'5G is Coming,' But Can the Security Industry Keep Up?

THE HAGUE, Netherlands – With the advent of 5G, the tech community is bracing itself for new applications like self-driving cars and other IoT applications. But what does that mean for the security landscape? At the GSMA Mobile 360 Conference taking place this week in the Netherlands, experts she...

5G IoT: Literally a Matter of Life or Death

THE HAGUE, Netherlands – Mobile operators need to get security right as they deploy their 5G networks this year and next – because the ramifications for getting it wrong will include loss of life. That’s the consensus at GSMA’s Mobile360 Security for 5G conference, where speakers on Wednesday not...

Juniper JSA10904

The version of tested product installed on the remote host is 12.3 prior to 12.3R12-S12, 12.3X48 prior to 12.3X48-D76, 14.1X53 prior to 14.1X53-D48, 15.1 prior to 15.1R5, 15.1X49 prior to 15.1X49-D151, 15.1 prior to 15.1F6-S12 or 16.1 prior to 16.1R2. It is, therefore, affected by a denial of...

USN-3976-4 samba vulnerability

USN-3976-1 fixed a vulnerability in Samba. The update introduced a regression causing Samba to occasionally crash. This update fixes the problem. Original advisory details: Isaac Boukris and Andrew Bartlett discovered that Samba incorrectly checked S4U2Self packets. In certain environments, a...

Cross site scripting

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting XSS vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service passwor...

Siemens SIMATIC WinCC (TIA Portal) < 15 Update 4 Multiple Vulnerabilities (SSA-233109)

Binary data scadasiemenstiawinccssa-233109.nbin...

GitLab Authorization Issues Vulnerability (CNVD-2019-43039)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An authorization issue vulnerability exists in GitLab. Th...

PHP 7.1.x < 7.1.29 Heap-based Buffer Overflow Vulnerability

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.29, 7.2.x prior to 7.2.18 or 7.3.x prior to 7.3.5. It is, therefore, affected by a heap-based buffer over-read condition within estrndup of the exifprocessIFDTAG in the exif.c script. An...

ProjectSend CVS Injection Vulnerability

rojectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A CVS injection vulnerability exists in versions prior to ProjectSend r1053 that affects victims who import data into Microsoft Excel...

Mail.ru: self XSS на странице https://aw.mail.ru/pin/

Do-it-yourself XSS in https://aw.mail.ru/pin/...

Cloud WAAPs Are the Future of Application Security. But What Does That Mean?

Millions of Verizon FIOS broadband users vulnerable to hackers controlling and surveilling their home networks. Thousands of GPS watches whose maps were open to attackers tracking and eavesdropping on children and elderly users. A zero-day hole in Microsoft’s Edge and Internet Explorer browsers...

Jenkins Swarm Plugin XML external entities information disclosure vulnerability

Summary The Jenkins Self-Organizing Swarm Modules Plugin, version 3.14, contains a trivial XXE XML External Entities vulnerability inside of the getCandidateFromDatagramResponses method. As a result of this issue, it is possible for an attacker on the same network as a Swarm client to read...

CVE-2019-10309

The CVE-2019-10309 entry concerns the Jenkins Swarm Plugin (Swarm Client) where UDP-based master discovery responses are XML documents that are parsed without proper XXE protection. This XXE flaw could allow an unauthenticated attacker on the same network to read arbitrary files from Swarm client...

CVE-2019-11511

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API...

RHEL 7 : kernel-alt (RHSA-2019:0831)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0831 advisory. The kernel-alt packages provide the Linux kernel version 4.x. Security Fixes: kernel: lack of check for mmap minimum address in...

GitLab Authorization Issues Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An authorization issue vulnerability exists in GitLab...

Overstepping Access Vulnerability in China Postal Express App

CPSE APP is a 24-hour courier self-service courier software. An override access vulnerability exists in China Post Express & Easy APP. The attacker obtains other users' information by grabbing packets and intercepting modifications...

GitLab Access Control Error Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An Access Control Error vulnerability exists in GitLab...

CVE-2017-16231

DISPUTED In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match in pcreexec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack th...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Libxslt vulnerability (USN-3947-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3947-1 advisory. It was discovered that Libxslt incorrectly handled certain documents. An attacker could possibly use this issue to access sensitive...