Threat Roundup for Jan. 18 to Jan. 25

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 18 and Jan. 25. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

CVE-2019-6290

An infinite recursion issue was discovered in eval.c in Netwide Assembler NASM through 2.14.02. There is a stack exhaustion problem resulting from infinite recursion in the functions expr, rexp, bexpr and cexpr in certain scenarios involving lots of '' characters. Remote attackers could leverage...

PT-2019-5492 · Graphicsmagick +6 · Graphicsmagick +6

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 7.0.8-25 GraphicsMagick versions prior to 1.3.32 Description: The issue is related to memory management errors in the WritePDFImage function of graphic editors ImageMagick and GraphicsMagick. Exploitation of this...

SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2018:3868-1)

java-180-ibm was updated to Java 8.0 Service Refresh 5 Fix Pack 25 bsc1116574 Class Libraries : - IJ10934 CVE-2018-13785 - IJ10935 CVE-2018-3136 - IJ10895 CVE-2018-3139 - IJ10932 CVE-2018-3149 - IJ10894 CVE-2018-3180 - IJ10930 CVE-2018-3183 - IJ10933 CVE-2018-3214 - IJ09315 FLOATING POINT EXCEPTI...

krutoymag.ru XSS vulnerability

Open Bug Bounty ID: OBB-714246 Description| Value ---|--- Affected Website:| krutoymag.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...

angustjones.com XSS vulnerability

Open Bug Bounty ID: OBB-714137 Description| Value ---|--- Affected Website:| angustjones.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

thietbimiendong.vn XSS vulnerability

Open Bug Bounty ID: OBB-714107 Description| Value ---|--- Affected Website:| thietbimiendong.vn Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...

packandgoholiday.com XSS vulnerability

Open Bug Bounty ID: OBB-714101 Description| Value ---|--- Affected Website:| packandgoholiday.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

hiace.com.tw XSS vulnerability

Open Bug Bounty ID: OBB-713946 Description| Value ---|--- Affected Website:| hiace.com.tw Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...

andalousite.fr XSS vulnerability

Open Bug Bounty ID: OBB-713886 Description| Value ---|--- Affected Website:| andalousite.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Facebook bug exposed private photos of 6.8M users to third-party developers

By Waqas Another day, another privacy breach - This time, the social media giant Facebook has announced that a bug in its Photo API exposed private photos of over 6.8 million users to third-party app developers. The breach took place from September 13 to September 25, 2018, which means for 12 day...

Cumulative Update 25 for Microsoft Dynamics NAV 2017 (Build 26396)

Cumulative Update 25 for Microsoft Dynamics NAV 2017 Build 26396 This article applies to Microsoft Dynamics NAV 2017 for all countries and all language locales. Overview This cumulative update includes all hotfixes and regulatory features that have been released for Microsoft Dynamics NAV 2017,...

grupocolae.com XSS vulnerability

Open Bug Bounty ID: OBB-704119 Description| Value ---|--- Affected Website:| grupocolae.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

flippingmastery.com XSS vulnerability

Open Bug Bounty ID: OBB-703652 Description| Value ---|--- Affected Website:| flippingmastery.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

itog.by XSS vulnerability

Open Bug Bounty ID: OBB-703615 Description| Value ---|--- Affected Website:| itog.by Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

iyiou.com XSS vulnerability

Open Bug Bounty ID: OBB-703603 Description| Value ---|--- Affected Website:| iyiou.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

CVE-2018-12158

creationtimestamp| type| source ---|---|--- 2018-11-25 03:19:56+00:00| published-proof-of-concept| https://t.me/N0iSeBit/185...

Security update for MozillaThunderbird (important)

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25 and MFSA 2018-28. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading...

listupp.ru XSS vulnerability

Open Bug Bounty ID: OBB-691320 Description| Value ---|--- Affected Website:| listupp.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

laescueladedecoracion.es XSS vulnerability

Open Bug Bounty ID: OBB-690831 Description| Value ---|--- Affected Website:| laescueladedecoracion.es Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:...