org.apache.jspwiki.it:jspwiki-selenium-tests (>=2.10.0, <=2.10.5), org.apache.jspwiki:jspwiki-markdown (>=2.10.3, <=2.10.5) potentially affected by CVE-2018-20242 via org.apache.jspwiki:jspwiki-war (>=2.10.0, <=2.10.5)

org.apache.jspwiki:jspwiki-war MAVEN version =2.10.0, =2.10.0, =2.10.3, =2.10.5 Source cves: CVE-2018-20242 Source advisory: OSV:GHSA-5Q75-CXCQ-WR26...

org.apache.jspwiki.it:jspwiki-selenium-tests (>=2.10.0, <=2.10.5), org.apache.jspwiki:jspwiki-markdown (>=2.10.3, <=2.10.5) potentially affected by CVE-2018-20242 via org.apache.jspwiki:jspwiki-war (>=2.10.0, <=2.10.5)

org.apache.jspwiki:jspwiki-war MAVEN version =2.10.0, =2.10.0, =2.10.3, =2.10.5 Source cves: CVE-2018-20242 Source advisory: MEND:CVE-2018-20242...

FTW - Framework For Testing WAFs

This project was created by researchers from ModSecurity and Fastly to help provide rigorous tests for WAF rules. It uses the OWASP Core Ruleset V3 as a baseline to test rules on a WAF. Each rule from the ruleset is loaded into a YAML file that issues HTTP requests that will trigger these rules...

SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2018:1183-1)

This update for nodejs6 fixes the following issues : - Fix some node-gyp permissions - New upstream LTS release 6.14.1 : - Security fixes : + CVE-2018-7160: Fix for inspector DNS rebinding vulnerability bsc1087463 + CVE-2018-7158: Fix for 'path' module regular expression denial of service...

SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2018:0952-1)

This update for nodejs4 fixes the following issues : - Fix some node-gyp permissions - New upstream maintenance 4.9.1 : - Security fixes : + CVE-2018-7158: Fix for 'path' module regular expression denial of service bsc1087459 + CVE-2018-7159: Reject spaces in HTTP Content-Length header values...

Adobe Acrobat and Reader Security bypass (APSB18-41: CVE-2018-16044)

A security bypass vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability would allow remote attackers to bypass security tests and protocols on the affected system...

Headless Chrome: DevOps Love It, So Do Hackers, Here’s Why

Google Chrome is the most popular web browser and has been so for almost a decade. Each new version of Chrome brings new usability, security and performance features. This article focuses on the “headless mode” feature that Google released more than a year ago; and, since day one has become very...

Why Malwarebytes decided to participate in AV testing

Starting this month, Malwarebytes began participating in the antivirus software for Windows comparison test performed by AV-test.org. This is uncharted territory for us, as we have refrained from participating in these types of tests since our inception. Although recent testing results show...

Network and Web Pentest Framework: Jok3r

Jok3r is a Python3 CLI application which is aimed at helping penetration testers for network infrastructure and web black-box security tests. Its main goal is to save time on everything that can be automated during network/web pentest in order to enjoy more time on more interesting and challengin...

Microsoft JScript Security Feature Bypass (CVE-2018-8417)

A security bypass vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability would allow remote attackers to bypass security tests and protocols on the affected system...

libvirt security, bug fix, and enhancement update

4.5.0-10 - conf: correct false boot order error during domain parse rhbz1601318 4.5.0-9 - virDomainDefCompatibleDevice: Relax alias change check rhbz1621910 - virDomainDetachDeviceFlags: Clarify update semantics rhbz1621910 - virDomainNetDefCheckABIStability: Check for MTU change too rhbz1623157...

co.cask.cdap:cdap-client-tests (3.0.0), co.cask.cdap:sparkkmeans (>=2.6.3, <=3.0.6) +274 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (8.1.15.v20140411)

org.eclipse.jetty:jetty-server MAVEN version 8.1.15.v20140411 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - co.cask.cdap:cdap-client-tests 3.0.0 - co.cask.cdap:sparkkmeans =2.6.3, =2.6.3, =0.2.0,...

IBM Security AppScan Standard 9.0.3 .udt Denial Of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: IBM Security AppScan Standard 9.0.3 .udt Denial Of Service Author: Kağan Çapar Software Link: http://www-01.ibm.com/support/docview.wss?uid=ibm10715965 Vendor Homepage : https://www.ibm.com/security/application-security/appscan...

io.snamp.features:wrapped-libs-for-tests (2.0.0) potentially affected by CVE-2016-3094 via org.apache.qpid:qpid-broker (0.32)

org.apache.qpid:qpid-broker MAVEN version 0.32 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker and may be impacted: - io.snamp.features:wrapped-libs-for-tests 2.0.0 Source cves: CVE-2016-3094 Source advisory:...

GHSA-XQJ7-J8J5-F2XR Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 bet...

Microsoft Device Guard Code Integrity Policy Security Feature Bypass (CVE-2018-8492)

A security bypass vulnerability exists in Microsoft Device Guard. Successful exploitation of this vulnerability would allow remote attackers to bypass security tests and protocols on the affected system...

Using MITRE ATT&CK When Researching Attacker Behavior in a Post-Compromise World

MITRE ATT&CK is arguably one of the best assets available to security professionals who want to dive into the intricacies of detecting and preventing adversary behaviors. Why is that? It’s a great knowledge base of known adversarial behaviors overlayed with attacker TTPs and their state in the...

Movable Type vulnerable to cross-site scripting

Overview Movable Type provided by Six Apart, Ltd. is a content management system. Movable Type contains a cross-site scripting vulnerability CWE-79. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

CIA Network Exposed through Insecure Communications System

Interesting story of a CIA intelligence network in China that was exposed partly because of a computer security failure: Although they used some of the same coding, the interim system and the main covert communication platform used in China at this time were supposed to be clearly separated. In...

Malicious input could cause uninitialized memory to be exposed

Affected versions of Claxon made an invalid assumption about the decode buffer size being a multiple of a value read from the bitstream. This could cause parts of the decode buffer to not be overwritten. If the decode buffer was newly allocated and uninitialized, this uninitialized memory could b...