15735 matches found
October 2018 Security Update Release
Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. MSRC team...
October 2018 Security Update Release
Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. MSRC team...
Claromentis Discuss 1.2.1 Cross Site Scripting
Issue: Stored Cross site Scripting XSS on Discuss Module v1.2.1 in Claromentis intranet application Reserved CVE: CVE-2018-15903 Vulnerability OverviewThe Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to Stored Cross Site Scripting XSS. An authenticated attacker is able to place...
DarkSpiritz - A Penetration Testing Framework For UNIX Systems
What is DarkSpiritz? Created by the SecTel Team it was a project of one of the owners to update and clean-up an older pentesting framework he had created to something updated and modern. DarkSpiritz is a re-vamp of the very popular framework known as "Roxysploit". You may be familiar with this...
open62541/fuzz_binary_message: NULL
Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=5738840736661504 Project: open62541 Fuzzer: libFuzzeropen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: libfuzzerubsanopen62541 Platform Id: linux Crash Type: UNKNOWN REA...
open62541/fuzz_binary_message: NULL
Detailed report: https://oss-fuzz.com/testcase?key=5693001825779712 Project: open62541 Fuzzer: libFuzzeropen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: libfuzzerubsanopen62541 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f535163ab78 Crash State: NULL...
Security Bulletin: Vulnerability in SSLv3 affects IBM Rational ClearQuest (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Rational ClearQuest. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this...
FreeBSD : spamassassin -- multiple vulnerabilities (613193a0-c1b4-11e8-ae2d-54e1ad3d6335)
the Apache Spamassassin project reports : In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the 'open' event is immediately followed by a 'close' event - even if the tag does not close in the HTML being parsed. Because...
SharpSploit - A .NET Post-Exploitation Library Written In C#
SharpSploit is a .NET post-exploitation library written in C that aims to highlight the attack surface of .NET and make the use of offensive .NET easier for red teamers. SharpSploit is named, in part, as a homage to the PowerSploit project, a personal favorite of mine! While SharpSploit does port...
Joomla CW Article Attachments 1.0.6 - id SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Joomla! CW Article Attachments 1.0.6 - 'id' SQL Injection Exploit Author: Haboob Team Software Link: https://extensions.joomla.org/extension/cw-article-attachments/ Version: below 1.0.6 CVE : CVE-2018-14592...
skia/image_filter_deserialize: Crash in SkTInternalLList<TriangulationVertex>::addToTail
Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5674426696204288 Project: skia Fuzzer: libFuzzerskiaimagefilterdeserialize Fuzz target binary: imagefilterdeserialize Job Type: libfuzzerubsanskia Platform Id: linux Crash Type: UNKNOWN READ Crash...
team-ncis.com XSS vulnerability
Open Bug Bounty ID: OBB-678716 Description| Value ---|--- Affected Website:| team-ncis.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Security Bulletin: Security vulnerability has been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2018-2973)
Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about multiple security vulnerabilities affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details CVEID: CVE-2018-2973 DESCRIPTION: An unspecifie...
unicorn/fuzz_emu_arm_thumb: Index-out-of-bounds in store_reg_arm
Project: https://github.com/unicorn-engine/unicorn.git Detailed report: https://oss-fuzz.com/testcase?key=5655596519391232 Project: unicorn Fuzzer: libFuzzerunicornfuzzemuarmthumb Fuzz target binary: fuzzemuarmthumb Job Type: libfuzzerubsanunicorn Platform Id: linux Crash Type: Index-out-of-bound...
ManageEngine Multiple Products File Disclosure
File disclosure vulnerability in ManageEngine Firewall Analyzer, NetFlow Analyzer, Network Configuration Manager, OpManager and OpUtils Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...
spamassassin -- multiple vulnerabilities
the Apache Spamassassin project reports: In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag does not close in the HTML being parsed. Because ...
Psychological Aspects of Vulnerability Remediation
In my opinion, Remediation is the most difficult part of Vulnerability Management process. If you know the assets in your organization and can assess them, you will sooner or later produce a good enough flow of critical vulnerabilities. But what the point, if the IT team will not fix them?...
How The ATT&CK™ Framework Can Mature Your Threat Hunting Program
The truth about threat hunting is that it’s a process that matures with your security team. The more you learn more about the threat landscape, the more you can operationalize that knowledge. Because of this, it is important to work within a framework that can help you track the growth of your...
September 2018 Security Update Release
Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. MSRC team...
September 2018 Security Update Release
Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. MSRC team...