CISO Kit — Breach Protection in the Palm of Your Hand

CISOs and CIOs need to know better than anyone the security pulse of their organizations. On the other hand, they cannot be flooded with every changing detail. Finding the right balance that enables them to clearly grasp the big picture required in making sound decisions is a task many security...

CVE-2019-6791

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control issue 3 of 3. When a project with visibility more permissive than the target group is imported, it will retain its prior visibility...

Design/Logic Flaw

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control issue 3 of 3. When a project with visibility more permissive than the target group is imported, it will retain its prior visibility...

CVE-2019-6791

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control issue 3 of 3. When a project with visibility more permissive than the target group is imported, it will retain its prior visibility...

CVE-2019-6791

Removed by vendor...

How To Handle Evolutions in Cybercrime

Cybercriminals are Evolving Attackers are constantly evolving their techniques—finding ways to evade your defenses and stay in your systems longer. Today, 68% of attacks remain undetected for months or more. Traditional antivirus AV can’t hold up against the modern hacker. New attacks, like...

GitLab Restriction Bypass Vulnerability (CNVD-2019-31323)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b68cc195-cae7-11e9-86e9-001b217b3468)

Gitlab reports : Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure Use...

Trend Micro Named A Leader in 2019 Gartner Magic Quadrant for Endpoint Protection Platforms

Leadership. It’s a weighty term, although frequently it is used too lightly and all too often it’s a self-declared position. We believe, leaders can come and go, and leadership can be fleeting depending on the factors for long term success. It is for all these reasons, that we are proud, not only...

CVE-2019-15074

CVE-2019-15074 describes a stored XSS in MantisBT (Timeline feature in my_view_page.php) affecting versions up to 2.21.1. The vulnerability occurs when an attacker uploads an attachment with a crafted filename; the injected script is executed for any user who can view the issue when My View Page ...

Alleviating Digital Transformation Performance and Security Concerns

Businesses across the world are migrating applications to the cloud to reduce IT cost and complexity, and accelerate the pace of innovation. But when you move applications and services to the cloud you lose visibility and control over your infrastructure, increasing risk and uncertainty. That's w...

Good Twitter Samaritans accidentally prevent shoeshine scam

A few days ago, Indian news portals were buzzing with tales of a well-worn shoeshine scam making its way into social media. It’s a great example of how good-natured gestures can unwittingly aid scammers when we combine high-visibility accounts with potential lack of fact checking. Thankfully, it...

Lessons Learned from the Incident Response Trenches: Investigating and Eradicating Kwampirs

Kroll has deployed CB Response during hundreds of cyber investigations because it can provide insights throughout each stage of the incident response IR process see graphic. One of Kroll’s recent investigations, which involved the Kwampirs malware, illustrates how CB Response helps uncover critic...

Tackling the Collaboration Conundrum

It’s 8 a.m. and you’ve just polished off a full cup of dark-roast coffee to jump-start your day. After booting up your PC, you instinctively open up Outlook, along with Slack or Teams or TeamViewer. While chatting with a co-worker, you recall that you need to send administrative credentials to he...

mpg123/decode_fuzzer: Heap-buffer-overflow in INT123_parse_new_id3

Detailed report: https://oss-fuzz.com/testcase?key=5081170552815616 Project: mpg123 Fuzzer: aflmpg123decodefuzzer Fuzz target binary: decodefuzzer Job Type: aflasanmpg123 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6040000000c0 Crash State: INT123parsenewid3...

Through the Years: an Inside Look at Carbon Black Technology

An early Carbon Black customer and Red Canary detection engineer provides perspective on Carbon Black’s technology evolutions. This post was originally published by our partner Red Canary on May 30, 2019. Back in 2013, I was one of the first security professionals to deploy Carbon Black. This was...

CVE-2019-13475

In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute...

Rapid Incident Response Now Available through Cynet’s Free IR Service Providers Offering

Organizations are increasingly outsourcing incident response situations to service providers. This is taking place across the spectrum – from cyber mature companies with highly staffed SOCs, to small operations with no dedicated security personnel. This keeps the IR providers busy, putting the on...

Cynet Launches Free Offering For Incident Response Service Providers

More and more, organizations take the route of outsourcing incident response to Managed Security Service Providers. This trend is distinct regardless of the organization's cyber maturity level and can be found across a wide range of cyber maturity, from small companies with no dedicated security...

Cynet Launches Free Offering For Incident Response Service Providers

More and more, organizations take the route of outsourcing incident response to Managed Security Service Providers. This trend is distinct regardless of the organization's cyber maturity level and can be found across a wide range of cyber maturity, from small companies with no dedicated security...