298 matches found
Security Bulletin: Open Redirection in IBM Tivoli Federated Identity Manager (CVE-2014-3097)
Summary In certain cases, IBM Tivoli Federated Identity Manager does not handle end user provided data before using that data to construct an HTTP redirect request. Vulnerability Details CVE ID: CVE-2014-3097 DESCRIPTION: In certain cases, IBM Tivoli Federated Identity Manager does not correctly...
First things first: Envisioning your security deployment
This blog post is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 Security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog...
October CMS User Plugin 1.4.5 - Persistent Cross-Site Scripting
Exploit Title: October CMS User Plugin v1.4.5 - Persistent Cross-Site Scripting Date: 2018-04-03 Author: 0xB9 Software Link: https://octobercms.com/plugin/rainlab-user Version: 1.4.5 Tested on: Ubuntu 17.10 CVE: CVE-2018-10366 1. Description: Front-end user management for October CMS. Allows...
Design/Logic Flaw
An issue was discovered in the Users aka Front-end user management plugin 1.4.5 for October CMS. XSS exists in the name field...
CVE-2018-0238
A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...
CVE-2018-0238
CVE-2018-0238 affects Cisco UCS Director; an attacker can log in with a modified username and valid password to gain visibility into and perform actions on any VM in the end-user portal. Root cause: improper user authentication checks in role-based resource checking; impact includes information d...
Cisco UCS Director Virtual Machine Information Disclosure Vulnerability for End User Portal
A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...
Measure What Matters: Your Competitive Advantage May Lie in Your Understanding (or Lack of Understanding) of What Users Are Really Experiencing
Attracting and retaining customers lies in your ability to offer an exceptional digital experience. Now that digital channels are increasingly preferred over channels of the past, the climate is increasingly competitive -- and businesses are fighting to maintain loyalty and keep users engaged...
iOS: Certain Public Apps cannot be installed
When adding a public app store XenMobile server, it fails to install through the Secure Hub store on the end user's devices. No installation prompt is presented to the user and no mention of the application can be seen in XCode logs...
Essays from 7 Experts on Moving to a Cloud-Based Endpoint Security Platform
Carbon Black recently published a series of essays about the experiences of experts in the field on information security as they moved their endpoint security program to the cloud; this is one of those essays. To read the full series check out 7 Experts on Moving to a Cloud-Based Endpoint Securit...
CVE-2015-5350
In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read file...
Gemalto SafeNet Authentication Service End User Software Tools for Windows Elevation of Privilege Vulnerability
Gemalto SafeNet Authentication Service End User Software Tools for Windows is a Windows-based SafeNet Authentication Service tool from Gemalto USA. A security vulnerability exists in SafeNet Authentication Service End User Software Tools for Windows that stems from the program's use of weak acces...
CVE-2015-7596
Technical details about CVE-2015-7596 are not publicly available in the provided documents; monitor for updates from official advisories and vendors.
CVE-2017-17947
A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure PCS before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure PPS before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL...
Improper access control
VMware AirWatch Console AWC contains a Broken Access Control vulnerability. Successful exploitation of this issue could result in end-user device details being disclosed to an unauthorized administrator...
CVE-2017-4942
The CVE-2017-4942 entry corresponds to VMware AirWatch Console (AWC) with a Broken Access Control vulnerability. The connected VMware advisory VMSA-2017-0020 confirms that successful exploitation could disclose end-user device details to an unauthorized administrator. The advisory documents that ...
CVE-2017-4942
VMware AirWatch Console AWC contains a Broken Access Control vulnerability. Successful exploitation of this issue could result in end-user device details being disclosed to an unauthorized administrator...
Configuring Citrix StoreFront with the Secure Browser Service
This article describes how existing on-premise XenApp/XenDesktop customers can integrate and deliver Secure Browser via their existing Storefronts to end users...
VMware AirWatch Console updates address Broken Access Control vulnerability.
VMware AirWatch Console AWC Broken Access Control VMware AirWatch Console AWC contains a Broken Access Control vulnerability. Successful exploitation of this issue could result in end-user device details being disclosed to an unauthorized administrator. The Common Vulnerabilities and Exposures...