CVE-2018-5304

An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The affected web interface is vulnerable to ClickJacking or UI Redressing: it is possible to access the web application in an iframe, and clicking on the iframe will redirect to a third-party application or...

CVE-2018-5304

An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The affected web interface is vulnerable to ClickJacking or UI Redressing: it is possible to access the web application in an iframe, and clicking on the iframe will redirect to a third-party application or...

CVE-2018-5304

An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The affected web interface is vulnerable to ClickJacking or UI Redressing: it is possible to access the web application in an iframe, and clicking on the iframe will redirect to a third-party application or...

Troubleshooting a 3rd Party Wrapped App

XenMobile: Troubleshooting a 3 rd Party Wrapped App 1. Test with the core .ipa or .apk file.Does the core file work without being wrapped? If yes go to 2. 2. Do other wrapped application works as expected? If yes go to 3. 3. Wrap with the latest toolkit found at:...

UBUNTU-CVE-2018-5157

Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR 52.8 an...

John Summers Q&A - Evanta Global CIO Executive Summit

Akamai's John Summers, VP & CTO, spoke at the recent Evanta Global CIO Executive Summit, a gathering of 75 major organization CIOs. His session was titled, "Cloud Security - Adopt Zero Trust and Put Asset-Level Safeguards in Place." Here are some of the key questions he addressed. How do you...

Multiple remote vulnerabilities (RCE, bof) in Nuuo NVR and NETGEAR Surveillance

Multiple vulnerabilities in NUUO NVRmini2 / NVRsolo / Crystal devices and NETGEAR ReadyNAS Surveillance application Discovered by Pedro Ribeiro [email protected], Agile Information Security http://www.agileinfosec.co.uk/ Disclosure: 04/08/2016 / Last updated: 05/08/2016 Background on the affected...

Phone Maker BLU Settles with FTC Over Unauthorized User Data Extraction

Android phone-maker BLU Products agreed to a proposed settlement on Tuesday with the Federal Trade Commission, over allegations it allowed the third-party firm Adups Technology to collect detailed consumer data from users without their consent. In an administrative complaint filed earlier this we...

PROTECTING YOUR PRIVACY – Part 2: How to Maximize Your Privacy on Social Media and in Your Browser

In the last post we highlighted the privacy risks associated with using popular social networking sites and browsers. You might not appreciate just how much of your personal data is being accessed by advertisers and other third parties via your social media accounts and internet browsing...

Design/Logic Flaw

ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...

CVE-2018-10665

ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...

CVE-2018-10665

CVE-2018-10665 : A cross-site scripting (XSS) vulnerability affects ILIAS 5.3.4, caused by unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files. Multiple connected sources (Red Hat, CNVD, NVD, OSV, CVE lists) confirm the issue as an XSS in ILIAS 5.3.4. The provide...

CVE-2018-10665

ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...

PROTECTING YOUR PRIVACY – Part 1: The Privacy Risks of Social Networks and Online Browsing

Most Americans today spend many of their waking hours online. In fact, we’re up to spending an average of five hours per day just on our mobiles. Much of this time is spent browsing the web or checking in, updating and sharing via our favorite social networks. There’s just one problem: unless you...

IoT Inspector Tool from Princeton

Researchers at Princeton University have released IoT Inspector, a tool that analyzes the security and privacy of IoT devices by examining the data they send across the Internet. They've already used the tool to study a bunch of different IoT devices. From their blog post: Finding 3: Many IoT...

A PowerShell Toolkit for Attacking SQL Server: PowerUpSQL

The PowerUpSQL module includes functions that support SQL Server discovery, auditing for common weak configurations, and privilege escalation on scale. It is intended to be used during internal penetration tests and red team engagements. However, PowerUpSQL also includes many functions that could...

Who is doing what on your network?

Over the past few months, while talking to customers, the topic of Zero Trust Architecture keeps coming up. Seemingly everyone is thinking of implementing the model - which we fully encourage! One of the core components of the principle is the ability to inspect and log all network and system...

Overwhelmed by overchoice at RSA Conference 2018

As over 500 companies vied for mindshare at this years RSA conference - a cacophony of vendors pitching thousands of products from brightly colored booths - it reminded me of how challenging it was for me to separate signal from noise when I was managing global networks. And the rapid growth of...

BD Pyxis

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Public exploits are available. Vendor : Becton, Dickinson and Company BD Equipment : Certain BD Pyxis Products Vulnerability : Reusing a Nonce 2. RISK EVALUATION Successful exploitation of this vulnerability could allow data traffic manipulation,...

Node.js third-party modules: [entitlements] Command injection on the 'path' parameter

Hello again, another command injection, this time on the entitlements module. Module module name: entitlements version: 1.2.0 npm page: https://www.npmjs.com/package/entitlements Module Description check the entitlements of a .app bundle Module Stats 26 downloads in the last day 328 downloads in...