Kaspersky Lab Sues U.S. Government Over Software Ban

Moscow-based cyber security firm Kaspersky Lab has taken the United States government to a U.S. federal court for its decision to ban the use of Kaspersky products in federal agencies and departments. In September 2017, the United States Department of Homeland Security DHS issued a Binding...

User ‘Gross Negligence’ Leaves Hundreds of Lexmark Printers Open to Attack

UPDATE Researchers at NewSky Security have found hundreds of Lexmark printers misconfigured, open to the public internet and easily accessible to anyone interested in taking control of targeted devices. Researchers identified 1,123 Lexmark printers traced back to businesses, universities and in...

How public-private partnerships can combat cyber adversaries

For several years now, policymakers and practitioners from governments, CERTs, and the security industry have been speaking about the importance of public-private partnerships as an essential part of combating cyber threats. It is impossible to attend a security conference without a keynote...

How public-private partnerships can combat cyber adversaries

For several years now, policymakers and practitioners from governments, CERTs, and the security industry have been speaking about the importance of public-private partnerships as an essential part of combating cyber threats. It is impossible to attend a security conference without a keynote...

Patch Tuesday, December 2017 Edition

The final Patch Tuesday of the year is upon us, with Adobe and Microsoft each issuing security updates for their software once again. Redmond fixed problems with various flavors of Windows, Microsoft Edge, Office, Exchange and its Malware Protection Engine. And of course Adobe's got another...

SQL Injection Vulnerability in the Website Construction System of Anshan China Domain Network Services Co.

Ltd. is a main website builder, for government agencies, business units and institutions and the majority of individual users to provide website planning, website construction, website promotion, space domain names and other businesses. There is a SQL injection vulnerability in the website...

Needl - Take Back Your Privacy. Lose Yourself In The Haystack.

Take back your privacy. Lose yourself in the haystack. Your ISP is most likely tracking your browsing habits and selling them to marketing agencies albeit anonymised. Or worse, making your browsing history available to law enforcement at the hint of a Subpoena. Needl will generate random Internet...

Is Your DJI Drone a Chinese Spy? Leaked DHS Memo Suggests

The United States Department of Homeland Security DHS has recently accused Da-Jiang Innovations DJI, one of the largest drone manufacturers, of sending sensitive information about U.S. infrastructure to China through its commercial drones and software. A copy memo from the Los Angeles office of t...

Former NSA Employee Pleads Guilty to Taking Classified Data

A former employee for the National Security Agency pleaded guilty on Friday to taking classified data to his home computer in Maryland. According to published reports, U.S. intelligence officials believe the data was then stolen from his computer by hackers working for the Russian government. Ngh...

bangladesh.gov.bd XSS vulnerability

Vulnerable URL: http://bangladesh.gov.bd/site/search?key=test%22onmouseover%3Dprompt%28document.domain%29%3E%3C%2Fiframe%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 59150 VIP website status:| No Coordinate...

faaf.gov.mv XSS vulnerability

Open Bug Bounty ID: OBB-429902 Description| Value ---|--- Affected Website:| faaf.gov.mv Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

New White House Announcement on the Vulnerability Equities Process

The White House has released a new version of the Vulnerabilities Equities Process VEP. This is the inter-agency process by which the US government decides whether to inform the software vendor of a vulnerability it finds, or keep it secret and use it to eavesdrop on or attack other systems. You...

White House Releases VEP Disclosure Rules

The U.S. government took steps toward offering more transparency into the Vulnerabilities Equities Process. On Wednesday it released of the “Vulnerabilities Equities Policy and Process” PDF charter that outlines how the government will disclose cyber security flaws and when it will keep them...

November 15, 2017 – Morning Cyber Coffee Headlines – “Lewis and Clark” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! November 15, 2017 - Headlines Carbon Black in the News: Some senators want to...

Implementing the CIS 20 Critical Security Controls: Slash Risk of Cyber Attacks by 85%

If a CISO needed to cut cyber attack risk by 85%, how would this security chief go about accomplishing that? Would the CISO even know where to begin? It’s safe to say that such a mandate would be considered daunting, and maybe even overwhelming. CISOs are scrambling to protect IT infrastructures...

Memory Corruption Vulnerability in Multiple JustSystems Products

JustSystems Ichitaro, Ichitaro Government and Ichitaro Pro are word processing software from JustSystems Japan.Rakuraku Hagaki is a postcard creation and search component. A memory corruption vulnerability exists in several JustSystems products. An attacker could exploit the vulnerability to...

GSA Bounty: Subdomain Takeover

@picklepwns discovered a subdomain takeover attack. Technically, the domain was out of scope for our Vulnerability Disclosure Policy. We want to remind hackers to please limit their testing to domains explicitly listed in that scope which is repeated on our HackerOne program page for convenience...

Russian 'Fancy Bear' Hackers Using (Unpatched) Microsoft Office DDE Exploit

Cybercriminals, including state-sponsored hackers, have started actively exploiting a newly discovered Microsoft Office vulnerability that Microsoft does not consider as a security issue and has already denied to patch it. Last month, we reported how hackers could leverage a built-in feature of...

Newly Uncovered 'SowBug' Cyber-Espionage Group Stealing Diplomatic Secrets Since 2015

A previously unknown hacking and cyber-espionage group that has been in operation since at least 2015 have conducted a series of highly targeted attacks against a host of government organizations in South America and Southeast Asia to steal their sensitive data. Codenamed Sowbug, the hacking grou...

government.nl XSS vulnerability

Vulnerable URL: https://www.government.nl/search?keyword=%27%22%2F%3E%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%2FOPENBUGBOUNTY%2F%29%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 88006 VIP website...