Symantec Messaging Gateway Directory Traversal

SUMMARY Symantec has released an update to address one issue in the Symantec Messaging Gateway product. AFFECTED PRODUCTS Symantec Messaging Gateway SMG --- CVE | Affected Versions | Remediation CVE-2017-15532 | Prior to 10.6.4 | Upgrade to 10.6.4 ISSUES CVE-2017-15532 --- Severity/CVSSv3: | Medi...

Richard Seiersen, CISO of Twilio, Joins Wallarm Board of Advisers

We are excited to welcome Richard Seiersen to Wallarm advisory team. Richard brings tons of security experience from both start-ups and global companies and unique views on making the impact of security measurable. We have asked Richard to share some of his thoughts on what’s important in cyber...

Xiongmai Technology IP Cameras and DVRs

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Xiongmai Technology Equipment: IP Cameras and DVRs Vulnerability: Stack-based Buffer Overflow AFFECTED PRODUCTS The following versions of Xiongmai Technology IP cameras and DVRs are affected: All IP Cameras and DVRs...

Command Injection in PAN-OS

A vulnerability exists in the PAN-OS web interface packet capture management that could allow an authenticated user to inject arbitrary commands. Ref PAN-81892 / CVE-2017-15940 PAN-OS contains a vulnerability that may allow for post authentication command injection This issue affects PAN-OS 6.1.1...

Vulnerability in PAN-OS and Panorama on Management Interface

Through the exploitation of a combination of unrelated vulnerabilities, and via the management interface of the device, an attacker could remotely execute code on PAN-OS or Panorama in the context of the highest privileged user. Ref PAN-61094 / PAN-80990 / PAN-80993 / PAN-80994 / CVE-2017-15944...

Server-Side Request Forgery in PAN-OS

A vulnerability exists in the PAN-OS web interface in the configuration file import for applications, spyware and vulnerability objects. Exploitation of this vulnerability allows for the parsing of external entities and could lead a PAN-OS device to connect to and disclose limited information to...

Implementing the CIS 20 Critical Security Controls: Building Upon Foundational Cyber Hygiene

Most successful cyber attacks exploit known vulnerabilities for which patches are available, or take advantage of weak configuration settings that could have been easily hardened. You can significantly lower the risk of being victimized by this type of common, preventable attack by adopting the...

Implementing the CIS 20 Critical Security Controls: Slash Risk of Cyber Attacks by 85%

If a CISO needed to cut cyber attack risk by 85%, how would this security chief go about accomplishing that? Would the CISO even know where to begin? It’s safe to say that such a mandate would be considered daunting, and maybe even overwhelming. CISOs are scrambling to protect IT infrastructures...

Symantec Endpoint Encryption Various Issues

SUMMARY Symantec has released an update to address two issues in the Symantec Endpoint Encryption product. AFFECTED PRODUCTS Symantec Endpoint Encryption SEE --- CVE | Affected Versions | Remediation CVE-2017-15525 CVE-2017-15526 | Prior to 11.1.3MP1 | Upgrade to 11.1.3MP1 ISSUES CVE-2017-15525 -...

Eavesdropper Vulnerability Exposes Mobile Call, Text Data

UPDATE Mobile app developers who code using the Twilio cloud-based platform and are forgetful about removing their hardcoded credentials have put businesses messaging data at risk for exposure. The so-called Eavesdropper vulnerability, disclosed today by Appthority, has been around since 2011 and...

Netflix functions without client-side React, and it's a good thing

A few days ago Netflix tweeted that they'd removed client-side React.js from their landing page and they saw a 50% performance improvement. It caused a bit of a stir. This shouldn't be a surprise The following: 1. Download HTML & CSS in parallel. 2. Wait for CSS to finish downloading & execute it...

App Layering 2.x/3.x: Best Practices

A consolidation of the various layering best practices to apply in the OS and App layers. For App Layering 4.x Best Practices, please refer here:https://support.citrix.com/article/CTX225952 Operating System Layer Have one Operating System layer per Operating System Windows 7 32-bit, Windows 7...

Kaspersky Opens Antivirus Source Code for Independent Review to Rebuild Trust

Kaspersky Lab — We have nothing to hide! Russia-based Antivirus firm hits back with what it calls a "comprehensive transparency initiative," to allow independent third-party review of its source code and internal processes to win back the trust of customers and infosec community. Kaspersky launch...

How to create an intentional culture of security

In this day and age, companies great and small are vulnerable to potential attacks that they are exposed to every day. From insider threats to simple phishing, one is always left guessing if they know enough to handle them or are well prepared to face the risks. Educating your staff about basic...

Infogram: User Enumeration

Vulnerability:- -User enumeration is possible through forgot password feature. steps to reproduce:- -Go to the above selected domain and go to forgot password. -You can submit a mail address and check whether it is existing in your database or not. Remediation:- -It should display like "if that...

EMC NetWorker Buffer Overflow Vulnerability

EMC NetWorker Server contains a buffer overflow vulnerability that could potentially be exploited by malicious users to compromise the affected system. Versions prior to 8.2.4.9, 9.0.x all supported versions, prior to 9.1.1.3, and prior to 9.2.0.4 are affected. EMC NetWorker Buffer Overflow...

October 16, 2017 – Morning Cyber Coffee Headlines – “National Boss Day” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 16, 2017 - Headlines Carbon Black in the News: Ransomware market...

Inflection: No password confirmation on changing primary email address

Users may change the primary email address associated with their account without being required to confirm their password again. The security researcher reporting this proposed that we add a password confirmation field when performing an email change. After considering the issue, we don't intend ...

good-practices.edb.hkedcity.net Open Redirect vulnerability

Vulnerable URL: http://good-practices.edb.hkedcity.net/exemplar9/flashdetection.swf?flashContentURL=https://openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.01.2018 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Ran...

Civil Liberties Activists Hit By Phishing Campaign

Digital civil liberties activists were hit with a barrage of phishing emails earlier this summer designed to wrest away business credentials. Activists with Fight for the Future, a nonprofit that’s campaigned against backdoors in mobile phones and for Net neutrality, and Free Press, a group that...