FortiOS Security Configuration Bypass

The vulnerability of the FortiOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by using specially crafted SSL/TLS or HTTP traffic...

beaker-builder stored credentials in plain text

beaker-builder stored the Beaker password unencrypted on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system. beaker-builder now stores these credentials encrypted...

Google to Experiment 'DNS over HTTPS' (DoH) Feature in Chrome 78

Immediately after Mozilla announced its plan to soon enable 'DNS over HTTPS ' DoH by default for Firefox users in the United States, Google today says it is planning an experiment with the privacy-focused technology in its upcoming Chrome 78. Under development since 2017, 'DNS over HTTPS' perform...

Security Bulletin: Security Vulnerabilties exist in IBM Cognos Controller

Summary Security Vulnerabilities exist in IBM Cognos Controller. When performing security testing, you might encounter a "Missing Secure Attribute in Encrypted Session SSL Cookie" error message. IBM Cognos Controller versions 10.4.1, 10.4.0, 10.3.1 and 10.3.0, by default, do not have this setting...

Cisco Small Business RV160, RV260, RV340 Privilege Escalation

The vulnerability of the microprogramming software of Cisco Small Business RV160, Cisco Small Business RV260, and Cisco Small Business RV340 is related to the use of strictly encrypted passwords for user roles such as root, debug-admin, cisco, admin, and guest. Exploiting this vulnerability allow...

McAfee DLPe Agent 11.x < 11.1.210.32 / 11.2.x / 11.3.x < 11.3.2.8 Multiple Vulnerabilities (SB10295)

The version of the McAfee Data Loss Prevention Endpoint DLPe Agent installed on the remote Windows host is 11.x prior to 11.1.210.32, 11.2.x, or 11.3.x prior to 11.3.2.8. It is, therefore, affected by multiple vulnerabilities: - Buffer overflow in McAfee Data Loss Prevention DLPe for Windows 11.x...

Covenant - A .NET Command And Control Framework For Red Teamers

Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers. Covenant is an ASP.NET Core, cross-platform application that includes a...

CVE-2019-3634

Buffer overflow in McAfee Data Loss Prevention DLPe for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory...

CVE-2019-3634

Buffer overflow in McAfee Data Loss Prevention DLPe for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory...

Buffer overflow

Buffer overflow in McAfee Data Loss Prevention DLPe for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory...

CVE-2019-3634: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in McAfee Data Loss Prevention DLPe for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory...

PT-2019-16641 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: McAfee Data Loss Prevention DLPe for Windows versions prior to 11.3.2.8 Description: The issue allows a local user to cause the Windows operating system to crash via an encrypted message sent to DLPe, which when decrypted results in DLPe...

PT-2019-4374

Name of the Vulnerable Software and Affected Versions HiSuite versions 9.1.0.305 and earlier HiSuite MAC versions 9.1.0.305 and earlier HwBackup versions prior to 9.1.1.308 Description The issue is related to a brute forcing vulnerability in encrypted backup data. This allows an attacker to obtai...

CVE-2018-14062

The COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages, conduct denial of service attacks, and send private messages unrelated to distress alerts via a crafted 406 MHz digital signal...

Code injection

The COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages, conduct denial of service attacks, and send private messages unrelated to distress alerts via a crafted 406 MHz digital signal...

CVE-2018-14062

Technical details about CVE-2018-14062 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2018-14062

The COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages, conduct denial of service attacks, and send private messages unrelated to distress alerts via a crafted 406 MHz digital signal...

The Hidden Bee infection chain, part 1: the stegano pack

About a year ago, we described the Hidden Bee miner delivered by the Underminer Exploit Kit. Hidden Bee has a complex and multi-layered internal structure that is unusual among cybercrime toolkits, making it an interesting phenomenon on the threat landscape. That's why we're dedicating a series o...

CVE-2019-9506

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks aka "KNOB" that can decrypt traffic and inject arbitrary...

CVE-2019-12806

UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, due to a buffer overflow in a library. That leads remote attacker to execute arbitrary code via crafted https packets...