node-tkinter is malware

The node-tkinter package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security...

CVE-2017-18314

CVE-2017-18314 affects Qualcomm closed‑source components. The entry notes that on TZ cold boot the CNOC_QDSS RG0, which is locked by xBL_SEC, is cleared by TZ. This is categorized as a Critical issue in the Qualcomm closed‑source component list and is referenced in Android/industry bulletins. The...

giro.com XSS vulnerability

Open Bug Bounty ID: OBB-671688 Description| Value ---|--- Affected Website:| giro.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

August 30, 2018—KB4343893 (OS Build 16299.637)

None None...

GHSA-QJ73-V688-WQXF Hijacked Environment Variables in proxy.js

The proxy.js package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security concer...

qualitysportswear.ca XSS vulnerability

Open Bug Bounty ID: OBB-661180 Description| Value ---|--- Affected Website:| qualitysportswear.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

GHSA-X52F-H74P-9JH8 node-sqlite is malware

The node-sqlite package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security...

chromium-browser: leak of page thumbnails in new tab page

Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail images after clearing browser data via a crafted HTML page...

lionbrand.com XSS vulnerability

Vulnerable URL: http://www.lionbrand.com/clearance?delid=%22%3E%3Csvg/onload=alert%27OPENBUGBOUNTY%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 08.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 67194 VIP website status:| N...

CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

MGASA-2017-0253 Updated varnish packages fix security vulnerability

A denial of service vulnerability was discovered in Varnish, a state of the art, high-performance web accelerator. Specially crafted HTTP requests can cause the Varnish daemon to assert and restart, clearing the cache in the process CVE-2017-12425...

Sweden Accidentally Leaks Personal Details of Nearly All Citizens

Another day, Another data breach! This time sensitive and personal data of millions of transporters in Sweden, along with the nation's military secrets, have been exposed, putting every individual's as well as national security at risk. Who exposed the sensitive data? The Swedish government itsel...

Session Fixation

clearance is vulnerable to session fixation attacks. These attacks are possible because the CSRF token is not rotated on sign in...

Apache MyFaces Trinidad CVE-2016-5019 Remote Code Execution Vulnerability

Description Apache MyFaces Trinidad is prone to a security vulnerability. Successfully exploiting this issue allows attackers to obtain sensitive information or execute arbitrary code in the context of the affected application. Apache MyFaces Trinidad 1.2.14-core , 1.0.13-core , 2.0.1-core and...

FBI 'Double Agent' Pleads Guilty to Selling 'Classified Information' to China

An FBI electronics technician has pleaded guilty to acting as a Chinese secret agent and passing along sensitive information about the Feds to a Chinese government official. Kun Shan "Joey" Chun, 46, admitted in federal court in Manhattan on Monday that he violated his security clearance on sever...

MGASA-2016-0214 Updated chromium-browser-stable packages fix security vulnerabilities

Chromium-browser-stable 51.0.2704.63 fixes security issues: cross-origin bypass problems in extensions bindings CVE-2016-1672 and CVE-2016-1676, blink CVE-2016-1673 and CVE-2016-1675, and extensions CVE-2016-1674 heap use-after free bugs in V8 bindings CVE-2016-1679, Skia CVE-2016-1680, and...

Hack the Pentagon DOD Bug Bounty

MIAMI—Lisa Wiswell’s phone rang off the hook last summer in the throes of the OPM hack. But she wasn’t just answering questions from those whose security clearance and personal data disappeared into the Chinese ether; there were also hackers on the other end of the line offering their help...

High school Student Hacked Into CIA Director's Personal Email Account

A self-described teenage hacker has claimed to have hacked into personal AOL email account of Central Intelligence Agency CIA Director John Brennan and swiped sensitive top-secret data. It's Really a major embarrassment for Brennan as well as the CIA. The hacker, who describes himself as an...

5.6 Million Fingerprints Stolen In OPM Hack

It turns out roughly 5.6 million federal employees may have had their fingerprints stolen as part of this year’s mammoth Office of Personnel Management breach – a figure five times what the agency initially announced in June. OPM press secretary Sam Schumach broke the bad news Wednesday morning,...

Federal CISOs Propose New Efforts to Shore Up Govt. Cybersecurity

Nearly six months removed from the OPM hack and with many government departments still reeling when it comes to security, several federal chief information security officers volunteered a handful of new ideas at last week’s Billington Cybersecurity Summit in Washington, D.C to combat future hacks...