Recognizing Q3 Top 5 Bounty Hunters

Throughout the year, security researchers submit some amazing work to us under the Microsoft Bug Bounty program. Starting this quarter, we want to give a shout out to and acknowledge the hard work and dedication of the following individuals and companies who have contributed to securing Microsoft...

Flawed Meltdown patch by Microsoft makes Windows more vulnerable

By Waqas Microsoft’s January patch was released amidst claims of addressing the This is a post from HackRead.com Read the original post: Flawed Meltdown patch by Microsoft makes Windows more vulnerable...

Unbootable state for AMD devices in Windows 7 SP1 and Windows Server 2008 R2 SP1

Unbootable state for AMD devices in Windows 7 SP1 and Windows Server 2008 R2 SP1 Summary This update resolves the following issue: Microsoft has received reports of some customers on a small subset of older AMD processors getting into an unbootable state after you install January 3, 2018—KB405689...

Bad Microsoft Meltdown Patch Made Some Windows Systems Less Secure

UPDATE Researcher Ulf Frisk has created a proof-of-concept exploit demonstrating that Microsoft’s January Patch Tuesday update made security matters worse when it comes to memory vulnerabilities associated with Intel’s CPU bug Meltdown. Frisk, a Swedish IT security expert, reported on Tuesday tha...

Epson AirPrint Cross-Site Scripting Vulnerability Vulnerability

EPSON AirPrint is an application for wireless printing from Epson Japan. A cross-site scripting vulnerability exists in versions of Epson AirPrint prior to January 19, 2018 . A remote attacker could exploit the vulnerability to hijack session cookies...

January 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows Server 2012 (KB 4057271)

January 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows Server 2012 KB 4057271 Notice This update has been released as part of the Preview of the Quality Rollup for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7....

January 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1, and Server 2012 R2 (KB 4057272)

January 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1, and Server 2012 R2 KB 4057272 Notice This update is included in the February 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1,...

Oracle JDeveloper Multiple Vulnerabilities (January 2018 CPU)

The version of Oracle JDeveloper installed on the remote host is missing a security patch. Please see the vendor advisory for additional information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid106903;...

Oracle WebCenter Portal Multiple Vulnerabilities (January 2018 CPU)

Binary data oraclewebcenterportalcpujan2018.nbin...

CVE-2018-5550

Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting XSS vulnerability, which can allow untrusted users on the network to hijack a session cookie or perform other reflected XSS attacks on a currently logged-on user...

Fedora 27 : GraphicsMagick (2018-7c61d08c4f)

Latest stable release, includes many bug and security fixes. See also http://www.graphicsmagick.org/NEWS.htmljanuary-20-2017 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clea...

Threat Outbreak Alert RuleID31870: Email Messages Distributing Malicious Software on January 31, 2018

Medium Alert ID: 56629 First Published: 2018 January 31 17:23 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31870 may contain the following files: Name |...

Threat Outbreak Alert RuleID31861: Email Messages Distributing Malicious Software on January 31, 2018

Medium Alert ID: 56625 First Published: 2018 January 31 17:19 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31861 may contain the following files: Name |...

my-avantages.com XSS vulnerability

Open Bug Bounty ID: OBB-550341 Description| Value ---|--- Affected Website:| my-avantages.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Threat Outbreak Alert RuleID31841: Email Messages Distributing Malicious Software on January 31, 2018

Medium Alert ID: 56617 First Published: 2018 January 31 15:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31841 may contain the following files: Name |...

usapartsdirect.com XSS vulnerability

Open Bug Bounty ID: OBB-550144 Description| Value ---|--- Affected Website:| usapartsdirect.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Fixed in Apache Tomcat Native Connector 1.2.16

Note: The issue below was fixed in Apache Tomcat Native Connector 1.2.15 but the release vote for the 1.2.15 release candidate did not pass. Therefore, although users must download 1.2.16 to obtain a version that includes the fix for this issue, version 1.2.15 is not included in the list of...

levyna.cz XSS vulnerability

Open Bug Bounty ID: OBB-549924 Description| Value ---|--- Affected Website:| levyna.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Threat Outbreak Alert RuleID31866: Email Messages Distributing Malicious Software on January 30, 2018

Medium Alert ID: 56613 First Published: 2018 January 30 19:08 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31866 may contain the following files: Name |...

Threat Outbreak Alert RuleID31864: Email Messages Distributing Malicious Software on January 30, 2018

Medium Alert ID: 56611 First Published: 2018 January 30 18:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31864 may contain the following files: Name |...