Denial of Service Vulnerability in Jiangmin Optimization Expert WfpNetLimiter Driver

Jiangmin Optimization Expert is a completely free computer optimization software that is purely a tool. A denial of service vulnerability exists in the Jiangmin Optimization Expert WfpNetLimiter driver. An attacker can exploit the vulnerability to cause a computer to blue screen, resulting in a...

Security update for libzypp, zypper (important)

This update for libzypp, zypper, libsolv provides the following fixes: Security fixes in libzypp: - CVE-2018-7685: PackageProvider: Validate RPMs before caching bsc1091624, bsc1088705 - CVE-2017-9269: Be sure bad packages do not stay in the cache bsc1045735 Changes in libzypp: - Update to version...

Schneider Electric StruxureWare Building Expert Plaintext Credentials Vulnerability

OVERVIEW Independent researcher Artyom Kurbatov has identified a cleartext transmission vulnerability in Schneider Electric’s StruxureWare Building Expert product. Schneider Electric has produced a new firmware version that mitigates this vulnerability. Artyom Kurbatov has tested the new firmware...

Reddit AMA

I did a Reddit AMA on Thursday, September 6...

Google Expands Bug-Bounty Program to Battle Abuse Methods

Google is now offering rewards for newly-discovered techniques that bad actors could use to bypass its systems protecting against abuse, fraud and spam. The company has expanded its bug bounty program scope beyond security vulnerabilities to also focus on mitigations around potential abuse method...

asmbs.org XSS vulnerability

Open Bug Bounty ID: OBB-662930 Description| Value ---|--- Affected Website:| asmbs.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ZombieBoy cryptomining malware exploits CVEs to evade detection

By Waqas ZombieBoy malware makes $1,000 Monero on a monthly basis. An independent security expert James Quinn has discovered a new family of cryptominers that has been dubbed as ZombieBoy. According to Quinn’s analysis, the newly discovered cryptomining worm clocked in at 43 KH/s which means as p...

A week in security (July 16 – July 22)

Last week on Labs, we looked at a Magniber expansion, explored open source vulnerabilities, and checked out the boons and drawbacks of smart assistants. We also continued our ad blocking article extravaganza, gave a whistlestop tour of third-party problems, and published our Q2 Cybercrime tactics...

Welcome to a New Look for Threatpost

Today we’re excited to unveil a better Threatpost. The update brings a fresh new look to the site, but also gives us a better platform overall, built and designed from the ground up for the future. Our first goal was to preserve all the things that didn’t need fixing – starting with Threatpost’s...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows

Summary Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version Java 1.8.0 SR4 FP1 used by DB2 Recovery Expert for Linux, Unix and Windows. These issues were disclosed as part of the IBM Java SDK updates in Jul 2017. Vulnerability Details CVEID: CVE-2017-10115...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version Java 1.8.0 SR1 FP10 used by DB2 Recovery Expert for Linux, Unix and Windows. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: An...

Security Bulletin:Multiple vulnerabilities in IBM® SDK Java™ Technology Edition affect IBM DB2 Recovery Expert for Linux, UNIX and Windows (CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0475, CVE-2016-0483, CVE-2016-0494, CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM DB2 Recovery Expert for Linux, UNIX and Windows . Information about these vulnerabilities affecting IBM Java SDK has been published in a security bulletin. Vulnerability Details CVEID: CVE-2016-040...

Security Bulletin: Multiple vulnerabilities in Java Runtime Environment affects IBM DB2 Recovery Expert for Linux, UNIX and Windows (CVE-2015-0204, CVE-2015-0138, CVE-2015-2808, CVE-2015-0460, CVE-2015-470)

Summary Various vulnerabilities in the Java Runtime Environment could affect IBM DB2 Recovery Expert for Linux, UNIX and Windows. Vulnerability Details CVEID:CVE-2015-0204 DESCRIPTION:A vulnerability in the OpenSSL ssl3getkeyexchange function could allow a remote attacker to downgrade the securit...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM DB2 Recovery Expert for Linux, UNIX and Windows (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM DB2 Recovery Expert for Linux, UNIX, and Windows Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, cause...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM DB2 Recovery Expert for Linux, UNIX, and Windows (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM DB2 Recovery Expert for Linux, UNIX, and Windows Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM DB2 Recovery Expert for Linux, UNIX and Windows (CVE-2014-3566, CVE-2014-6457, CVE-2014-6468)

Summary There are multiple vulnerabilities in the IBM Runtime Environment, Java™ Technology Edition versions v7.0.7, v7.0.6.1,v6.0 and v7.1.1 that are used by IBM DB2 Recovery Expert for Linux, UNIX and Windows. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODL...

Schneider Electric Floating License Manager

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Remotely exploitable/low skill level to exploit Vendor : Schneider Electric Equipment : Floating License Manager Vulnerabilities : Heap-based Buffer Overflow, Improper Restriction of Operations within the Bounds of a Memory Buffer, Open Redirect 2...

WannaCry hero charged with creating Kronos banking malware

By Waqas The 23-year-old cybersecurity expert, Marcus Hutchins @Malwaretech on Twitter, who This is a post from HackRead.com Read the original post: WannaCry hero charged with creating Kronos banking malware...

acde-expert-comptable-vitrolles.com XSS vulnerability

Open Bug Bounty ID: OBB-609664 Description| Value ---|--- Affected Website:| acde-expert-comptable-vitrolles.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

expert-proof.ru XSS vulnerability

Open Bug Bounty ID: OBB-609310 Description| Value ---|--- Affected Website:| expert-proof.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...