br.net.woodstock.rockframework:rockframework-core (>=1.2.1 <=1.2.2), com.alanpoi:alanpoi-all (>=1.3.5 <=3.0.0) +64 more potentially affected by CVE-2016-1000344 via org.bouncycastle:bcprov-jdk14 (>=1.38 <=1.55)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.38, =1.2.1, =1.3.5, =1.3.5, =2.0, =1.0, =1.6.1.P24, =1.7, =0.0.1, =1.0, =1.1 - com.github.lkkushan101.RestAssuredPDFReport:com.github.lkkushan101.RestAssuredPDFReport =1.00 - com.github.lkkushan101.appiumlocator:com.github.lkkushan101.appiumlocator...

CVE-2018-18450

apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI...

The 4 Core Pillars of Endpoint Security

Cb Connect is always an exciting time for me. At Cb Connect 2017, we unveiled our vision for the Cb Predictive Security Cloud PSC. Over the past year, this platform has expanded and grown to provide better prevention, detection and response for our global customers. Today, at CbConnect18, we...

Facebook Breach Sparks Concerns Around Third-Party Apps, Website Security

Days after Facebook acknowledged a data breach of its platform – impacting 50 million accounts – the company said it has found no evidence that attackers accessed any apps using Facebook Login. But security experts are still on edge that the breach could have let attackers access third-party apps...

Facebook Finds 'No Evidence' Hackers Accessed Connected Third-Party Apps

When Facebook last weekend disclosed a massive data breach—that compromised access tokens for more than 50 million accounts—many feared that the stolen tokens could have been used to access other third-party services, including Instagram and Tinder, through Facebook login. Good news is that...

The Facebook Hack Is an Internet-Wide Failure

Major sites using Facebook's Single Sign-On don't implement basic security features, potentially making the fallout of last week's hack much worse...

Excerpts From “Why Companies Are Replacing AV with Advanced Endpoint Security”

Is legacy antivirus failing to keep your endpoints secure? In Carbon Black's recent webinar, Fulcanelli Chavez, Sr. Security Operations Analyst at D.A. Davidson, shared how switching from McAfee to Cb Defense has improved protection and simplified operations for his team. Below are excerpts from...

Microsoft Windows Server ADFS Server-Side Request Forgery Vulnerability

Microsoft Active Directory Federation Services ADFS is an Active Directory Federation Service from Microsoft. The service provides Web Single Sign-On SSO technology, which enables authentication of a user to multiple websites or applications during a single session. A server-side request forgery...

CVE-2018-17020

ASUS GT-AC5300 devices with firmware through 3.0.0.4.38432738 allow remote attackers to cause a denial of service via a single "GET / HTTP/1.1\r\n" line...

[SECURITY] Fedora 27 Update: zziplib-0.13.69-1.fc27

The zziplib library is intentionally lightweight, it offers the ability to easily extract data from files archived in a single zip file. Applications can bundle files into a single zip archive and access them. The implementat ion is based only on the free subset of compression with the zlib...

RHEL 7 : Red Hat Single Sign-On 7.1 update on RHEL 7 (Moderate) (RHSA-2017:0873)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0873 advisory. Red Hat Single Sign-On is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-o...

RHEL 6 : Red Hat Single Sign-On 7.1 update on RHEL 6 (Moderate) (RHSA-2017:0872)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0872 advisory. Red Hat Single Sign-On is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-o...

CEM - Support for COSU Android Enterprise devices - COSU

Objective Support for COSU Android Enterprise devices Endpoint Management supports the management of corporate owned single use COSU Android Enterprise devices. COSU devices fulfill a single use case, such as digital signage, ticket printing, or inventory management. Administrators restrict these...

August 30, 2018—KB4343894 (Preview of Monthly Rollup)

None None...

Java System Solutions SSO plugin for BMC MyIT Cross Site Scripting Vulnerability

Java System Solutions SSO plugin for BMC MyIT is a single-sign-on plugin for BMC MyIT from Java System Solutions, UK. A cross-site scripting vulnerability exists in Java System Solutions SSO plugin for BMC MyIT version 4.0.13.1. A remote attacker can exploit this vulnerability to inject client-si...

IBM Security Access Manager for Enterprise Single Sign-On Information Disclosure Vulnerability

IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO is a suite of identity and access management software from IBM in the United States that provides single sign-on. A security vulnerability exists in IBM ISAM ESSO version 8.2.2 that stems from the program's failure to set securit...

Authorization

IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be...

CVE-2017-1732

IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be...

CVE-2017-1732

CVE-2017-1732 affects IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2.2, where authorization tokens or session cookies are not marked as Secure. This enables potential disclosure of cookie values if a user clicks an http link or visits a page containing such a link, allo...

Security Bulletin: A security vulnerability has been fixed in IBM Security Access Manager for Enterprise Single-Sign On (CVE-2017-1732)

Summary IBM Security Access Manager for Enterprise Single-Sign On does not set the secure attribute on authorization tokens or session cookies. Vulnerability Details CVEID: CVE-2017-1732 DESCRIPTION: IBM Security Access Manager for Enterprise Single-Sign On does not set the secure attribute on...