HackerOne: Changing Victim's JIRA Integration Settings Through Multiple Bugs

Summary: Changing victim's JIRA integration settings through multiple bugs. Description: Using multiple HackerOne bugs, an attacker can change the victim's JIRA integration settings. Bugs: 1 The Jira integration consent screen lacks information about the Jira project that will be connected to...

Jenkins unauthorized code execution vulnerability analysis-vulnerability warning-the black bar safety net

A, summary CloudBees Jenkins 2.32.1 version exists in Java deserialization vulnerability, and ultimately can lead to remote code execution. Jenkins is a continuous integration continuous integration and continuous delivery system, can improve the software development process of the Central Africa...

Mapbox: Node modules path disclosure due to lack of error handling

On May 2nd, 2017 @apapedulimu reported an issue where changing a POST request to a GET request on one of our integration servers returned a full error stack trace rather than an HTTP 404 error. The full error stack trace revealed the full path of the Node.js modules directory on the integration...

Oracle Primavera Gateway Remote Vulnerability

Oracle Primavera Products Suite is Oracle's suite of portfolio management solutions, of which Primavera Gateway is an extensible, lightweight framework for application integration. A security vulnerability exists in the Primavera Desktop Integration subcomponent of the Primavera Gateway component...

Oracle PeopleSoft Enterprise PeopleTools Denial of Service Vulnerability

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle Corporation, and PeopleSoft Enterprise PeopleTools is one of the tools and technology components that transforms the way organizations manage, use, and maintain their PeopleSoft software. PeopleSoft...

Qualys Support for Reserve Bank of India (RBI) Cyber Security Guidelines

Reserve Bank of India RBI, India's central banking and monetary authority, points out that the number, frequency, and impact of cyber incidents on Indian banks has increased substantially. Like their peers globally, Indian banks are committed to maintaining customer trust, protecting financial...

Targeted WPA2-Enterprise Evil Twin Attacks: eaphammer

Targeted WPA2-Enterprise Evil Twin Attacks EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on providing an easy-to-use interface that...

How to Integrate StoreFront and XenMobile when XenMobile is enabled with Domain and Certificate Based Authentication

This article will guide you with the steps to enable XenMobile server and StoreFront Server integration when XenMobile environment is enabled withCertificate + Domain based authentication. To achieve the above use case, you as an admin need to setup the following. 1. Configure/Enable XenMobile...

Oracle Primavera Gateway Remote Vulnerability (CNVD-2017-06627)

Oracle Primavera Products Suite is Oracle's suite of portfolio management solutions, of which Primavera Gateway is an extensible, lightweight framework for application integration. A security vulnerability exists in the Primavera Desktop Integration subcomponent of the Primavera Gateway component...

CVE-2017-3548

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Integration Broker. Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2017-3548

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Integration Broker. Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2017-3508

Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite subcomponent: Primavera Desktop Integration. Supported versions that are affected are 1.0, 1.1, 14.2, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows high privileged attacker with network acce...

EUVD-2017-12668

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Integration Broker. Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2017-3548

The CVE-2017-3548 issue affects Oracle PeopleSoft Enterprise PeopleTools (subcomponent Integration Broker) with affected versions 8.54 and 8.55. It is an XML External Entity (XXE) vulnerability in the PeopleSoftServiceListeningConnector that allows an unauthenticated remote attacker, over HTTP, t...

CVE-2017-3548

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Integration Broker. Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2016-4459

Stack-based buffer overflow in native/modmanager/node.c in modcluster 1.2.9...

Scheduler Workbench Integration - Critical - Unsupported - SA-CONTRIB-2017-39

Updates 20170414 - A new module maintainer has been found and a new release for this module has been published. Provides integration between the Scheduler module and the Workbench Moderation module. The security team is marking this module unsupported. There is a known security issue with the...

Microsoft Windows Monthly Rollup (KB4015551)

This host is missing a monthly rollup according to Microsoft KB4015551. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Kong and Wallarm Partner Up to Boost Microservices API Security

Wallarm has partnered with Mashape to provide the microservices community with API security. Mashape enterprise customers who use Kong API gateway can now quickly add API security protection without change in Kong user’s deployment. Read more about Kong and Wallarm partnership in this blog. Today...

CSRF in Facebook/Dropbox - "Mallory added a file using Dropbox"

tl;dr Facebook Groups offers the option to upload files directly from the Dropbox account. This integration is done using the OAuth 2.0 protocol and suffered from a variant of the classic OAuth CSRF defined by Egor Homakov as the the Most Common OAuth2 Vulnerability, see video below: Introduction...