vulhub

This is an open-source collection of pre-built vulnerable docker environments. It is not a PoC exploit for a specific CVE, but rather a toolkit for testing and training purposes. The repository contains a variety of vulnerable environments, including Flask SSTI, Apache Parsing Vulnerability, and...

vulhub

This is an open-source collection of pre-built vulnerable docker environments. It is an offensive tool for testing and training purposes. The primary CVE ID is not specified, but the repository contains various vulnerable environments based on Docker-Compose, including ones for Flask, Apache, and...

Game-based learning platform provides full immersion into cybersecurity

Working and learning have gone remote, and we have to come to terms with this new reality. Nowadays, several organizations allow their staff to work from home permanently. Most universities consider reducing classroom time wherever possible, and now we are seeing the demand for online courses sky...

Operational resilience in a remote work world

Microsoft CEO Satya Nadella recently said, “We have seen two years’ worth of digital transformation in two months.” This is a result of many organizations having to adapt to the new world of document sharing and video conferencing as they become distributed organizations overnight. At Microsoft, ...

The vulnerability of the OTA Training Activities sub-component of the Oracle Learning Management component in the Oracle E-Business Suite system allows a malicious user to gain access to and modify data.

The vulnerability of the OTA Training Activities sub-component of the Oracle Learning Management component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to gain access to read, modify, add, or delete data...

Empowering your remote workforce with end-user security awareness

COVID-19 has rapidly transformed how we all work. Organizations need quick and effective user security and awareness training to address the swiftly changing needs of the new normal for many of us. To help our customers deploy user training quickly, easily and effectively, we are announcing the...

Exploit for Improper Input Validation in Redhat Openshift

This is a pre-built vulnerable environment based on Docker-Compose, provided by Vulhub. The repository contains a collection of vulnerable environments, each with its own set of vulnerabilities and exploits. The repository is designed to be easy to use, with a simple installation process and a...

Cybersecurity Needs to Go Back to the Basics

This is part of our ongoing conversation about the worldwide challenges of working remotely. To stay up-to-date on the latest insights, refer to our live page for COVID-19: Cybersecurity Community Resources. This piece was co-authored with support from Optiv. Security teams have spent decades...

Housemates. The new Red Team?

You have the VPN set up, you have 2FA, you have a good enforced password policy, firewalls are in place, you even managed to squeeze in some remote training to make employees more aware of potential phishing. You stop, breathe a sigh of relief, and then think… I've no idea who my employees live...

Anti-Phishing process with advanced phishing attacks simulation

This time I want to write about the service of my friends from Antiphish. They call it “security awareness and employee behaviour management platform”. Simply put, they teach company employees how to detect and avoid phishing attacks. By the way, they are great guys, made a demo for me, prepared...

Critical Bugs Found in 3 Popular e-Learning Plugins for WordPress Sites

Security researchers are sounding the alarm over newly discovered vulnerabilities in some popular online learning management system LMS plugins that various organizations and universities use to offer online training courses through their WordPress-based websites. According to the Check Point...

What does it take to become a good reverse engineer?

How much money and effort does it take to become a good reverse engineer? Do you even need to be one? There are no universally acceptable answers to these questions. Software reverse engineering RE is not a science but a skillset combined with specific knowledge and backed by a lot of experience...

The DoD Isn't Fixing Its Security Problems

It has produced several reports outlining what's wrong and what needs to be fixed. It's not fixing them: GAO looked at three DoD-designed initiatives to see whether the Pentagon is following through on its own goals. In a majority of cases, DoD has not completed the cybersecurity training and...

You can’t build a great IoT system without a strong foundation

Introduction Building a secure IoT system requires secure IoT devices, and building a secure IoT device requires a strong foundation. The hardware in the device must support and enable security. Too often, we've found that IoT products use innappropriate hardware. Worse still, many devices contai...

Unspecified Vulnerability in Oracle Learning Management

Oracle E-Business Suite is in the original Application ERP based on the expansion, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management and so on a variety of management software collection, is a seamless integration of a management...

Welcoming a more diverse workforce into cybersecurity: expanding the pipeline

Despite much focus on increasing the number of women in cybersecurity, as an industry we are still falling short. For many companies the problem starts with the tech pipeline—there just aren’t enough resumes from qualified female candidates. But I think the real problem is that our definition of...

UPDATE: MITRE CALDERA 2.6.5

MITRE CALDERA 2.6.5 is now available! My last post about CALDERA from MITRE was about MITRE CALDERA 2.5.1 and as you remember, this awesome adversary emulation system was listed in my older post titled – List of Adversary Emulation Tools. This release includes a new plugin – Training. It has been...

CVE-2020-10510

CVE-2020-10510 affects Sunnet eHRD (human training and development management system). According to the provided documents, it involves Broken Access Control where, after login, an attacker can access an unauthorized URL to reach restricted functionality and data. The CVSS metrics from NVD indica...

CVE-2020-10509

CVE-2020-10509 affects Sunnet eHRD (Web application). The connected CNVD entry reports a Cross-Site Scripting (XSS) vulnerability caused by lack of proper validation of client-side data in the WEB application, allowing an attacker to execute client-side code via XSS. NVD reiterates XSS with injec...

CVE-2020-10508

CVE-2020-10508 affects Sunnet eHRD, a human training and development management system. The vulnerability is an information-disclosure flaw caused by improper storage of system files, enabling an attacker to access confidential information via a specific URL. Multiple sources (NVD and CVE lists) ...