Small compilation of interesting sites related with IT Security

I am not checking them at regular intervals but i hope they still work and are relevant.

Please provide me some feedback if for some reason they are not relevant or working anymore.

CVE-2019-0232

New vulnerability that requires attention from the users that run the apache / tomcat from windows machines.

source:

http://mail-archives.us.apache.org/mod_mbox/www-announce/201904.mbox/%3C13d878ec-5d49-c348-48d4-25a6c81b9605%40apache.org%3E

“When running on Windows with enableCmdLineArguments enabled, the CGI
Servlet is vulnerable to Remote Code Execution due to a bug in the way
the JRE passes command line arguments to Windows. The CGI Servlet is
disabled by default. The CGI option enableCmdLineArguments is disabled
by default in Tomcat 9.0.x (and will be disabled by default in all
versions in response to this vulnerability)”

Difference between Filtered vs Closed Ports

During nmap scans we found several times responses that say port closed and port filtered.

Example:

PORT      STATE    SERVICE
22/tcp    open     ssh
443/tcp   open     https
1024/tcp  filtered kdm
1084/tcp  filtered ansoft-lm-2
1863/tcp  filtered msnp
3128/tcp  open     squid-http
3333/tcp  filtered dec-notes
4900/tcp  filtered hfcs
9943/tcp  filtered unknown
30000/tcp open     unknown
38292/tcp filtered landesk-cba
40911/tcp filtered unknown
52673/tcp filtered unknown

If you get a response closed it means that the scanner is receiving a TCP reset packet.

If you do not get any response it means that the port is not available and thus changing the scan time that is required to fulfill the scan as the scanner needs to do more tests to make sure that there is no service available in the scanned port.

The best way to remove this information from your scan results is to use the option –open in the nmap. If we use it we will only get the results for open ports.