Xen Denial of Service and Elevation of Privilege Vulnerabilities

Xen is an open source virtual machine monitor developed by the Xen Project. A Denial of Service and Elevation of Privilege vulnerability exists in Xen 4.11, which stems from a failure to properly handle x86 IOREQ server resource accounting for use with external emulators and can be exploited by a...

Xen Denial of Service Vulnerability (CNVD-2019-07946)

Xen is an open source virtual machine monitor developed by the Xen Project. Xen 4.11.x suffers from a denial of service vulnerability that stems from p2m locking being indefinitely unavailable under certain error conditions, which can be exploited by users of x86 client operating systems to cause...

DEBIAN-CVE-2018-19963

An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service host OS crash or possibly gain host OS privileges because x86 IOREQ server resource accounting for external emulators was mishandled...

Using Fuzzing to Mine for Zero-Days

Fuzzing is a term that sounds hard to take seriously. But it needs to be, in light of today’s attack landscape. Fuzzing has traditionally been a sophisticated technique used by professional threat researchers to discover vulnerabilities in hardware and software interfaces and applications. They d...

30 Years of Trend Micro

This year marks 30 years of Trend Micro. That’s three decades of working to make the world safe for exchanging digital information in a constantly changing technology and cyber threat environment. Our founders often reference the humble beginnings of the company – starting from a garage in...

SNDBOX: AI-Powered Online Automated Malware Analysis Platform

Looking for an automated malware analysis software? Something like a 1-click solution that doesn't require any installation or configuration…a platform that can scale up your research time… technology that can provide data-driven explanations… well, your search is over! Israeli cybersecurity and...

SNDBOX: AI-Powered Online Automated Malware Analysis Platform

Looking for an automated malware analysis software? Something like a 1-click solution that doesn't require any installation or configuration…a platform that can scale up your research time… technology that can provide data-driven explanations… well, your search is over! Israeli cybersecurity and...

Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP

In MITREs evaluation of endpoint detection and response solutions, Windows Defender Advanced Threat Protection demonstrated industry-leading optics and detection capabilities. The breadth of telemetry, the strength of threat intelligence, and the advanced, automatic detection through machine...

i4 assistant cross-site scripting vulnerability

i4 assistant is a specialized management tool for Apple mobile devices from China for Aipu Information Technology Company. A cross-site scripting vulnerability exists in i4 assistant version 7.85. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML via th...

Facebook HHVM Denial of Service Vulnerability (CNVD-2018-24629)

Facebook HHVM aka HipHop Virtual Machine is a virtual machine from Facebook that significantly improves the performance of loading dynamic pages in PHP. A denial of service vulnerability exists in Facebook HHVM versions 3.24.3 and earlier and 3.21.7 and earlier, which can be exploited by an...

UBUNTU-CVE-2018-6332

A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources. This affects all supported versions of HHVM 3.24.3 and 3.21.7 and below when using the proxygen server to handle HTTP2 requests...

Wallarm to Sponsor KubeCon + CloudNative Con

If you have not registered yet for the main Kubernetes event in North America which will start on December 10th in Seattle, you may be out of luck. The event is sold out and is only taking the waitlist applications. But if you are going, KubeCon + CloudNativeCon promises to be a treat with the...

Three-Rotor Enigma Machine Up for Auction Today

Sotheby's is auctioning off a working, I think three-rotor Enigma machine today. They're expecting it to sell for about $200K. I have an Enigma, but it's missing the rotors...

CVE-2018-19527

i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings...

CVE-2018-19527

i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings...

Obfuscated Command Line Detection Using Machine Learning

This blog post presents a machine learning ML approach to solving an emerging security problem: detecting obfuscated Windows command line invocations on endpoints. We start out with an introduction to this relatively new threat capability, and then discuss how such problems have traditionally bee...

SUSE-SU-2018:3933-1 Security update for java-1_7_1-ibm

java-171-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 35 bsc1116574: Consumability - IJ10515 AIX JAVA 7.1.3.10 GENERAL PROTECTION FAULT WHEN ATTEMPTING TO USE HEALTH CENTER API Class Libraries - IJ10934 CVE-2018-13785 - IJ10935 CVE-2018-3136 - IJ10895 CVE-2018-3139 - IJ10932 CVE-2018-31...

libssh: Authentication Bypass due to improper message callbacks implementation

A vulnerability was found in libssh's server-side state machine. A malicious client could create channels without first performing authentication, resulting in unauthorized access...

SUSE-SU-2018:3921-1 Security update for java-1_7_1-ibm

java-171-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 35 bsc1116574: Consumability - IJ10515 AIX JAVA 7.1.3.10 GENERAL PROTECTION FAULT WHEN ATTEMPTING TO USE HEALTH CENTER API Class Libraries - IJ10934 CVE-2018-13785 - IJ10935 CVE-2018-3136 - IJ10895 CVE-2018-3139 - IJ10932 CVE-2018-31...

Teledyne DALSA Sherlock Machine Vision Detection (Windows SMB Login)

SMB login-based detection of Teledyne DALSA Sherlock Machine Vision. Copyright C 2018 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Fre...