Lack of Internal IT Security Expertise Requires Connected Threat Defense

There are many different factors that can impact a company's overall security posture. Increasing sophistication on the part of cyber criminals, combined with more frequent attacks launched using advanced malware, represent some of the most pervasive drivers of IT security. However, one issue...

The Internet Wants You: Consider a Career in Cybersecurity

October is National Cybersecurity Awareness Month, an annual campaign to raise awareness about cybersecurity. The month’s themes educate students and professionals about cybersecurity attack methods, best practices, and preventive measures and are geared toward informing the next generation of...

complianceprofessionals.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-359719 Description| Value ---|--- Affected Website:| complianceprofessionals.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

BaRMIe - Java RMI Enumeration And Attack Tool

BaRMIe is a tool for enumerating and attacking Java RMI Remote Method Invocation services. RMI services often expose dangerous functionality without adequate security controls, however RMI services tend to pass under the radar during security assessments due to the lack of effective testing tools...

Small Business: A Target for Cyber Criminals

The age of cyber threats has been marked with critical vulnerabilities, evolving strains and organizations that have faced the consequences. Target's breach, the rise of ransomware like WannaCry and the recent Equifax hack serve as lessons that these attacks are the new normal for companies, maki...

Krebs Given ISSA’s ‘President’s Award’

KrebsOnSecurity was honored this month with the 2017 President's Award for Public Service from the Information Systems Security Association, a nonprofit organization for cybersecurity professionals. The award recognizes an individual's contribution to the information security profession in the ar...

Experts Have Sobering Message on Human Rights, Privacy for Security Pros

MADRID—Continuing a theme that picked up momentum at Black Hat this summer, two influential speakers at Virus Bulletin today painted grim pictures of the threats to physical safety and civil liberties posed by commercial spyware and high-end surveillance software often sold to governments. The ca...

legalprofessionals.co.uk XSS vulnerability

Vulnerable URL: http://legalprofessionals.co.uk/modalbox/login.php?id=13'"112 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

iTech Gigs Script 1.20 - cat SQL Injection

iTech Gigs Script 1.20 - cat SQL Injection Exploit Title: iTech Gigs Script v1.20 - SQL Injection Date: 2017-09-15 Exploit Author: 8bitsec Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/the-gigs-script/ Version: 1.20 Tested on: Kali Linux 2.0 | Mac OS 10.12.6...

Ubiquiti Networks UniFi Cloud Key Command Injection Vulnerability

Ubiquiti Networks UniFi Cloud Key wwith firmware versions 0.6.4 and below suffer from an authenticated command injection vulnerability. title: Authenticated Command Injection product: Ubiquiti Networks UniFi Cloud Key vulnerable version: Firmware version =0.6.9 CVE number: - impact: High homepage...

iTech Gigs Script 1.20 - 'cat' SQL Injection

Exploit Title: iTech Gigs Script v1.20 - SQL Injection Date: 2017-09-15 Exploit Author: 8bitsec Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/the-gigs-script/ Version: 1.20 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected] Contact:...

Description of the security update for Office 2010: September 12, 2017

Description of the security update for Office 2010: September 12, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...

Intel Confirms Its Much-Loathed ME Feature Has A Kill Switch

Researchers at Positive Technologies forced Intel’s hand at revealing that a previously undocumented kill switch exists for its oft-criticized Intel Management Engine, a remote management component of Intel CPUs. Initially, Positive Technologies set out to disable the feature that some security...

Announcing the Fourth Annual Flare-On Challenge

The fourth annual Flare-On Challenge – the FireEye Labs Advanced Reverse Engineering FLARE team’s yearly reverse engineering contest – is scheduled to kick off on Sept. 1, 2017, at 8pm ET. This is a CTF-style challenge for all active and aspiring reverse engineers, malware analysts, and security...

Level up your cybersecurity journey with CLOUDSEC 2017

Beginning this month, Trend Micro will be hosting CLOUDSEC, one of the largest cybersecurity conferences across Asia-Pacific and Europe. The event features presentations and panel discussions from industry experts and thought leaders who will discuss high-level strategies, forward looking securit...

Python Pentesting Framework: PytheM

pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act practiced by this tool, for more informatio...

Security update for the Windows Error Reporting elevation of privilege vulnerability for and Windows Server 2008: August 8, 2017

Security update for the Windows Error Reporting elevation of privilege vulnerability for and Windows Server 2008: August 8, 2017 Summary This security update resolves a vulnerability in Windows Error Reporting WER. The vulnerability could allow elevation of privilege if successfully exploited by ...

Security update for the Windows NetBIOS denial of service vulnerability in Windows Server 2008: August 8, 2017

Security update for the Windows NetBIOS denial of service vulnerability in Windows Server 2008: August 8, 2017 Summary A denial of service vulnerability exists when Microsoft Windows improperly handles NetBIOS packets. An attacker who successfully exploits this vulnerability could cause a target...

IRS Warns Tax Professionals of New Scam to Steal Passwords

The Internal Revenue Service IRS, acting in concert with state tax agencies and the tax industry, has issued an IRS Security Summit Alert for tax professionals to beware of a new phishing email scam. Scam operators often use fraudulent e-mails to entice their targets to reveal login credentials...

Academia's Role in Security Skills Gap Examined

LAS VEGAS—For a long time, there’s been a chorus from employers about the lacked of skilled security professionals to fill available openings. And while it would not be an illogical leap to think universities are adequately preparing tomorrow’s security admins and CISOs, quite the opposite may be...