U.S. Finance Sector Hit with Targeted Backdoor Campaign

The financial services sector in the U.S. found itself under a barrage of cyberattacks last month, all bent on delivering a powerful backdoor called Minebridge. The attack chain employed a known method called “VBA Stomping” to avoid detection. According to researchers at FireEye, the campaigns,...

The 5 Conversations I want to have at CB Connect 2019

In a few weeks, I’ll be attending CB Connect in my hometown of San Diego, CA. If you’ve read my earlier blogs, you know I’m passionate about this event because it brings together some of the best and brightest in the security space to network and collaborate on solving some of our industry’s...

jobs.mrinetwork.com XSS vulnerability

Open Bug Bounty ID: OBB-675048 Description| Value ---|--- Affected Website:| jobs.mrinetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Parity Pledge: Carbon Black’s Continued Commitment to Diversity & Inclusion

Carbon Black knows that unique ideas come from unique perspectives, which is why we’ve focused on creating a more diverse and inclusive workplace. Our team has built out initiatives to support our current workforce and continues to seek out new opportunities to attract and hire diverse members to...

chasing-glory.com XSS vulnerability

Open Bug Bounty ID: OBB-632585 Description| Value ---|--- Affected Website:| chasing-glory.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

kellentankedme.com XSS vulnerability

Open Bug Bounty ID: OBB-632582 Description| Value ---|--- Affected Website:| kellentankedme.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

strangedaze.info XSS vulnerability

Open Bug Bounty ID: OBB-632580 Description| Value ---|--- Affected Website:| strangedaze.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

darkorderofcaine.com XSS vulnerability

Open Bug Bounty ID: OBB-632576 Description| Value ---|--- Affected Website:| darkorderofcaine.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

devilsdue.us XSS vulnerability

Open Bug Bounty ID: OBB-632568 Description| Value ---|--- Affected Website:| devilsdue.us Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

igsclan.com XSS vulnerability

Open Bug Bounty ID: OBB-632563 Description| Value ---|--- Affected Website:| igsclan.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

resonanceguild.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-632562 Description| Value ---|--- Affected Website:| resonanceguild.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

aetherianavengers.com XSS vulnerability

Open Bug Bounty ID: OBB-632555 Description| Value ---|--- Affected Website:| aetherianavengers.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

guild.lrrw.info XSS vulnerability

Open Bug Bounty ID: OBB-632553 Description| Value ---|--- Affected Website:| guild.lrrw.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

teso.the-eternal-watch.com XSS vulnerability

Open Bug Bounty ID: OBB-632546 Description| Value ---|--- Affected Website:| teso.the-eternal-watch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

p99ps.com XSS vulnerability

Open Bug Bounty ID: OBB-632545 Description| Value ---|--- Affected Website:| p99ps.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

inertialb.com XSS vulnerability

Open Bug Bounty ID: OBB-632535 Description| Value ---|--- Affected Website:| inertialb.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

shipwreckedguild.com XSS vulnerability

Open Bug Bounty ID: OBB-631670 Description| Value ---|--- Affected Website:| shipwreckedguild.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Working towards a more diverse future in security

Last year I embarked on an exercise to examine diversity in cybersecurity. As one full year has passed, I decided to revisit this topic and the ongoing challenges of recruiting AND retaining diverse talent in the cybersecurity field. This past year saw the MeToo movement in the spotlight, and whi...

SAP E-Recruiting Input Validation Vulnerability

SAP E-Recruiting also known as ERECRUIT is a set of German SAP SAP electronic recruitment system. The system has automatic personnel screening, filtering and sorting functions. A security vulnerability exists in SAP E-Recruiting versions 605 through 617. A remote attacker could exploit this...

Code injection

An issue was discovered in SAP E-Recruiting aka ERECRUIT 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and...