Intel Extreme Tuning Utility 6.4.1.23 - DoS Vulnerability

Document Title: =============== Intel Extreme Tuning Utility 6.4.1.23 - DoS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2165 ID: INTEL-SA-00162 https://nvd.nist.gov/vuln/detail/CVE-2018-12151...

Microsoft Internet Explorer 11 Tree::Notify_InvalidateDisplay Null Pointer Dereference

Summary Internet Explorer is a series of graphical web browsers developed by Microsoft and included in the Microsoft Windows line of operating systems, starting in 1995. It was first released as part of the add-on package Plus! for Windows 95 that year. Description The crash is caused due to a NU...

ThreatList: Fewer Big DDoS Attacks in Q3, Overall Rate Holds Steady

When it comes to distributed denial of service DDoS attacks, the third quarter of 2018 marked an apparent lull in the action, with fewer huge, multi-day attacks than in previous quarters. Researchers however warn against having a false sense of security: The total number of attacks in the quarter...

StrongPity APT Changes Tactics to Stay Stealthy

The APT group behind the sophisticated malware known as StrongPity a.k.a. Promethium has changed its tactics, after various research groups analyzed the malware and exposed its methods of deployment. The efforts have allowed the group to return to hidden status, even after being labeled a known...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-60.3.0esr-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

[slackware-security] libssh

New libssh packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libssh-0.7.6-i586-1slack14.2.txz: Upgraded. Fixed authentication bypass vulnerability. For more information, see:...

TP-Link TL-SC3130 1.6.18 Unauthenticated RTSP Stream Disclosure Vulnerability

Summary The TL-SC3130G surveillance camera is a versatile solution for your home and office monitoring, whose 54Mbps wireless connectivity enables you to deploy the camera where inaccessible previously by Ethernet connection such as ceiling and walls. This camera can be placed in your living room...

FLIR Systems FLIR Brickstream 3D+ Unauthenticated RTSP Stream Disclosure

Summary Thermal Imaging Camera For Continuous Condition and Safety Monitoring FLIR AX8 is a thermal sensor with imaging capabilities. Combining thermal and visual cameras in a small, affordable package, the AX8 provides continuous temperature monitoring and alarming capabilities to protec critica...

FLIR Systems FLIR AX8 Thermal Camera 1.32.16 Hard-coded Credentials Shell Access

Summary Thermal Imaging Camera For Continuous Condition and Safety Monitoring FLIR AX8 is a thermal sensor with imaging capabilities. Combining thermal and visual cameras in a small, affordable package, the AX8 provides continuous temperature monitoring and alarming capabilities to protec critica...

FLIR Systems FLIR Brickstream 3D+ Unauthenticated Config Download File Disclosure

Summary Thermal Imaging Camera For Continuous Condition and Safety Monitoring FLIR AX8 is a thermal sensor with imaging capabilities. Combining thermal and visual cameras in a small, affordable package, the AX8 provides continuous temperature monitoring and alarming capabilities to protec critica...

Zero-day exploit (CVE-2018-8453) used in targeted attacks

Yesterday, Microsoft published their security bulletin, which patches CVE-2018-8453, among others. It is a vulnerability in win32k.sys discovered by Kaspersky Lab in August. We reported this vulnerability to Microsoft on August 17, 2018. Microsoft confirmed the vulnerability and designated it...

Microsoft Patches Zero-Day Under Active Attack by APT

Microsoft has issued a patch for a zero-day bug being actively exploited in the wild, as part of its Patch Tuesday security bulletin. The vulnerability is an elevation-of-privilege flaw, rated important, affecting the Windows Win32k component. The zero-day CVE-2018-8453, found by Kaspersky Lab,...

Virus Bulletin 2018: Saudi Dissident Spyware Attack Belies Bigger Threat

MONTREAL – This week, news broke that a well-known Saudi dissident has been targeted by the notorious Pegasus spyware – after he gained permanent citizen status in Canada. While this fits into pattern of ongoing attacks on “civil society” members i.e., journalists, social justice activists,...

Facebook - Instagram Business Access Token Vulnerability

Document Title: =============== Facebook - Instagram Business Access Token Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2152 URL: https://www.youtube.com/watch?v=tdLKRky1Da4 News & Press:...

Facebook - Instagram Business Access Token Demo PoC

Document Title: =============== Facebook - Instagram Business Access Token Demo PoC References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2153 View: https://www.youtube.com/watch?v=4Obsd1Qw7uU News & Press:...

Ex-NSA Developer Gets 5.5 Years in Prison for Taking Top Secret Documents Home

A former NSA employee has been sentenced to five and a half years in prison for illegally taking a copy of highly classified documents and hacking tools to his home computer between 2010 and 2015, which were later stolen by Russian hackers. Nghia Hoang Pho, 68, of Ellicott City, Maryland—who work...

Pegasus Spyware Used in 45 Countries

Citizen Lab has published a new report about the Pegasus spyware. From a ZDNet article: The malware, known as Pegasus or Trident, was created by Israeli cyber-security firm NSO Group and has been around for at least three years -- when it was first detailed in a report over the summer of 2016. Th...

ThreatList: Malware Samples Targeting IoT More Than Double in 2018

It’s no secret that connected devices are posing a security threat in the commercial, consumer and industrial worlds. A fresh report on this expanding threat landscape shows that attacks are accelerating, with MikroTik routers, Telnet password-cracking and the Mirai botnet dominating the...

Powerful Android and iOS Spyware Found Deployed in 45 Countries

One of the world's most dangerous Android and iPhone spyware program has been found deployed against targets across 45 countries around the world over the last two years, a new report from Citizen Lab revealed. The infamous spyware, dubbed Pegasus, is developed by NSO Group—an Israeli company whi...

Dangerous Pegasus Spyware Has Spread to 45 Countries

The infamous Pegasus spyware, which targets iPhones and Android devices, has allegedly infiltrated 45 different countries across the globe — and six of those countries have used surveillance malware in the past to abuse human rights, a group of researchers claimed Tuesday. Researchers from The...