Citrix App Layering 4: LayerPriority Utility

Please note: You can download the required file from the Citrix downloads website by visiting the following link:https://www.citrix.com/downloads/citrix-tools Introduction This utility is used to modify the layer priority of App layers. The documentation provided here includes an explanation of...

Citrix Diagnostics Toolkit - 64bit Edition

Citrix Diagnostic Toolkit x64 – C.D.T Citrix Diagnostic Toolkit x64 – C.D.T| Description| Important Notes about This Release ---|---|--- Citrix Tools Included| Prerequisites| Why does C.D.T. use an Installer Installing C.D.T.| Start Menu Integration| Tracing Options and Setup XenApp Tracing Optio...

Citrix Hypervisor Security Update

Description of Problem An issue has been discovered in Citrix Hypervisor that, if exploited, could potentially allow an attacker on the management network to enumerate valid administrative account usernames. Note that this attack does not disclose the corresponding passwords and does grant not...

CVE-2020-27122 Cisco Identity Services Engine Privilege Escalation Vulnerability

A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine ISE could allow an authenticated, local attacker to elevate privileges on an affected device. To exploit this vulnerability, an attacker would need to have a valid administrator account on an affected...

HackerOne: Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml

@nagli found a reflected Cross-Site Scripting XSS, Server-Side Request Forgery SSRF, and XML External Entity XXE vulnerability in a 3rd party vendor that was used by HackerOne. This system did not contain any data related to reports submitted and stored on hackerone.com. HackerOne worked with the...

HackerOne: Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io

@nagli found an open redirect vulnerability in a 3rd party vendor that was used by HackerOne. This system did not contain any data related to reports submitted and stored on hackerone.com. HackerOne worked with the vendor to remediate the vulnerability. The report is partially disclosed to...

CVE-2020-17510

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...

Cisco Identity Services Engine Elevation of Privilege Vulnerability

Cisco Identity Services Engine ISE is a next-generation identity and access control policy platform that enables organizations to enforce compliance, enhance infrastructure security, and streamline their service operations. An elevation of privilege vulnerability exists in the Microsoft Active...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2020-27122

A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine ISE could allow an authenticated, local attacker to elevate privileges on an affected device. To exploit this vulnerability, an attacker would need to have a valid administrator account on an affected...

Security Bulletin: IBM Integration Bus affected by multiple Apache Tomcat vulnerabilities (CVE-2020-13935)

Summary IBM Integration Bus ships Apache Tomcat which is susceptible to vulnerabilities which were reported and have been addressed. Vulnerability Details CVEID: CVE-2020-13935 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by improper validation of the payload length in ...

The vulnerability of the Kryo Codec component in the software platform for integrating corporate applications in Spring Integration allows a hacker to execute arbitrary code.

The vulnerability of the Kryo Codec component in the software platform for integrating corporate applications in Spring Integration is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Unspecified Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (CNVD-2020-59227)

Oracle PeopleSoft Enterprise PeopleTools provides a comprehensive set of development tools that support the development and runtime of PeopleSoft applications. A security vulnerability exists in the Integration Broker component in Oracle PeopleSoft Enterprise PeopleTools 8.56, 8.57, and 8.58. An...

The value of cybersecurity integration for MSPs

For modern Managed Service Providers MSPs, gone are the days of disparate workflows, and that’s really for the best. Imagine trying to run a successful MSP business today—finding potential customers, procuring new clients, developing purchase orders, managing endpoints, and sending invoices—all...

Security Bulletin: Apache CXF vulnerability identified in IBM Tivoli Application Dependency Discovery Manager (CVE-2020-1954)

Summary This security bulletin addresses the vulnerability in Open Source Apache CXF that affect IBM Tivoli Application Dependency Discovery Manager. Vulnerability Details CVEID: CVE-2020-1954 DESCRIPTION: Apache CXF is vulnerable to a man-in-the-middle attack, caused by a flaw in JMX Integration...

CVE-2020-14832

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Integration Broker. Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2020-14805

Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite component: Search Integration Engine. Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access...

CVE-2020-14832

CVE-2020-14832 affects Oracle PeopleSoft Enterprise PeopleTools (Integration Broker) on versions 8.56, 8.57, 8.58. The vulnerability allows an unauthenticated attacker with network access over HTTP to potentially modify or read data within PeopleTools, with the attack requiring user interaction. ...

CVE-2020-14811

CVE-2020-14811 affects Oracle E-Business Suite Applications Manager (AMP EBS Integration). Affected versions: 12.1.3 and 12.2.3–12.2.10. An unauthenticated attacker with network access over HTTP can read a subset of Oracle Applications Manager data. The CVSSv3.1 base score is 5.3 (Confidentiality...

Status.im: HTTP Parameter Pollution with semicolons in iframe allows loading external Greenhouse forms

Summary: Status.im uses Greenhouse for job applications, specifically the older Greenhouse integration which relies on iframes. The ghjid URL parameter is used to load the correct form in the iframe. HTML characters are escaped, but using semicolons you can inject URL parameters into the iframe v...