Hacked Password Service Leakbase Goes Dark

Leakbase, a Web site that indexed and sold access to billions of usernames and passwords stolen in some of the world largest data breaches, has closed up shop. A source close to the matter says the service was taken down in a law enforcement sting that may be tied to the Dutch police raid of the...

Feds Seize Over 20,500 Domain Names For Selling Counterfeit Products

In a coordinated International cyber operation, law enforcement agencies have seized over 20,520 website domains for illegally selling counterfeit products, including luxury products, sportswear, electronics, pharmaceuticals and online piracy on e-commerce platforms and social networks...

CVE-2017-8864

Client-side enforcement using JavaScript of server-side security options on the Cohu 3960HD allows an attacker to manipulate options sent to the camera and cause malfunction or code execution, as demonstrated by a client-side "if !passwordsAreEqual" test...

Code injection

Client-side enforcement using JavaScript of server-side security options on the Cohu 3960HD allows an attacker to manipulate options sent to the camera and cause malfunction or code execution, as demonstrated by a client-side "if !passwordsAreEqual" test...

Australia’s “Essential Eight” is Critical to Meet 2018 Cybersecurity Mandates & Privacy Laws

Christopher Strand, Carbon Black’s security risk and compliance officer recently wrote a blog discussing how the new mandatory data breach notification rule in the Privacy Amendment Notifiable Data Breaches Bill 2016, helps bring attention to cybersecurity solutions and focus on the practices...

CVE-2017-8700

A flaw was found in dotNET where the CORS attribute is not properly enforced or checked. An attacker could leverage this for possible remote execution...

SUSE-SU-2017:2971-1 Security update for samba

This update for samba fixes several issues. These security issues were fixed: - CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file, leaking information from the server to the client bsc1058624. - CVE-2017-12150: Always enforce smb signing when it is configured...

Cybercriminal Undergrounds: Social and Economic Philosophies

When you think of a hacker, what's the first thing that comes to mind? It might be a lone person typing away in a dark room, an image commonly represented in movies and television. However, the world of cybercrime is much more sophisticated than this. Attackers are forming groups to create larger...

Texas Shooter’s Phone Encrypted

Government and law enforcement officials may soon reignite the debate over encryption after the FBI today revealed that the dead suspect in Sunday’s Texas church shooting was using an encrypted cellphone. FBI special agent Christopher Comb did not reveal what type of phone alleged shooter Devin...

samba: Some code path don't enforce smb signing, when they should (incomplete fix of CVE-2017-12150)

It was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6...

Google Chrome Omnibox Domain Spoofing Vulnerability - Mac OS X

Google Chrome is prone to a domain spoofing vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

CVE-2017-12625

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

Code injection

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

USN-3470-1 linux vulnerabilities

Qian Zhang discovered a heap-based buffer overflow in the tipcmsgbuild function in the Linux kernel. A local attacker could use to cause a denial of service system crash or possibly execute arbitrary code with administrative privileges. CVE-2016-8632 Dmitry Vyukov discovered that a race condition...

Google Chrome Domain Spoofing Vulnerability (CNVD-2017-33606)

Google Chrome for Mac is a Mac-based web browser developed by Google.Omnibox is one of the real-time search engines. A security vulnerability exists in Omnibox in Google Chrome for Mac, which stems from the program's failure to adequately enforce policies. The vulnerability can be exploited by a...

CVE-2017-6160

In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously crafted HTTP request to cause Traffic Management Microkernel TMM to restart and temporarily fail to process traffic. This issue is exposed on virtual servers...

CVE-2017-6160

In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously crafted HTTP request to cause Traffic Management Microkernel TMM to restart and temporarily fail to process traffic. This issue is exposed on virtual servers...

CVE-2017-6160

In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously crafted HTTP request to cause Traffic Management Microkernel TMM to restart and temporarily fail to process traffic. This issue is exposed on virtual servers...

CVE-2017-5105

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

CVE-2017-5105

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...