Flaw in Microsoft Outlook Lets Hackers Easily Steal Your Windows Password

A security researcher has disclosed details of an important vulnerability in Microsoft Outlook for which the company released an incomplete patch this month—almost 18 months after receiving the responsible disclosure report. The Microsoft Outlook vulnerability CVE-2018-0950 could allow attackers ...

Climbing the Ladder: Zero Trust, Single Sign-On, Multiple Applications

It is understood that there is a significant amount of complexity to securing today's enterprise, especially as more services and applications move to the cloud and a Zero Trust security model is employed. We at Akamai are actively engaged in helping enterprises adjust to a Zero Trust security...

Microsoft Outlook retrieves remote OLE content without prompting

Overview When a Rich Text RTF email is previewed in Microsoft Outlook, remotely-hosted OLE content is retrieved without requiring any additional user interaction. This can leak private information including the user's password hash, which may be cracked by an attacker. Description Microsoft Outlo...

CVE-2017-12090

An exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below. A specially crafted snmp-set request, when sent without associated firmware flashing snmp-set commands, can cause a device power cycle...

Node.js third-party modules: [angular-http-server] Server Directory Traversal

I would like to report a Server Directory Traversal vulnerability in angular-http-server. It allows reading local files on the target server. Module module name: angular-http-server version: 1.4.3 npm page: https://www.npmjs.com/package/angular-http-server Module Description A very simple...

CPU usage at 100% when you move files in Windows Server 2008

CPU usage at 100% when you move files in Windows Server 2008 Symptoms After installing security update 4041995 or any other recent update that includes srv2.sys, CPU usage may spike up to 100% when you perform any type of SMB activity, such as copying files over the network. The problem is...

FTP path trickery leads to NIL byte out of bounds write

curl can be fooled into writing a zero byte out of bounds. This bug can trigger when curl is told to work on an FTP URL, with the setting to only issue a single CWD command --ftp-method singlecwd or the libcurl alternative CURLOPTFTPFILEMETHOD. curl then URL-decodes the given path, calls strlen o...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.2.1 security update

Red Hat Single Sign-On 7.2.1 is now available for download from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2018-1443

An XML parsing vulnerability affects IBM SAML-based single sign-on SSO systems IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a differe...

IBM Tivoli Federated Identity Manager SSO XML Parsing Vulnerability

IBM Tivoli Federated Identity Manager is an access management solution that provides Web and federated SSO to end users across multiple applications. An XML parsing vulnerability exists in the Security Assertion Markup Language SAML-based single sign-on SSO system in IBM Tivoli Federated Identity...

Application Security Testing — The Wallarm Approach

Testing the security of the corporate applications is a part of every-day life for Ops and DevOps professionals. Larger companies have whole teams dedicated to independent security testing, called Red Teams. These folks use various tools at their disposal to discover the flaws in both application...

OpenJDK: SingleEntryRegistry incorrect setup of deserialization filter (JMX, 8186998)

It was discovered that the JMX component of OpenJDK failed to properly set the deserialization filter for the SingleEntryRegistry in certain cases. A remote attacker could possibly use this flaw to bypass intended deserialization restrictions...

OpenJDK: SingleEntryRegistry incorrect setup of deserialization filter (JMX, 8186998)

It was discovered that the JMX component of OpenJDK failed to properly set the deserialization filter for the SingleEntryRegistry in certain cases. A remote attacker could possibly use this flaw to bypass intended deserialization restrictions...

Dr. Mine - Tool To Aid Automatic Detection Of In-Browser Cryptojacking

Dr. Mine is a node script written to aid automatic detection of in-browser cryptojacking. The most accurate way to detect things that happen in a browser is via browser itself. Thus, Dr. Mine uses puppeteer to automate browser thingy and catches any requests to online cryptominers. When a request...

CVE-2018-7211

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials...

CVE-2018-6911

The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument aka the command parameter...

LuLu - macOS Firewall That Aims To Block Unauthorized (Outgoing) Network Traffic

LuLu is the free open-source macOS firewall that aims to block unauthorized outgoing network traffic, unless explicitly approved by the user: Full details and usage instructions can be found here. It's also important to understand LuLu's limitations! Some of these will be addressed as the softwar...

Task Rabbit Clone SQL Injection Vulnerability

Task Rabbit Clone is a set of PHP-based scripts for online service marketplace websites. A SQL injection vulnerability exists in Task Rabbit Clone version 1.0. A remote attacker can inject SQL commands by sending the 'id' parameter to the singleblog.php file...

CVE-2018-6363

SQL Injection exists in Task Rabbit Clone 1.0 via the singleblog.php id parameter...

aromariserva.com XSS vulnerability

Open Bug Bounty ID: OBB-548568 Description| Value ---|--- Affected Website:| aromariserva.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...