866 matches found
Path traversal
Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...
CVE-2021-22114
Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...
Afternoon Cyber Tea: Evaluating individual and organizational cyber risk in a pandemic
Cybersecurity professionals find themselves in high demand as organizations worldwide continue to grapple with how to secure millions of remote workers. James Turner is an industry analyst at CISO Lens and served as an adjudicator from 2017 to 2019 for the Australian government’s cyber war games:...
Micro Focus Operations Bridge Manager Local Privilege Escalation
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Micro Focus Operations Bridge Manager Local Privilege Escalation', 'Description' = %q This module exploits an incorrectly permissioned folder in...
The Untold History of America’s Zero-Day Market
The lucrative business of dealing in code vulnerabilities is central to espionage and war planning, which is why brokers never spoke about it—until now...
'2034: A Novel of the Next World War,' an Exclusive Excerpt
What if things escalated? What if communications were knocked out? What if cyberwar was just the start? A note about this special six-part series...
British Court Rejects U.S. Request to Extradite WikiLeaks' Julian Assange
A British court has rejected the U.S. government's request to extradite Wikileaks founder Julian Assange to the country on charges pertaining to illegally obtaining and sharing classified material related to national security. In a hearing at Westminster Magistrates' Court today, Judge Vanessa...
Donald Trump Could Still Launch Nuclear Weapons at Any Time
The president's responsibility for the US nuclear arsenal is a Cold War anachronism. The Trump era shows why it needs reform...
Behind Anduril’s Effort to Create an Operating System for War
The company, launched by Oculus cofounder Palmer Luckey, is building software to connect multiple Air Force systems—allowing officers to act more quickly...
Swiss-Swedish Diplomatic Row Over Crypto AG
Previously I have written about the Swedish-owned Swiss-based cryptographic hardware company: Crypto AG. It was a CIA-owned Cold War operation for decades. Today it is called Crypto International, still based in Switzerland but owned by a Swedish company. Its back in the news: Late last week,...
Information Disclosure
tapestry-core is vulnerable to information disclosure. Mishandling of URL allows an attacker to use malicious URL to list and download the JAVA webapp files from WEB-INF of the WAR being run...
How to Start Growing and Never Stop
My heritage is Sri Lankan. But, at the age of 15 I moved to France as a refugee, fleeing a civil war. Starting a new life from scratch in France, without speaking French, was certainly an interesting journey. But I was lucky enough to have support from my parents. They lived by the mantra of "whe...
wer-war-hitler.de Cross Site Scripting vulnerability OBB-1332885
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Enigma Machine for Sale
A four-rotor Enigma machine -- with rotors -- is up for auction...
wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)
It was found that the explode function of the deployment utility in jboss-cli and console that allows extraction of files from an archive does not perform necessary validation for directory traversal. This can lead to remote code execution...
Ann Mitchell, Bletchley Park Cryptanalyst, Dies
Obituary...
Cross-site Request Forgery (CSRF)
JBoss is vulnerable to Cross-site request forgery CSRF. flaw was found in the JMX Console. A remote attacker could use this flaw to deploy a WAR file of their choosing on the target server, if they are able to trick a user, who is logged into the JMX Console as the admin user, into visiting a...
Story of Gus Weiss
This is a long and fascinating article about Gus Weiss, who masterminded a long campaign to feed technical disinformation to the Soviet Union, which may or may not have caused a massive pipeline explosion somewhere in Siberia in the 1980s, if in fact there even was a massive pipeline explosion...
The Doomsday Clock Moves Closer Than Ever to Midnight
Since the advent of the clock—even during the peak years of the Cold War—the minute hand has never advanced past the 11:58 mark...
CVE-2019-14768
An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new WebApp WAR file to the Tomcat server via Path Traversal, allowing remote code execution with SYSTEM privileges...