Olympic Destroyer Returns to Target Biochemical Labs

Olympic Destroyer, the threat actor that caused a crippling sabotage attack on the networks supporting this year’s Winter Games in Pyeongchang, South Korea, has resurfaced with a spy campaign – and with a wider target range. The new campaign began last month and is ongoing, employing spear-phishi...

Hackers Who Hit Winter Olympics 2018 Are Still Alive and Kicking

Remember the 'Olympic Destroyer' cyber attack? The group behind it is still alive, kicking and has now been found targeting biological and chemical threat prevention laboratories in Europe and Ukraine, and a few financial organisation in Russia. Earlier this year, an unknown group of notorious...

electron-packager Man-in-the-Middle Attack Vulnerability

electron-packager is a tool for packaging applications into executables based on different platforms. A security vulnerability exists in electron-packager versions 5.2.1 through 6.0.0 and 6.0.0 through 6.0.2, which stems from the '--strict-ssl' command line option being set by default to 'false '...

CVE-2014-10068

The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when showHidden is false...

Survey: 27 Percent of IT professionals receive more than 1 million security alerts daily

Imagine trying to tackle over one million security alerts in a day. That number is so huge that it may sound like hyperbole, but this is exactly what many security teams face. Dealing with such a high volume of potential threats on a regular basis can quickly lead to alert fatigue. Sure, we expec...

Authentication flaw

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, an improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

CVE-2018-8862

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, an improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

CVE-2018-8864

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, a missing encryption of sensitive data vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

CVE-2018-8864

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, a missing encryption of sensitive data vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

Code injection

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, a missing encryption of sensitive data vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

CVE-2018-8862

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, an improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

CVE-2018-8862

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, an improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

CVE-2018-8864

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, a missing encryption of sensitive data vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

CVE-2018-8864

The CVE-2018-8864 entry applies to ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, ALERT4000). The vulnerability is caused by missing encryption of sensitive data in radio transmissions, enabling a remote attacker to trigger false alarms. Affected components are the comman...

CVE-2018-8862

ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, ALERT4000) are affected by CVE-2018-8862 due to an improper authentication vulnerability triggered by specially crafted radio transmissions that could remotely trigger false alarms. The issue arises in the authentication mech...

CVE-2018-8862: Improper Authentication

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, an improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

CVE-2018-8864: Missing Encryption of Sensitive Data

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, a missing encryption of sensitive data vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

Adding transparency and context into industry AV test results

Corporate Vice President Brad Anderson recently shared his insights on how Windows Defender Advanced Threat Protection Windows Defender ATP evolved to achieve important quality milestones. Our Windows Defender ATP team is committed to delivering industry-leading protection, customer choice, and...

Reverb.com: XSS in main search, use class tag to imitate Reverb.com core functionality, create false login window

This is an expansion of 349684 which was flagged as a duplicate. In that bug report I explained that several HTML tags end up rendering when entered into the main search. I've since found out that the class attribute of multiple types of tags can be modified to create a realistic imitation of cor...

Authentication Bypass

django-allauth is vulnerable to authentication bypass attacks. The vulnerability exists as the checkpassword function used in the authentication backend failed to reject authentication to a user if isactive=False is set...