CVE-2017-16126

The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. Source IP process.versions process.platform How the module was invoked test, require,...

[SECURITY] Fedora 28 Update: matrix-synapse-0.28.1-1.fc28

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...

Riccardo Di Blasio joins Wallarm as an advisor

We are excited to welcome Riccardo Di Blasio to Wallarm advisory team. Riccardo is a well known industry executive who brings his experience running go-to-market operations and managing business worldwide for large internationals like EMC Corp and VMware, including RSA Security. Riccardo’s...

Beauty Ecosystem Coin smart contract integer overflow vulnerability

Beauty Ecosystem Coin BEC is a virtual currency system based on blockchain technology by the Beauty Chain Foundation. smart contract is one of the smart contracts. An integer overflow vulnerability exists in the 'batchTransfer' function of the smart contract implementation in BEC. An attacker cou...

Securing the modern workplace with Microsoft 365 threat protection – part 1

This post is authored by Debraj Ghosh, Senior Product Marketing Manager, Microsoft 365 Security. The roots of Microsoft 365 threat protection Over the next few weeks, well introduce you to Microsoft 365s threat protection services and demonstrate how Microsoft 365s threat protection leverages...

Integer overflow

An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin BEC, the Ethereum ERC20 token used in the Beauty Chain economic system, allows attackers to accomplish an unauthorized increase of digital assets by providing two receivers arguments in...

VulnCheck KEV: CVE-2018-10299

An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin BEC, the Ethereum ERC20 token used in the Beauty Chain economic system, allows attackers to accomplish an unauthorized increase of digital assets by providing two receivers...

Recognizing Q3 Top 5 Bounty Hunters

Throughout the year, security researchers submit some amazing work to us under the Microsoft Bug Bounty program. Starting this quarter, we want to give a shout out to and acknowledge the hard work and dedication of the following individuals and companies who have contributed to securing Microsoft...

Oblivious DNS

Interesting idea: ...we present Oblivious DNS ODNS, which is a new design of the DNS ecosystem that allows current DNS servers to remain unchanged and increases privacy for data in motion and at rest. In the ODNS system, both the client is modified with a local resolver, and there is a new...

Connect to the Intelligent Security Graph using a new API

Most organizations deal with high volumes of security data and have dozens of security solutions in their enterprise, making the task of integrating various products and services daunting and complex. The cost, time, and resources necessary to connect systems, enable correlation of alerts, and...

Don’t Trust Android OEM Patching, Claims Researcher

Many Android device manufacturers are not telling the truth when they say they have patched phone vulnerabilities in new updates, researchers found. Karsten Nohl and Jakob Lell, researchers with Security Research Labs, told Threatpost they have tested the firmware on close to 3,000 phones and fou...

Popular Android Phone Manufacturers Caught Lying About Security Updates

Android ecosystem is highly broken when it comes to security, and device manufacturers better known as OEMs make it even worse by not providing critical patches in time. According to a new study, most Android vendors have been lying to users about security updates and telling customers that their...

Bitwarden: Tracking Bitwarden firefox addon users

Firefox web extension, generate a UUID for each web-extension and is specific to a user. Unlike chrome extensions. Which means whenever the user installs Bitwarden on Firefox, it generates a different extension ID for each user. You can check the extension ID by about:debugging - under extensions...

Security baselines should underpin efforts to manage cybersecurity risk across sectors

This post is authored byAngela McKay, Director of Cybersecurity Policy and Amanda Craig, Senior Cybersecurity Strategist, CELA. Organizations are leveraging technology to transform their operations, products, and services, and governments are increasingly focusing on how to enable such dynamic...

Node.js third-party modules: [buttle] HTML Injection in filename leads to XSS when directory listing is displayed in the browser

I would like to report HTML Injection in buttle module. Due to lack of filenames sanitization, it is possible to inject malicious iframe tag via filename and execute arbitray JavaScript code. Module module name: buttle version: 0.2.0 npm page: https://www.npmjs.com/package/buttle Module Descripti...

Carbon Black Elevated to CDW Emerging Gold Partner

I am proud to announce that CDW recently elevated Carbon Black from the “Silver” partner designation to “Emerging Gold!” This honor is a true testament to our growing partnership with CDW. It’s also a reflection of CDW’s continued commitment to endpoint security by leveraging Next-Generation...

Smart DNS Resolution for a Better Safer Internet

By Arlen Frew Top-level Domain TLD operators are focused on making the Internet a better and safer place, enabling name registrations, and maintaining the DNS namespace in support of their stakeholders. The entire Internet ecosystem, including TLDs, is always looking for ways to improve security...

The bundled Atlassian Application Links plugin had various XSS issues - CVE-2018-5227

The version of the bundled Atlassian Application Links plugin was vulnerable to XSS. See https://ecosystem.atlassian.net/browse/APL-1361 for more details...

Carbon Black’s Victor Baez Recognized as a 2018 CRN Channel Chief

CRN®, a brand of The Channel Company, has named Victor Baez, Vice President, WW Channels of Carbon Black, to its prestigious list of 2018 Channel Chiefs. The executives on this annual list represent top leaders in the IT channel who excel at driving growth and revenue in their organization throug...

Node.js third-party modules: [file-static-server] Path Traversal allows to read content of arbitrary file on the server

Hi Guys, There is Path Traversal vulnerability in file-static-server module, which allows to read arbitrary file from the remote server. Module file-static-server no description provided https://www.npmjs.com/package/file-static-server version: 1.0.2 Stats 0 downloads in the last day 3 downloads ...