CVE-2018-15136

TitanHQ SpamTitan before 7.01 has Improper input validation. This allows internal attackers to bypass the anti-spam filter to send malicious emails to an entire organization by modifying the URL requests sent to the application...

Microsoft’s Cyber Defense Operations Center shares best practices

Today, a single breach, physical or virtual, can cause millions of dollars of damage to an organization and potentially billions in financial losses to the global economy. Each week seems to bring a new disclosure of a cybersecurity breach somewhere in the world. As we look at the current state o...

How to Secure Your Mid-Size Organization From the Next Cyber Attack

If you are responsible for the cybersecurity of a medium-sized company, you may assume your organization is too small to be targeted. Well, think again. While the major headlines tend to focus on large enterprises getting breached – such as Sony, Equifax, or Target the actual reality is that smal...

Privilege Escalation

ansible is vulnerable to privilege escalation attacks. The vulnerability exists as Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their...

Cross-site Scripting (XSS)

spacewalk-schema is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as a cross-site scripting XSS flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attack...

Authorization Bypass

foreman is vulnerable to authorization bypass. An unspecified vulnerability allows authenticated users to bypass organization and location restrictions to read, edit or delete organizations or locations...

Procedure to migrate a Cloud Connect tenant to vCloud Director

Challenge SPs who have vCloud Director deployed in their infrastructure can expose vCloud Director resources as cloud hosts for tenant VM replicas. This article describes a procedure of migrating existing tenants to vCloud Director. Solution On the Tenant side: 1. Delete all Cloud Backup and...

CVE-2018-20226

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

CVE-2018-20226

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

CVE-2018-20226

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

CVE-2018-20226

The vulnerability CVE-2018-20226 affects THEHIVE PROJECT Cortex up to version 2.1.3, caused by not overriding Role.toString. This enables an organization administrator to add a super administrator (privilege escalation). Exploitation details are not provided in the supplied documents. Remediation...

CVE-2018-20226: Undefined Security Weakness

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

Wicked scammers steal $1 million from Save the Children charity

By Uzair Amir Another day, another email scam - This time, wicked scammers have stolen over $1,000,000 from Save the Children, an international non-governmental organization based in London, United Kingdom. This happened after scammers compromised email address of one of the Save the Children...

Save the Children Federation Duped in $1M Scam

Hackers scammed the Save the Children Federation out of almost $1 million in a business email compromise BEC scam. Save the Children is a well-known U.S.-based non-profit group that offers charity services like fundraising and sponsorships. According to the company’s 2017 income tax returns,...

Global IT Asset Inventory: The Foundation for Security and Compliance

Pablo Quiroga, Qualys’ Director of Product Management for IT Asset Management, talks about the new Asset Inventory solution When IT directors and CISOs look at their digitally transformed networks, they encounter many shadows that their legacy enterprise software tools can’t illuminate. These bli...

coveybefriending.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-705912 Description| Value ---|--- Affected Website:| coveybefriending.org.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Mueller: Cohen Lied About Trump Organization's Moscow Project

Trump's former lawyer has testified that the Trump Organization pursued a real estate deal with Moscow deep into the 2016 presidential campaign...

Happy graduation, Envoy!

Envoy, the new darling of the DevOps community, performs the role of a service and edge proxy. With advanced features such as timeouts, rate limiting, circuit breaking, load balancing, retries, stats, logging, and distributed tracing are required to handle network failures in a fault tolerant and...

VSAXESS V2.6.2.70 build20171226_053 - organization Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: VSAXESS V2.6.2.70 build20171226053 - 'organization' Denial of Service PoC Discovery by: Diego Santamaria Vendor Homepage: https:https://www.visionistech.com/en/home/ Software Link:...

annd.org XSS vulnerability

Open Bug Bounty ID: OBB-695467 Description| Value ---|--- Affected Website:| annd.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...