DMARC Compliance Lacking in 28 Percent of .Gov Agencies

As phishing ploys continue to take their toll on businesses, federal agencies have yet to fully protect themselves against such attacks with basic defenses like DMARC. With only months to go before the federal Binding Operational Directive BOD 18-01 deadline of October 2018, which mandates DMARC...

Titan Security Keys – Google launches its own USB-based FIDO U2F Keys

At Google Cloud Next '18 convention in San Francisco, the company has introduced Titan Security Keys—a tiny USB device, similar to Yubico's YubiKey, that offers hardware-based two-factor authentication for your online accounts with the highest level of protection against phishing attacks. These...

CVE-2018-5385

Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some...

Session fixation

Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some...

CVE-2018-5385

CVE-2018-5385 affects Navarino Infinity web interface (up to version 2.2). The vulnerability arises from accepting the session ID as a GET parameter, enabling session fixation that can bypass two-factor authentication in some installations, with potential phishing implications. The linked sources...

Microsoft Says Russia Tried to Hack Three 2018 Midterm Election Candidates

Microsoft said it detected and helped the US government to block Russian hacking attempts against at least three congressional candidates this year, a Microsoft executive revealed speaking at the Aspen Security Forum today. Although the company refused to name the targets but said, the three...

FTC Issues Alert on Tech Support Scams

The Federal Trade Commission has released an alert on tech support scams. Scammers use pop-up messages, websites, emails, and phone calls to entice users to pay for fraudulent tech support services to repair problems that don’t exist. Users should not pay or give control of their devices to any...

IC3 Warns of Business Email Compromise Scams

The Internet Crime Complaint Center IC3 has released an alert on business email compromise scams. This type of scam targets businesses and individuals by using social engineering or computer intrusion to compromise legitimate email accounts and conduct unauthorized fund transfers or obtain...

Open redirect

Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. IBM X-Force ID: 83383...

CVE-2013-0594

The affected software is IBM iNotes (formerly IBM Lotus iNotes). Affected versions are IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1. The vulnerability is an open redirect that allows remote attackers to redirect users to arbitrary websites and potentially conduct phishing. The exact ro...

CVE-2013-0594

Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. IBM X-Force ID: 83383...

Salesforce Careermount - Bypass & XSS Web Vulnerability

Document Title: =============== Salesforce Careermount - Bypass & XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1969 Release Date: ============= 2018-07-04 Vulnerability Laboratory ID VL-ID: ====================================...

Hanno's projects: Open redirect on https://blog.fuzzing-project.org

Summary: There is an Open Redirect on https://blog.fuzzing-project.org/exit.php?url= due to the application not checking the value passed by the user to the "url" parameter. Description: Unchecked redirects occur when an application redirects to a destination controlled by attackers. This often...

SUSE-SU-2018:1830-1 Security update for python-Django

This update for python-Django fixes the following security issues: - CVE-2016-2512: The utils.http.issafeurl function allowed remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting XSS attacks via a URL containing basic...

SUSE-SU-2018:1828-1 Security update for python-Django

This update for python-Django fixes the following security issues: - CVE-2016-2512: The utils.http.issafeurl function allowed remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting XSS attacks via a URL containing basic...

Brave Software: OPEN REDIRECTION at every 302 HTTP CODE

Summary i guess every 302 HTTP CODE on https://publishers.basicattentiontoken.org possible to OpenRedirection Steps To Reproduce: 1. I edited the request when i got redirected from this request url...

Indonesian Hacker Group Cashes In On Blockbuster Movie Titles

When breaking the law isn't a barrier, there’s always a way to make a quick buck. We see it every day, and this time from an Indonesian cybercrime campaign infecting vulnerable websites by luring their visitors to a network of scam websites using blockbuster movies. The attack part I: Recruiting...

Security Bulletin: Multiple Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Worklight and IBM MobileFirst Platform Foundation

Summary IBM WebSphere Application Server Liberty vulnerabilities have been disclosed by IBM WebSphere Application Server Liberty . IBM WebSphere Application Server Liberty is used by IBM Worklight and IBM MobileFirst Platform Foundation. IBM Worklight and IBM MobileFirst Platform Foundation have...

Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to conduct phishing attacks, using an open redirect attack (CVE-2017-1558)

Summary IBM Maximo Asset Management could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicio...

Security Bulletin: IBM Tivoli Netcool Impact affected by Open Redirect vulnerability in IBM WebSphere Application Server Liberty (CVE-2016-3040)

Summary IBM WebSphere Application Server Liberty is shipped as a component of IBM Tivoli Netcool Impact. There is an Open Redirect Vulnerability in IBM WebSphere Application Server Liberty. Vulnerability Details CVEID: CVE-2016-3040 DESCRIPTION: IBM WebSphere Application Server Liberty could allo...