CVE-2019-1010287: Improper Neutralization of Input During Web Page Generation

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

OpenJPEG De-Zero Vulnerability

OpenJPEG is a C-based open source JPEG2000 codec . OpenJPEG 2.3.0 and earlier versions of the openmj2/pi.c file have a divide-by-zero error vulnerability in the 'pinextpcrl' function, the 'pinextcprl' function, and the ' pinextrpcl' functions have a divide-by-zero error vulnerability. A remote...

OpenJPEG Out-of-Bounds Access Vulnerability

OpenJPEG is an open source JPEG 2000 codec written in C language. An out-of-bounds access vulnerability exists in the pinextlrcp, pinextrlcp, pinextrpcl, pinextrpcl, pinextpcrl, pinextrpcl, and pinextcprl functions in OpenMJ2/pi.c in OpenJPEG 2.3.0 and earlier versions. A remote attacker could...

Three Network Security Questions with CEITEC’s CIO

Ireneo Demanarig is the Chief Information Officer at CEITEC S.A. located in Porto Alegre, Rio Grande do Sul, Brazil. CEITEC is a microelectronics manufacturer that specializes in solutions such as automatic identification RFID and smartcards, application-specific integrated circuits ASICs aimed a...

DEBIAN-CVE-2018-20846

Out-of-bounds accesses in the functions pinextlrcp, pinextrlcp, pinextrpcl, pinextpcrl, pinextrpcl, and pinextcprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service application crash...

DEBIAN-CVE-2018-20845

Division-by-zero vulnerabilities in the functions pinextpcrl, pinextcprl, and pinextrpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service application crash...

Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection

While Windows Defender Antivirus makes catching 5 billion threats on devices every month look easy, multiple advanced detection and prevention technologies work under the hood to make this happen. Windows Defender Antivirus is the next-generation protection component of Microsoft Defender Advance...

PT-2019-3410

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 60.7.1 Description A flaw in the implementation of iCal in Thunderbird causes a heap buffer overflow in parser get next char when processing certain email messages, resulting in a potentially exploitable crash. Th...

Xbox Two vs PlayStation 5: Which console is winning the race of anticipation?

By Uzair Amir Excitement is mounting among gamers as Microsoft and Sony continue to tease tantalizing details of their upcoming next-generation console releases. The PlayStation 5 is expected to launch towards the end of 2020 and lead architect Mark Cerny has already revealed details of the...

UBUNTU-CVE-2019-12046

LemonLDAP::NG -2.0.3 has Incorrect Access Control...

Data Security in the Cloud: How to Lock Down the Next-Gen Perimeter

With businesses continuing their digital migrations to cloud services and applications, IT is finding itself wrestling with how to keep companies’ data safe. The challenge? The cloud has created a next-generation, virtual perimeter. Businesses are using infrastructure-as-a-service IaaS, cloud...

Three Common Questions (and Answers) About Next-Gen AV

Most organizations with traditional, or legacy, antivirus AV solutions are well aware that they are no longer protected from the more advanced tactics and threats of attackers today. Signatures just can’t keep up with emerging threats. But that doesn’t mean that everyone is ready to dive head fir...

WAFW00F v1.0.0 - Detect All The Web Application Firewall!

WAFW00F identifies and fingerprints Web Application Firewall WAF products. How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions. If that is not successful, it sends a number of potentially...

CVE-2018-18978

An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the encryption key is necessary for deciphering communications between this application and the backend server. This, in combination with...

CVE-2018-18977

An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. An attacker may reverse engineer the codebase to extract sensitive data that contributes to the disclosure of medical information of patients utilizing the Ascensia platform. This occurs because of...

CVE-2018-18976

An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. This information ca...

CVE-2018-18975

An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15. An attacker may proxy communications between the app and Ascensia backend servers because of a weak certificate-pinning implementation, leading to disclosure of medical information...

CVE-2018-18976

An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. This information ca...

CVE-2018-18977

An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. An attacker may reverse engineer the codebase to extract sensitive data that contributes to the disclosure of medical information of patients utilizing the Ascensia platform. This occurs because of...

CVE-2018-18978

An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the encryption key is necessary for deciphering communications between this application and the backend server. This, in combination with...