4592 matches found
Simplify Security with Open Source Code Scanning Tools
Explore how source security tools can help mitigate the risk of utilizing open source libraries, saving development effort by using open source components while ensuring your final product’s security...
Simplify Security with Open Source Code Scanning Tools
Explore how source security tools can help mitigate the risk of utilizing open source libraries, saving development effort by using open source components while ensuring your final product’s security...
This Was the Summer of AppSec: All the Improvements We Made in Q3
Summer has come to an end. The backyard barbecues are behind us, the hot dogs have all been eaten, and we're all gearing up for some awesome autumn leaf peeping. But before we fall into another season see what we did there?, we wanted to take a moment to look back on all of the improvements we've...
CVE-2021-33603 Denial-of-Service (DoS) Vulnerability
A Denial-of-Service DoS vulnerability was discovered in F-Secure Atlant whereby the AVPACK module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service DoS of...
Penetration Testing Your AWS Environment - A CTO's Guide
So, you've been thinking about getting a Penetration Test done on your Amazon Web Services AWS environment. Great! What should that involve exactly? There are many options available, and knowing what you need will help you make your often limited security budget go as far as possible. Broadly, th...
Backdoor.Win32.Prorat.lkt Man-In-The-Middle
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/dec8f9042986d64e29d62effb482290bB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Prorat.lkt Vulnerability: Port Bounce Scan MITM Description: The ProSpy Server V1.9...
Backdoor.Win32.Hupigon.gy Unauthenticated Open Proxy
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/be74cbb86c007309d8004d910f5270f7.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.gy Vulnerability: Unauthenticated Open Proxy Description: The malware listens...
Exploit for Unrestricted Upload of File with Dangerous Type in Microsoft
ProxyShellPOC POC for...
A9: Using Components with Known Vulnerabilities ❗️ — Top 10 OWASP 2017
A9: Using Components with Known Vulnerabilities ❗️ — Top 10 OWASP 2017 Introduction A9: Using Components with Known Vulnerabilities What are Components With Known Vulnerabilities? Top 10 OWASP describes the term components as a very broad term. It can either be a full piece of software that our...
Agents are not enough: Why cloud security needs agentless deep scanning
In this post, we’re going to dive into the role and limitations of security agents in the cloud, and put forth a different approach for cloud infrastructure security: agentless deep scanning...
Google Warns of a New Way Hackers Can Make Malware Undetectable on Windows
Cybersecurity researchers have disclosed a novel technique adopted by a threat actor to deliberately evade detection with the help of malformed digital signatures of its malware payloads. "Attackers created malformed code signatures that are treated as valid by Windows but are not able to be...
ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host
Ruby's Net::FTP module trusted the IP address included in the FTP server's response to the PASV command. A malicious FTP server could use this to make Ruby applications using the Net::FTP module to connect to arbitrary hosts and use this to perform port scanning or information extraction from...
500,000 Fortinet VPN credentials exposed: Turn off, patch, reset passwords
A threat actor has leaked a list of almost 500,000 Fortinet VPN credentials, stolen from 87,000 vulnerable FortiGate SSL-VPN devices. The breach list provides raw access to organizations in 74 countries, including the USA, India, Taiwan, Italy, France, and Israel, with almost 3,000 US entities...
CVE-2021-33599
A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service infinite loop and freezes AV engine scanner. The vulnerability can be exploit remotely by an attacker. A successful attack will result in Denial-of-Service of the...
Apple delays plans to search devices for child abuse imagery
After the uproar from users and privacy advocates about Apple’s controversial plans to scan users devices for photos and messages containing child abuse and exploitation media, the company has decided to put the brakes on the plan. If you may recall, Apple announced in early August that it would...
OPENSUSE-SU-2021:1231-1 Security update for xerces-c
This update for xerces-c fixes the following issues: - CVE-2018-1311: Fixed use-after-free inside XML parser during the scanning of external DTDs bsc1159552. This update was imported from the SUSE:SLE-15:Update update project...
Nettacker - Automated Penetration Testing Framework
OWASP Nettacker project is created to automate information gathering, vulnerability scanning and eventually generating a report for networks, including services, bugs, vulnerabilities, misconfigurations, and other information. This software will utilize TCP SYN, ACK, ICMP, and many other protocol...
Security update for xerces-c (important)
openSUSE Security Update: Security update for xerces-c Announcement ID: openSUSE-SU-2021:2958-1 Rating: important References: 1159552 Cross-References: CVE-2018-1311 CVSS scores: CVE-2018-1311 NVD : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-1311 SUSE: 8.1...
SUSE: Security Advisory (SUSE-SU-2021:2944-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
