capturing and recording highly personal audio of domestic violence, confidential business calls — and even some users asking their smart speakers to play porn on their connect...

brusselsjazzweekend.be Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-885239 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting brusselsjazzweekend.be websit...

Marriott Hit With $123M Fine For Massive 2018 Data Breach

The U.K.’s privacy watchdog is hitting Marriott International with a $123 million £99 million penalty stemming from its 2018 data breach of more than 383 million guest records. The Tuesday fine is issued by the Information Commissioner’s Office ICO and comes only a day after the organization...

Dashboards to Use on Palo Alto Networks for Effective Management

Enterprises should expect to see more cyberattacks launched against them. The data that they now gather and store have made their infrastructures key targets for hackers. Customer data and intellectual property can be sold in the black market for profit, and sensitive information can also be used...

Rules-Based Policy Approaches Need to Go

Enterprises are making tremendous investments in their digital transformations, and no wonder: Increasingly, those who can more rapidly part from old, manual and antiquated ways of managing technology and shift to new ways of thinking will come out on top. That’s especially true when it comes to...

CVE-2017-9327

Technical details about CVE-2017-9327 are not publicly available in the provided documents; no affected products, versions, root cause, or mitigation are specified. Monitor for updates.

Beers with Talos Ep. #56 - Flatlined: Breach to Bankrupt

Beers with Talos BWT Podcast Ep. 56 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded 6/24/19 - Back in the studio for EP 56 and off the top, Matt got some new audio toy for his side hustle as a Twitch star...