 A program called Windows Exploit Suggester - Next Generation, or WES-NG, has been released that will list the known vulnerabilities affecting a Windows installation, any exploits that are available, and what security updates are needed to patch the bugs. WES-NG was created by security researcher Arris Huijgen, who based his project off the Windows-Exploit-Suggester program that was originally released in 2014 by GDS Security, now known as AON Security. The original program stopped working when Microsoft stopped updating its Microsoft Security Bulletin Data Excel file and switched to the Microsoft Security Response Center API. This program works by comparing a Windows SystemInfo report with a downloaded CSV file of known vulnerabilities and their associated security updates. Using this data, Windows Exploit Suggester will display a report showing all of the unpatched vulnerabilities found on the computer and their respective CVE IDs, Microsoft knowledge base article numbers, and a link to any known exploits for that vulnerability. According to the project's description, every version of Windows between Windows XP and Windows 10, including the Windows Server counterparts, is supported. For those who want to focus on specific vulnerabilities and filter out the rest, users can utilize the --hide flag to specify those vulnerabilities that should be filtered. For example, to filter out Edge vulnerabilities you can use the wes.py systeminfo.txt --hide Edge command. For more refer to OUR FORUM.  Adobe today released emergency updates that fix a critical vulnerability for the ColdFusion web app development platform. The bug can lead to arbitrary code execution and has been exploited in the wild. The security issue allows an attacker to bypass restrictions for uploading files. To take advantage of it, the adversary has to be able to upload executable code to a directory of files on a web server. The code can then be executed via an HTTP request, Adobe says in its security bulletin. All ColdFusion versions that do not have the current updates are affected by the vulnerability (CVE-2019-7816), regardless of the platforms, they are for. Charlie Arehart, an independent consultant credited for reporting the vulnerability, told us that he discovered the bug when it was used against one of his clients. If applying the latest updates is not possible at the moment, one method to mitigate the risk is to create restrictions for requests to directories that store uploaded files. Developers should also modify their code to disallow executable extensions and check the list themselves, as is recommended by the Adobe Coldfusion guidelines. They also add the option "Blocked file extensions for CFFile uploads" to the server settings menu to create a list of extensions that should not be uploaded by the cffile tag/functions. More complete details are posted on OUR FORUM.  Facebook currently faces 10 investigations into whether the company — including its WhatsApp and Instagram platforms — violated new European privacy laws, which are stricter than their U.S. counterparts. But it's not the only one. Facebook, Twitter, Apple, and LinkedIn are all being probed by Ireland’s Data Protection Commission, for violating the European Union's General Data Protection Regulation, or GDPR, which was implemented in May 2018, the agency revealed in a report released on Thursday. Ireland's DPC is the lead regulator for the European Union because so many of the multinational tech giants have their European headquarters there. In September, Facebook announced a problem in its "View As" feature that led to an attack on almost 30 million accounts. In December the company announced a software bug that exposed the photos of nearly seven million users to third-party apps without user consent. Three of the potential GDPR violations are related to the September breach, which the company self-reported to the DPC, according to the report. Regulators are examining whether Facebook correctly handled notifying European authorities of the breach and user data. Two probes are focused on WhatsApp, which is often considered the most secure of the platforms because of its end-to-end encryption. One is related to how it handles user privacy and how it shares information with Facebook outside of the app. Twitter and Apple also face two probes each. LinkedIn, which is owned by Microsoft, faces one. While one of the probes against Twitter comes after it self-reported a "large number of breaches," the company is also being investigated for how much access users have to their own data. Is anybody safe from GDPR find out on OUR FORUM? |
Latest Articles
|