CVE-2019-15611

Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications...

CVE-2019-15611

CVE-2019-15611 affects the iOS Nextcloud App (version 2.23.0) and is due to a violation of Secure Design Principles that causes the app to disclose login credentials and access tokens to other Nextcloud services during user search (e.g., federated users) or push-notification registration. The iss...

Changing the monolith—Part 1: Building alliances for a secure culture

Any modern security expert can tell you that we’re light years away from the old days when firewalls and antivirus were the only mechanisms of protection against cyberattacks. Cybersecurity has been one of the hot topics of boardroom conversation for the last eight years, and has been rapidly...

ACSC Releases Fundamentals of Cross Domain Solutions

The Australian Cyber Security Centre ACSC has released a cybersecurity guide outlining the fundamentals of cross domain solution CDS technologies. This guidance provides cross domain security principles to enable organizations to share information securely across separated networks. The...

WakaTime: [invalid][false-positive] csrftoken on profile page

step of reproduce- 1. Go to https://wakatime.com and create account. 2. login account after that go public profile. 3. after that change the full name and intercept brup suite and delete csrftoken. 4. After forward then you see name was changed. Impact Violation of Secure Design Principles...

[SECURITY] Fedora 29 Update: python-jinja2-2.10.1-1.fc29

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. If you have any exposure to other text-based template languages, such as Smarty or Django, you should feel right at home with...

[SECURITY] Fedora 30 Update: python-jinja2-2.10.1-1.fc30

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. If you have any exposure to other text-based template languages, such as Smarty or Django, you should feel right at home with...

Guide to Developing a National Cybersecurity Strategy—a resource for policymakers to respond to cybersecurity challenges

Nations from every corner of the world are increasingly leveraging digital transformation to grow their economies and empower businesses to improve services, including vital services provided by critical infrastructures. This adoption of new information communications technologies ICT has...

A Way Forward

Carbon Black recently published a report on the challenges of securing Linux-based operating systems and how Carbon Black is redesigning the approach. For more information about how the CB Predictive Security Cloud, Carbon Black's consolidated endpoint security platform, helps enterprises cut cos...

[SECURITY] Fedora 28 Update: moodle-3.4.6-1.fc28

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

This Week in Security News: Holiday Cybercriminals & Cryptomining Malware

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn the common threats and the best practices for defending against cybercriminals during November’s online shopping season. Also, see the...

[SECURITY] Fedora 29 Update: moodle-3.5.2-1.fc29

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

ZDResearch Advanced Web Hacking Training 2018 – Learn Online

Are you looking to master web hacking? Interested in a bug-hunting career? Do you want to land a job in cybersecurity? Are you already working as a security engineer, but want to further advance or refine your skills? If yes, read on. ZDResearch Advanced Web Hacking AWH course, including optional...

[SECURITY] Fedora 28 Update: moodle-3.4.4-1.fc28

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

QSC18 Virtual Edition – Securing our Networks and Enabling the Digital Transformation: One App at a Time

Qualys Chairman and CEO Philippe Courtot set the tone for the company’s first virtual conference, the QSC18 Virtual Edition, with a call to the industry to re-invent security to protect digital transformation efforts. CIOs and CISOs can’t continue accumulating disparate, point solutions that are...

Google Tackles AI Principles: Is It Enough?

Google has released its manifesto of principles guiding its efforts in the artificial intelligence realm – though some say the salvo isn’t as complete as it could be. AI is the new golden ring for developers, thanks to its potential to not just automate functions at scale but also to make...

FTC Promotes Privacy Awareness Week

The Federal Trade Commission FTC has released an announcement promoting Privacy Awareness Week PAW May 14–18, 2018. PAW is an annual event fostering awareness of privacy issues and the importance of protecting personal information. This year’s theme, “From Principles to Practice,” focuses on...

Java deserialization vulnerability the principles of the analysis-vulnerability warning-the black bar safety net

In the world there are three things most difficult: Put someone else's money stuffed into their own pockets Put their ideas put into someone else's head. To let own code run on someone else's server Foreword Java deserialization vulnerability is nearly a period of time has been focused on the...

AICPA Releases New SOC 2 Guide – What You Need to Know

In March 2018, the American Institute of Certified Public Accountants AICPA released its highly anticipated new System and Organization Controls 2 SOC 2 guide, which includes information for the extant 2016 trust services principles and the new 2017 trust services criteria. The following is a...

[SECURITY] Fedora 27 Update: moodle-3.3.4-1.fc27

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...