Phabricator: Administrator can create user without entering high security mode

When an administrator wants to create a user, he can go to https://phabricator.example.com/people/create/ and will be required to enter his MFA token in order to enter high security mode. However, if an administrator goes to https://phabricator.example.com/people/new/standard/ he will bypass the...

Who is doing what on your network?

Over the past few months, while talking to customers, the topic of Zero Trust Architecture keeps coming up. Seemingly everyone is thinking of implementing the model - which we fully encourage! One of the core components of the principle is the ability to inspect and log all network and system...

Akamai and Duo have announced a technology partnership for Zero Trust

Akamai continues to build a zero trust ecosystem by integrating it's Enterprise Application Access EAA with Duo's Multi-Factor Authentication MFA solution. Duo now natively integrates into EAA and augments access with push-based MFA, phone call delivery of MFA tokens, and additional device level...

Working towards a more diverse future in security

Last year I embarked on an exercise to examine diversity in cybersecurity. As one full year has passed, I decided to revisit this topic and the ongoing challenges of recruiting AND retaining diverse talent in the cybersecurity field. This past year saw the MeToo movement in the spotlight, and whi...

CVE-2018-7213: Improper Authentication

The Password Manager Extension in Abine Blur 7.8.242 before 7.8.2428 allows attackers to bypass the Multi-Factor Authentication and macOS disk-encryption protection mechanisms, and consequently exfiltrate secured data, because the right-click context menu is not secured...

HPESBMU03833 rev.5 - HPE IceWall SSO dfw, IceWal MCRP, IceWall MFA Proxy, Remote URL Redirection

Potential Security Impact: Remote: URL Redirection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. IceWall SSO Dfw 10.0 RHEL5, RHEL6, RHEL7, HP-UX, Windows and 11.0 RHEL 7 IceWall MCRP 3.0 RHEL 5, RHEL 6, RHEL 7, HP-UX and 4.0 RHEL 7, RHEL 8 IceWall MFA 4.0 Enterprise Edition MFA...

CVE-2017-8978

A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Products version MFA 4.0 proxy was found...

CVE-2017-8978

A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Products version MFA 4.0 proxy was found...

Information disclosure

A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Products version MFA 4.0 proxy was found...

CVE-2017-8978

A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Products version MFA 4.0 proxy was found...

CVE-2017-8978: Exposure of Sensitive Information to an Unauthorized Actor

A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Products version MFA 4.0 proxy was found...

HPESBMU03806 rev.2 - HPE IceWall Products, Multiple Remote Unauthorized Disclosure of Information, Unauthorized Modificiation

Potential Security Impact: Remote: Unauthorized Disclosure of Information, Unauthorized Modification SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. IceWall SSO Dfw 10.0 Patch 8 HP-UX and RHEL, 10.0 Patch 10 HP-UX and RHEL and 11.0 RHEL IceWall MCRP 4.0 RHEL 7 IceWall MFA 4.0...

August 16, 2017—KB4034661 (OS Build 14393.1613)

None None...

AWS Auditing & Hardening Tool: Zeus

Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user. Identity and Access...

PingID MFA Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Product: PingID MFA 1 Vendor: Ping Identity Corporation CSNC ID: CSNC-2017-013 Subject: Reflected Cross-Site Scripting Risk: High Effect: Remotely exploitable Author: Stephan Sekula Date: 18.04.2017 Introduction: ------------- With PingID MFA,...

PingID MFA Cross Site Scripting

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: PingID MFA 1 Vendor: Ping Identity Corporation CSNC ID: CSNC-2017-013 Subject: Reflected Cross-Site Scripting Risk: High Effect: Remotely exploitable Author: Stephan Sekula Date: 18.04.2017 Introduction:...

Uber: Stored XSS on any page in most Uber domains

Due to two IDOR vulnerabilities in Tealium, it was possible to compromise an administrator’s account and inject arbitrary Javascript into https://tags.tiqcdn.com/utag/uber/, which an attacker could leverage for a stored XSS attack on several Uber domains. Additionally, a Tealium user’s password a...

ŠKODA MFA Pro - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application ŠKODA MFA Pro published at the 'play' market has multiple vulnerabilities...

mfa.gov.cy XSS vulnerability

Vulnerable URL: http://www.mfa.gov.cy/mfa/embassies/embassystockholm.nsf/indexen/indexen?OpenDocument="';--=GO Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 360672 Google Pagerank...

Security auditing tool for AWS: AWS Scout2

Scout2 is an open source tool that helps assessing the security posture of AWS environments. Using the AWS API, the Scout2 Python scripts fetch CloudTrail, EC2, IAM, RDS, and S3, configuration data. The gathered configuration is analysed and stored as JSON objects in several JavaScript files. The...