4477 matches found
About the security content of Safari 9.1.3
About the security content of Safari 9.1.3 This document describes the security content of Safari 9.1.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are availabl...
webkit2gtk: multiple issues
CVE-2016-4590 same-origin policy bypass xisigr of Tencents Xuanwu Lab discovered a vulnerability in the way webkit handles URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. - CVE-2016-4591 arbitrary filesystem access ma.la of LINE Corporation discoveered...
ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability
Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...
ZKTeco ZKBioSecurity 3.0 (visLogin.jsp) Local Authorization Bypass
Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...
Lurk Criminal Gang Also Behind Angler Exploit Kit
The June arrest of a Russian cybercrime gang responsible for the Lurk Trojan also put to rest the infamous Angler Exploit Kit. Researchers at Kaspersky Lab today published a detailed report on the Lurk takedown, confirming at the same time the connection between the Lurk gang and Angler. Activity...
ZKTeco ZKAccess Professional 3.5.3 Insecure File Permissions
Summary ZKAccess 3.5 is a desktop software which is suitable for small and medium businesses application. Compatible with all ZKAccess standalone reader controllers, the software can simultaneously manage access control and generate attendance report. The brand new flat GUI design and humanized...
Kaspersky Company Account - FileManager Vulnerability
Document Title: =============== Kaspersky Company Account - FileManager Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1924 Video: https://www.vulnerability-lab.com/getcontent.php?id=1976 Release Date: ============= 2016-08-30 Vulnerabili...
ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote SYSTEM Code Execution
Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...
RIPPER ATM Malware Uses Malicious EMV Chip
Update This story was updated Aug. 31. A never-before-seen malware family known as RIPPER is being blamed for a rash of ATM heists in Thailand last week. The malware, found by researchers at FireEye, is responsible for the theft of 12 million baht $378,000 from ATMs at banks across Thailand. The...
iOS 9.3.5 emergency release behind the truth:NSO using the iPhone 0day without clicking on a remote compromised iPhoneďź8 on 2 6 May 1 3:4 1 Update-bug warning-the black bar safety net
! According to the Washington Post reported, many people think that their iPhone is absolutely safe, but the latest research shows that Apple's mobileoperating systemin iOS over the years always the presence of three previously unknownâzero-day exploitâ, in fact Apple users are always in danger...
Emergency iOS Update Patches Zero Days Used by Government Spyware
Apple rushed an emergency iOS update today after the discovery of three zero-day vulnerabilities used by governments to spy on the activities of human rights activists and journalists. The zero days, called Trident, allow an attacker to take complete control of an iPhone or iPad with just one...
Apple releases 'Emergency' Patch after Advanced Spyware Targets Human Rights Activist
Apple has released iOS 9.3.5 update for iPhones and iPads to patch three zero-day vulnerabilities after a piece of spyware found targeting the iPhone used by a renowned UAE human rights defender, Ahmed Mansoor. One of the world's most invasive software weapon distributors, called the NSO Group, h...
About the security content of iOS 9.3.5
About the security content of iOS 9.3.5 This document describes the security content of iOS 9.3.5. For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on th...
Dutch, Belgian Ransomware Wildfire Disrupted, Decryption Keys Posted
The No More Ransom initiative released decryption keys for yet another strain of ransomware this week; now victims of the mostly Dutch-leaning ransomware called WildFire can get their files back without paying attackers. According to an update from the Dutch National Police on Wednesday, when it...
CareMonkey - Reset Password Token Remote Vulnerability
Document Title: =============== CareMonkey - Reset Password Token Remote Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1926 Video: https://www.youtube.com/watch?v=cnwmQAUI7ik Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1873 Release Date:...
Rupture - A framework for BREACH and other compression-based crypto attacks
Rupture is a framework for easily conducting BREACH and other compression-based attacks. For more information, please visit Rupture's home page: RuptureIt Authors Rupture is developed by: Dimitris Karakostas [email protected] Dionysis Zindros [email protected] Eva Sarafianou...
ShadowBrokers' Leak Has 'Strong Connection' to Equation Group
A high-stakes game of attribution started by a group claiming to have a cache of exploits belonging to the Equation Group took a somewhat definitive turn Tuesday afternoon. Researchers at Kaspersky Lab yesterday confirmed a connection between the tools currently up for auction by the ShadowBroker...
EyeLock Myris 3.3.2 SDK Service Unquoted Service Path Privilege Escalation
Summary myrisÂŽ provides unparalleled security, is portable, lightweight and is as easy as looking in a mirror. Use myris to quickly and easily enroll users for EyeLockâs access control products or to grant users access to corporate domain environments within secondsâusers never have to type their...
VBULLETIN 5.2.0/5.2.1/5.2.2 MEDIA UPLOAD SSRF PRIVILEGE ESCALATION
Author: c1tas, p0wd3r know Chong Yu 404 security lab CVE: CVE-2016-6483 A vulnerability overview vBulletin accepts the url parameters, it is not prohibited to jump transduction induced SSRF vBulletin need this function to access external connections, but this limit is not strict cause can trigger...
Breach Forces Password Change on Oracle MICROS PoS Customers
Oracle is alerting customers it found malicious code in some of its MICROS point-of-sale systems and is requiring they change account passwords. The security measures come on the heels of reports the worldâs No. 3 PoS service succumbed to a security breach perpetrated by the Carbanak gang. The...