15689 matches found
Security Bulletin: Vulnerability in SSLv3 affects IBM Rational ClearQuest (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Rational ClearQuest. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this...
FreeBSD : spamassassin -- multiple vulnerabilities (613193a0-c1b4-11e8-ae2d-54e1ad3d6335)
the Apache Spamassassin project reports : In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the 'open' event is immediately followed by a 'close' event - even if the tag does not close in the HTML being parsed. Because...
SharpSploit - A .NET Post-Exploitation Library Written In C#
SharpSploit is a .NET post-exploitation library written in C that aims to highlight the attack surface of .NET and make the use of offensive .NET easier for red teamers. SharpSploit is named, in part, as a homage to the PowerSploit project, a personal favorite of mine! While SharpSploit does port...
Joomla CW Article Attachments 1.0.6 - id SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Joomla! CW Article Attachments 1.0.6 - 'id' SQL Injection Exploit Author: Haboob Team Software Link: https://extensions.joomla.org/extension/cw-article-attachments/ Version: below 1.0.6 CVE : CVE-2018-14592...
skia/image_filter_deserialize: Crash in SkTInternalLList<TriangulationVertex>::addToTail
Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5674426696204288 Project: skia Fuzzer: libFuzzerskiaimagefilterdeserialize Fuzz target binary: imagefilterdeserialize Job Type: libfuzzerubsanskia Platform Id: linux Crash Type: UNKNOWN READ Crash...
team-ncis.com XSS vulnerability
Open Bug Bounty ID: OBB-678716 Description| Value ---|--- Affected Website:| team-ncis.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Security Bulletin: Security vulnerability has been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2018-2973)
Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about multiple security vulnerabilities affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details CVEID: CVE-2018-2973 DESCRIPTION: An unspecifie...
unicorn/fuzz_emu_arm_thumb: Index-out-of-bounds in store_reg_arm
Project: https://github.com/unicorn-engine/unicorn.git Detailed report: https://oss-fuzz.com/testcase?key=5655596519391232 Project: unicorn Fuzzer: libFuzzerunicornfuzzemuarmthumb Fuzz target binary: fuzzemuarmthumb Job Type: libfuzzerubsanunicorn Platform Id: linux Crash Type: Index-out-of-bound...
ManageEngine Multiple Products File Disclosure
File disclosure vulnerability in ManageEngine Firewall Analyzer, NetFlow Analyzer, Network Configuration Manager, OpManager and OpUtils Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...
spamassassin -- multiple vulnerabilities
the Apache Spamassassin project reports: In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag does not close in the HTML being parsed. Because ...
Psychological Aspects of Vulnerability Remediation
In my opinion, Remediation is the most difficult part of Vulnerability Management process. If you know the assets in your organization and can assess them, you will sooner or later produce a good enough flow of critical vulnerabilities. But what the point, if the IT team will not fix them?...
How The ATT&CK™ Framework Can Mature Your Threat Hunting Program
The truth about threat hunting is that it’s a process that matures with your security team. The more you learn more about the threat landscape, the more you can operationalize that knowledge. Because of this, it is important to work within a framework that can help you track the growth of your...
September 2018 Security Update Release
Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. MSRC team...
September 2018 Security Update Release
Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. MSRC team...
September 2018 Security Update Release
Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. MSRC team...
MACOS: Need to whitelist Citrix Workspace Kernel Extensions - need Team ID and Bundle ID
Need to whitelist Citrix Workspace Kernel Extensions - need Team ID and Bundle Identifier to load into macOS MDM provider...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Support Assistant Team Server
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8.0 used by IBM Support Assistant Team Server. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID: CVE-2018-2790 DESCRIPTION: An unspecified vulnerability...
Security Bulletin: IBM Support Assistant is affected by a WebSphere Application Server vulnerability
Summary IBM Support Assistant has addressed the vulnerability in WebSphere Application Server affecting installations using Form Login. Vulnerability Details CVEID: CVE-2017-1788 DESCRIPTION: IBM WebSphere Application Server installations using Form Login could allow a remote attacker to conducts...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Support Assistant Team Server (CVE-2014-6457)
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 1.7.0 that is used by IBM Support Assistant Team Server. These issues were disclosed as part of the IBM Java SDK updates in October 2014. One of these vulnerabilities affects the IBM Support...
Fixed in Apache Tomcat 9.0.12
Moderate: Open Redirect CVE-2018-11784 When the default servlet returned a redirect to a directory e.g. redirecting to /foo/ when the user requested /foo a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. This was fixed in revision...