CVE-2017-16020

CVE-2017-16020 affects Summit (Node.js web framework) when using the PouchDB driver. Affected: Summit 0.1.0 and later. Vulnerability: collection names can be manipulated to execute arbitrary commands, enabling remote code execution. Exploitation details across connected sources consistently refer...

CVE-2017-16020

Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name...

PT-2018-6051 · Summit +1 · Summit +1

Name of the Vulnerable Software and Affected Versions: Summit versions 0.1.0 and later Description: The issue allows an attacker to execute arbitrary commands via the collection name when using the PouchDB driver in the module. There is no information about the estimated number of potentially...

summit-tctap.com XSS vulnerability

Open Bug Bounty ID: OBB-621445 Description| Value ---|--- Affected Website:| summit-tctap.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

John Summers Q&A - Evanta Global CIO Executive Summit

Akamai's John Summers, VP & CTO, spoke at the recent Evanta Global CIO Executive Summit, a gathering of 75 major organization CIOs. His session was titled, "Cloud Security - Adopt Zero Trust and Put Asset-Level Safeguards in Place." Here are some of the key questions he addressed. How do you...

Beers with Talos EP 28 - APT, BGP, RCEs, and an Old RAT

Beers with Talos BWT Podcast Episode 28 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP28 Show Notes: Recorded April 27 - We have a special guest intro this week, since Mitch came down wit...

Beers with Talos EP27: Smart Install, Vuln Process Realities, and Professional Wrestling

Beers with Talos BWT Podcast Episode 27 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP27 Show Notes: Recorded 4/13/18 - We just upgraded all our gear, so naturally we had a straight tech...

Beers with Talos EP26: Talos is Holding a Conference, and the Evolving Battle at the Edge

Beers with Talos BWT Podcast Episode 26 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP26 Show Notes: Recorded 3/29/18 - Joel is sitting out this week, and Bill Largent from the Outreach...

Talos Threat Research Summit at Cisco Live US 2018

Cisco Talos presents a conference by Defenders, for Defenders. Talos had one goal in mind when creating a brand new conference: Make something that we'd want to attend ourselves. As such, the Talos Threat Research Summit is aimed at being a one-day conference by defenders, for defenders. This...

The ‘Perfect Storm’ of Disinformation and Hacking

We live in an age of fake news, misinformation and disinformation. Recently, we have been falling for it – mostly. That is largely thanks to a confluence of social media, hacking and good old fashion disinformation campaigns, according to Matt “Pwn all the Things” Tait, a senior cybersecurity...

FireEye’s Marina Krotofil On Triton and ICS Threats

At the Security Analyst Summit this year in Cancun, FireEye’s Marina Krotofil talks about the Triton malware, first disclosed in December 2017, that targets industrial control systems. Krotofil discusses with Threatpost’s Lindsey O’Donnell about the implications of this malware for the...

Vulnerability in Robots Can Lead To Costly Ransomware Attacks

CANCUN, Mexico – A vulnerability in Softbank Robotics’ NAO and Pepper robots can lead to costly ransomware attacks that could cause robots deployed in businesses to stop working, curse at customers, or even perform violent movements. The vulnerability was disclosed at Kaspersky Lab’s Security...

Leaked NSA Dump Also Contains Tools Agency Used to Track Other Hackers

A years ago when the mysterious hacking group 'The Shadow Brokers' dumped a massive trove of sensitive data stolen from the US intelligence agency NSA, everyone started looking for secret hacking tools and zero-day exploits. A group of Hungarian security researchers from CrySyS Lab and Ukatemi ha...

Highlights from the HITRUST Third-Party Assurance Summit

The HITRUST TPA Summit brought together experts representing customers, vendors, and assessor firms in various aspects of risk management to share best practices, lessons learned and effective third-party risk management strategies leveraging the HITRUST CSF Assurance Program and HITRUST Assessme...

summit-mea.com XSS vulnerability

Open Bug Bounty ID: OBB-560324 Description| Value ---|--- Affected Website:| summit-mea.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Healthcare Security Pros Prioritize Sharing and Caring in the Wild, Wild West of Healthcare

Security professionals from healthcare delivery organizations HDOs, medical device manufacturers, and pharmaceutical companies gathered in Scottsdale, Arizona for the NH-ISAC Cyber Rodeo Summit last month. The big topics were how to share more threat intelligence, while at the same time ensuring...

summitceramics.com XSS vulnerability

Open Bug Bounty ID: OBB-472709 Description| Value ---|--- Affected Website:| summitceramics.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...

Look Out! Risk Is on the Move, According to IoT Thought Leaders from Across the Globe

The IoT Security Summit 2017 in New York City in late October and the Security of Things World USA 2017 in San Diego last month were both packed with thought leaders from all parts of the IoT ecosystem - device manufacturers, telecom carriers, cloud providers, and early-adopter end users from...

Carbon Black Named 2017 CDW Silver Partner of The Year

Carbon Black is proud to announce it was recognized as the 2017 CDW Silver Partner of The Year on Thursday November 9 at the 2017 CDW Partner Summit. The award recognizes the CDW partners that have consistently gone above and beyond to provide exceptional support to CDW and its customers. CDW...

Gone Phishing: A Case Study on Conducting Internal Phishing Campaigns

To many, emails are boring. Its been a long time since they were cool, and theyre probably the slowest form of communication in an evolving fast-paced digital world. Nevertheless, there were 215 billion emails exchanged per day in 2016, and that number is growing at 3% annually. It's clear that...