CVE-2017-7422

Reflected and stored Cross-Site Scripting XSS, CWE-79 vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms CWE-693 and other...

Automated Android Malware Analysis: CuckooDroid

CuckooDroid is an extension of Cuckoo Sandbox the Open Source software for automating analysis of suspicious files. CuckooDroid brigs to cuckoo the capabilities of execution and analysis of android application. CuckooDroid is an automated, cross-platform, emulation and analysis framework based on...

A Leader for Four Consecutive Years in the Gartner Magic Quadrant for WAFs

Gartner has published their 2017 Magic Quadrant for Web Application Firewalls WAF and Imperva has again been named a WAF leader—now for four consecutive years. Attacks remain same, but infrastructure is changing According to 2017 Verizon Data Breach Investigations Report, web app attacks remain t...

Adding Security to Your Managed Services Offering

Over the years Trend Micro has collaborated with and learned from a variety of MSPs. Today’s threat landscape is continuously evolving, becoming more complex and sophisticated than it was even a year ago. For MSPs to rely on a single solution is not practical or in the best interest of their...

August 7, 2017—KB4038220 (OS Build 14393.1537)

None None...

WebKit: use-after-free in WebCore::AccessibilityRenderObject::handleAriaExpandedChanged(CVE-2017-7043)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector simply opening the...

Continental AG Infineon S-Gold 2 (PMB 8876)

CVSS v3 8.8 ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available. Vendor: Continental AG Equipment: Infineon S-Gold 2 PMB 8876 Vulnerabilities: Stack-Based Buffer Overflow, Improper Restriction of Operations within the Bounds of a Memory Buffer AFFECTED PRODUC...

WebKit WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free

WebKit: use-after-free in WebCore::AccessibilityNodeObject::textUnderElement CVE-2017-7048 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug...

WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function go li.hidden = true; dir.setAttribute"aria-labeledby", "map"; !-- ================================================================= ASan log: ================================================================= ==728==ERROR:...

WebKit - 'WebCore::AccessibilityRenderObject::handleAriaExpandedChanged' Use-After-Free

div visibility: collapse function eventhandler document.execCommand"bold", false; img.style.removeProperty"-webkit-appearance"; img.setAttribute"aria-expanded", "false"; aaa !-- ================================================================= ASan log:...

WebKit - WebCore::AccessibilityRenderObject::handleAriaExpandedChanged Use-After-Free Exploit

Exploit for multiple platform in category dos / poc div visibility: collapse function eventhandler document.execCommand"bold", false; img.style.removeProperty"-webkit-appearance"; img.setAttribute"aria-expanded", "false"; aaa !-- =================================================================...

Hardentools - Utility that disables a number of risky Windows features

Hardentools is a collection of simple utilities designed to disable a number of "features" exposed by operating systems Microsoft Windows, for now, and primary consumer applications. These features, commonly thought for Enterprise customers, are generally useless to regular users and rather pose ...

Windows Defender Antivirus cloud protection service: Advanced real-time defense against never-before-seen malware

For cybercriminals, speed is the name of the game. It takes newly released malware an average of just four hours to achieve its goal—steal financial information, extort money, or cause widespread damage. In a recent report, the Federal Trade Commission FTC said that cybercriminals will use hacked...

Keeping up with the Petyas: Demystifying the malware family

Last June 27, there was a huge outbreak of a Petya-esque malware with WannaCry-style infector in the Ukraine. Since there is still confusion about how exactly this malware is linked to the original Petya, we have prepared this small guide on the background of the Petya family. The origin of Petya...

openSUSE Security Update : libreoffice (openSUSE-2017-807)

LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements : Writer : - New 'Go to Page' dialog for quickly jumping to another page. - Support for 'Table Styles'. - New drawing tools were added. - Improvements in the toolbar. - Borderless padding is displayed. Calc : - New...

SUSE SLED12 Security Update : libreoffice (SUSE-SU-2017:1821-1)

LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements: Writer : - New 'Go to Page' dialog for quickly jumping to another page. - Support for 'Table Styles'. - New drawing tools were added. - Improvements in the toolbar. - Borderless padding is displayed. Calc : - New...

SUSE-SU-2017:1821-1 Security update for libreoffice

LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements: Writer: - New 'Go to Page' dialog for quickly jumping to another page. - Support for 'Table Styles'. - New drawing tools were added. - Improvements in the toolbar. - Borderless padding is displayed. Calc: - New...

Windows NSA Information Assurance: Locklevel

Windows NSA Information Assurance LOCKLEVEL was a rapidly built prototype that demonstrates a method for scoring how well Windows systems have implemented some of the NSA Information Assurance top 10 mitigation strategies . This prototype is being shared to encourage industry adoption of these...

DoD Secure Host Baseline

NSA Information Assurance configuration guidance and files in support of the DoD Secure Host Baseline The Secure Host Baseline SHB provides an automated and flexible approach for assisting the DoD in deploying the latest releases of Windows 10 using a framework that can be consumed by organizatio...

BSA-2017-320

Security Advisory ID : BSA-2017-320 Component : Intel Active Mgmt Technology Revision : 1.0: Interim There is an escalation of privilege vulnerability in Intel® Active Management Technology AMT, Intel® Standard Manageability ISM, and Intel® Small Business Technology versions firmware versions 6.x...