Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign

Campaign Details In September 2017, FireEye identified the FELIXROOT backdoor as a payload in a campaign targeting Ukrainians and reported it to our intelligence customers. The campaign involved malicious Ukrainian bank documents, which contained a macro that downloaded a FELIXROOT payload, being...

CVE-2018-0339

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient input validation of some...

CVE-2018-0287

A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format ARF files could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability is due to a design flaw in the affected software. An attacker could exploit this...

XYHCMS_V3-20170614 CSRF and File Upload Vulnerabilities in the Backend

Xing Yunhai CMS XYHcms is a completely open source CMS content management system. XYHCMSV3-20170614 CSRF and file upload vulnerability exists in the background. Attackers can use this vulnerability to lure administrators to click on specially crafted links to further Getshell and gain control of...

Should SaaS Companies Publish Customers Lists?

A few weeks back, HR and financial management firm Workday.com sent a security advisory to customers warning that crooks were sending targeted malware phishing attacks at customers. At the same time, Workday is publishing on its site a list of more than 800 companies that use its services, making...

CSRF Vulnerability in Ocean CMS V6.48

Ocean Movie System aka Ocean CMS seacms is a PHP movie system. There is a CSRF vulnerability in the back-end SQL execution form of Ocean CMS, which can be exploited by attackers to trick administrators into clicking on malicious links to execute SQL statements and write webshell to gain server...

Searching for Leaked Celebrity Photos? Don't Blindly Click that Fappening Link!

Are you curiously googling or searching torrents for photos or videos of Emma Watson, Amanda Seyfried, Rose McGowan, or any other celebrities leaked in The Fappenning 2.0? If yes, then beware, you should not click any link promising Fappenning celebrity photos. Cybercriminals often take advantage...

Marcher Trojan Finds New Android Victims Targeting Porn Sites

In the security world where Trojans remake themselves more often than a fading Hollywood actor, the Marcher Trojan is no exception. The 3-year-old Marcher has found new relevance targeting Android users visiting porn sites, according to a report from security firm Zscaler. Over the past month,...

Unspecified vulnerability in Oracle MySQL Server:Partition component (CNVD-2015-04913)

Oracle MySQL Server is a relational and popular database. A security vulnerability exists in the Server:Optimizer subcomponent of Oracle MySQL Server, which can be exploited by remote attackers to construct a malicious WEB page and trick users into parsing it, which can impact system availability...

Dridex Banking Trojan Spreading Via Macros in XML Files

Not long ago, criminals pushing the Dridex banking Trojan were using Microsoft Excel documents spiked with a malicious macro as a phishing lure to entice victims to load the malware onto their machines. Even though macros are disabled by default inside most organizations, the persistent hackers a...

OpenKM Document Management System 5.1.7 - Command Execution

COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-002 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Cross-site Request Forgery based OS Command Execution Risk: High Effect: Remotely exploitable Author: Cyrill Brunschwiler...

Experts: Justin Bieber Virus Spotted…But Sputtering

Anti virus experts are warning the public about a new virus that tempts unwitting Windows users with the promise of a video of teen heart throb Justin Bieber. But the virus appears to be having trouble attracting the interest of potential victims. The malware, named Trojan.Bieber.FraudPack was...

Examples to explain: a network of deception methods, and offensive and defensive!- Vulnerability warning-the black bar safety net

Lure the enemy in depth is a very practical tactics, ancient and modern, many military, politicians, entrepreneurs all of the tactics talked about, in the network attack and Defense is no exception, the system administrator will also use such tactics. Since each network system has a security...