New Relic: CSRF at adding new role (user-management.service.newrelic.com)

Hey New Relic security team, I have discovered a CSRF-vulnerability allowing attacker to create new custom role on behalf of victim. The role creation endpoint does not implement correct CSRF-protection so it can be bypassed. The exploited works fine at least at latest Firefox browser. Steps to...

RSAC 2019: 58% of Orgs Have Unfilled Cyber Positions

SAN FRANCISCO – Much has been made of the cybersecurity workforce gap, and it appears to be a persistent issue: A full 69 percent of respondents in a recent survey said that they have cybersecurity teams that are understaffed. According to ISACA’s State of Cybersecurity 2019 survey, released at t...

Professional Services Simplified - Check out what's new!

In today's fast-moving digital world, we know businesses need to rapidly adapt to meet user expectations and stay competitive. At Akamai, we see a world of unimagined potential, enabled through the unique power of the Akamai Edge. It's this power, backed by the support of our 2000 global experts,...

Apache UNO API Remote Code Execution Vulnerability

When Apache OpenOffice and LibreOffice are spawn as an office server, they bind an Apache UNO API that allows for remote code execution. Dear reader, I am not sure if I am contacting through the right email address but someone said I should e-mail you guys. I found an RCE functionality in the...

ffmpeg/ffmpeg_AV_CODEC_ID_MPEG4_fuzzer: Heap-buffer-overflow in mpeg4_decode_studio_block

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5769760178962432 Project: ffmpeg Fuzzer: aflffmpegAVCODECIDMPEG4fuzzer Fuzz target binary: ffmpegAVCODECIDMPEG4fuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

6 Pieces of Tech Every Office Needs

By Carolina Before you start buying any technology or furniture for your office, you must put in some planning and research time. There are so many options to consider and each one will have a direct impact on the functionality of your workspace and, as result, how productive you and your team ar...

SALT - SLUB ALlocator Tracer For The Linux Kernel

Welcome to salt , a tool to reverse and learn kernel heap memory management. It can be useful to develop an exploit, to debug your own kernel code, and, more importantly, to play with the kernel heap allocations and learn its inner workings. This tool helps tracing allocations and the current sta...

openthread/radio-receive-done-fuzzer: Crash in ot::Buffer::GetNextBuffer

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5727516331868160 Project: openthread Fuzzer: libFuzzeropenthreadradio-receive-done-fuzzer Fuzz target binary: radio-receive-done-fuzzer Job Type: libfuzzerubsanopenthread Platform Id: linux...

opencv/imdecode_fuzzer: Crash in jp2_box_get

Project: https://github.com/opencv/opencv.git Detailed report: https://oss-fuzz.com/testcase?key=5665823442599936 Project: opencv Fuzzer: libFuzzeropencvimdecodefuzzer Fuzz target binary: imdecodefuzzer Job Type: libfuzzerubsanopencv Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

envoy/config_fuzz_test: Heap-use-after-free in std::__1::__bucket_list_deallocator<std::__1::allocator<std::__1::__hash_node_ba

Project: https://github.com/envoyproxy/envoy.git Detailed report: https://oss-fuzz.com/testcase?key=5666128418832384 Project: envoy Fuzzer: libFuzzerenvoyconfigfuzztest Fuzz target binary: configfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

drupal -- Drupal core - Highly critical - Remote Code Execution

Drupal Security Team Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases...

A week in security (February 11 – 17)

Last week on Malwarebytes Labs we discussed the return of the Sextortion Bitcoin scams, we gave you an early overview of the exploit kits in the winter of 2019, we talked about the destruction of VFEmail service, for consumers we discussed whether you should remove yourself from social media, for...

qdPM 9.1 - 'type' Cross-Site Scripting

=========================================================================================== Exploit Title: qdPM 9.1 - 'type' XSS Injection CVE: CVE-2019-8391. Date: 14-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...

qdPM 9.1 - search_by_extrafields[] SQL Injection Vulnerability

Exploit for php platform in category web applications =========================================================================================== Exploit Title: qdPM 9.1 - 'searchbyextrafields' SQL Injection Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...

qdPM 9.1 - search_by_extrafields[] SQL Injection

qdPM 9.1 - searchbyextrafields SQL Injection =========================================================================================== Exploit Title: qdPM 9.1 - 'searchbyextrafields' SQL Injection Date: 14-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...

qdPM 9.1 - 'search_by_extrafields[]' SQL Injection

=========================================================================================== Exploit Title: qdPM 9.1 - 'searchbyextrafields' SQL Injection Date: 14-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...

Microsoft Team Foundation Server Cross-Site Scripting Vulnerability (CNVD-2019-24386)

Microsoft Team Foundation Server is a source code management, project management, and team collaboration platform within an application lifecycle management ALM tool suite. A cross-site scripting vulnerability in Microsoft Team Foundation Server 2018 Update version 3.2, which stems from the progr...

Security Updates for Microsoft Team Foundation Server (February 2019)

The Microsoft Team Foundation Server installation on the remote host is missing security updates. It is, therefore, affected by multiple cross-site scripting vulnerabilities. An authenticated attacker could exploit the vulnerability by sending a specially crafted payload to the Team Foundation...

Joomla PhocaMaps 3.0.5 Database Disclosure / SQL Injection

Exploit Title : Joomla PhocaMaps 3.0.5 SQL Injection / Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : phoca.cz/phocamaps Software Download Link : phoca.cz/download/category/38-phoca-maps-plugin Software Informati...

Team Foundation Server Cross-site Scripting Vulnerability

A Cross-site Scripting XSS vulnerability exists when Team Foundation Server does not properly sanitize user provided input. An authenticated attacker could exploit the vulnerability by sending a specially crafted payload to the Team Foundation Server, which will get executed in the context of the...