517 matches found
Description of the security update for the CredSSP remote code execution vulnerability in Windows Server 2008, Windows Embedded POSReady 2009, and Windows Embedded Standard 2009: March 13, 2018
None None...
Description of the security update for the Windows Installer elevation of privilege Vulnerability in Windows Server 2008 and WES09 and POSReady 2009: March 13, 2018
Description of the security update for the Windows Installer elevation of privilege Vulnerability in Windows Server 2008 and WES09 and POSReady 2009: March 13, 2018 Summary An elevation of privilege vulnerability exists in Windows Installer when the Installer fails to properly sanitize input,...
Description of the security update for the Windows Wireless WPA pairwise encryption key reinstallation vulnerability in WES09 and POSReady 2009: March 13, 2018
None None...
Trend Micro at HiMSS: Protecting Healthcare Organizations with Optimized, Connected Security
Submitted by Elie Nasrallah , Director – Cyber Security Strategy The healthcare industry remains one of the most frequently targeted sectors in the United States. It accounted for nearly a quarter 23% of all breaches reported in 2017, second only to the business category, in another record year f...
Bingo, Amigo! Jackpotting: ATM malware from Latin America to the World
Introduction Of all the forms of attack against financial institutions around the world, the one that brings traditional crime and cybercrime together the most is the malicious ecosystem that exists around ATM malware. Criminals from different backgrounds work together with a single goal in mind:...
Sonatype Nexus Repository Manager OSS/Pro 2.14.5 / 3.7.1 XSS
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Cross-Site Scripting Vulnerabilities product: Sonatype Nexus Repository Manager OSS/Pro vulnerable version: =2.14.5, =3.7.1 fixed version: 2.14.6, 3.8.0 CVE...
DVWA - Damn Vulnerable Web Application
Damn Vulnerable Web Application DVWA is a PHP/MySQL web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid...
The New Cyber Landscape: More Threats, But Fewer Security Professionals
Great news: If you're a security professional, your skills have never been more in demand. On the flip side, if you're looking for security talent, the search will likely be lengthy and difficult. ISACA predicts that by 2019 there will be a shortage of two million cyber security professionals...
Expert: IoT Botnets the Work of a ‘Vast Minority’
In December 2017, the U.S. Department of Justice announced indictments and guilty pleas by three men in the United States responsible for creating and using Mirai, a malware strain that enslaves poorly-secured "Internet of Things" or IoT devices like security cameras and digital video recorders f...
New Dridex Variant Emerges With An FTP Twist
A variant of the Dridex banking trojan recently popped up in an email campaign, with an unusual twist: The attackers used compromised FTP sites for hosting malicious documents, according to researchers at Forcepoint. It was a notable departure from the norm of using HTTP links and could represent...
Excerpts from Preparing for NGAV at Scale: Easy Operation at Enterprise Scale
Carbon Black recently published a guide to help enterprises gauge their readiness in their initial search for next-generation antivirus, or NGAV; this is the last excerpt from that guide, which you can find here. For more information about how Cb Defense, Carbon Black's NGAV + EDR solution, helps...
SNMPwn - An SNMPv3 User Enumerator and Attack tool
SNMPwn is an SNMPv3 user enumerator and attack tool. It is a legitimate security tool designed to be used by security professionals and penetration testers against hosts you have permission to test. It takes advantage of the fact that SNMPv3 systems will respond with "Unknown user name" when an...
as30045.http.sasm3.net XSS vulnerability
Open Bug Bounty ID: OBB-485551 Description| Value ---|--- Affected Website:| as30045.http.sasm3.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Description of the security update for SQL Server 2016 SP1 GDR: January 3, 2018
None None...
Description of the security update for the elevation of privilege vulnerability in Windows Server 2008: January 3, 2018
Description of the security update for the elevation of privilege vulnerability in Windows Server 2008: January 3, 2018 Summary An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. An attacker who successfully exploits the vulnerability could...
IT Security Team Staffing Shortages: Managing Risks and Attracting Talent
A company's C-suite has multiple priorities during this time of year: Getting next year's budget squared away while also ensuring the business is on a path toward its upcoming goals are two items high on this list. Another key element that executives must consider heading into 2018 is staffing...
Description of the security update for the information disclosure vulnerability in Windows Server 2008: December 12, 2017
Description of the security update for the information disclosure vulnerability in Windows Server 2008: December 12, 2017 Summary An information disclosure vulnerability exists when the Windows its:// protocol handler unnecessarily sends traffic to a remote site to determine the zone of a provide...
WAGO PFC 200 SERIES Multiple Vulnerabilities
Exploit for hardware platform in category local exploits VENDOR DESCRIPTION “The WAGO-I/O-SYSTEM is a flexible fieldbus-independent solution for decentralized automation tasks. With the relay, function and interface modules, as well as overvoltage protection, WAGO provides a suitable interface fo...
Description of the security update for Word Viewer: November 14, 2017
None None...
Trend Micro Capture the Flag: Train security professionals – Close the skills gap
Businesses today face a security challenge: Protecting their systems and data is vital, but there aren’t enough qualified employees who can successfully make that happen. Similarly, young cybersecurity professionals need to overcome the gap between what is learned in a classroom and the practical...