Important: Red Hat Security Advisory: rhvm-appliance security and enhancement update

An update for rhvm-appliance is now available for Red Hat Virtualization 4 for RHEL-7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

PT-2018-10231

Name of the Vulnerable Software and Affected Versions LilyPond version 2.19.80 Description The issue allows remote attackers to conduct argument-injection attacks via a crafted URL. This is because the lilypond-invoke-editor in LilyPond does not validate strings before launching the program...

Two Romanian Hackers Extradited to the U.S. Over $18 Million Vishing Scam

Two Romanian hackers have been extradited to the United States to face 31 criminal charges including computer fraud and abuse, wire fraud conspiracy, wire fraud, and aggravated identity theft. Described as "international computer hackers" by the United States Department of Justice, Teodor Laurent...

Secret Service Warns of Chip Card Scheme

The U.S. Secret Service is warning financial institutions about a new scam involving the temporary theft of chip-based debit cards issued to large corporations. In this scheme, the fraudsters intercept new debit cards in the mail and replace the chips on the cards with chips from old cards. When...

UBUNTU-CVE-2015-9258

In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might for example be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed2551...

FBI: Iranian Firm Stole Data In Massive Spear Phishing Campaign

The United States Department of Justice announced charges against nine Iranians accused of stealing private data from U.S. universities, private companies and U.S. government agencies. FBI Deputy Director David Bowdich said in a statement that the state-sponsored hackers worked for more than four...

Mozilla Firefox Same-Origin Policy Bypass Vulnerability (CNVD-2018-07309)

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. A same-origin policy bypass vulnerability exists in Mozilla Firefox. A remote user can bypass the same-origin policy and access data in another tab by invoking a shared worker via the 'data:' U...

CVE-2018-7753: Improper Input Validation

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized...

CannibalRAT targets Brazil

This post was authored by Warren Mercer and Vitor Ventura Introduction Talos has identified two different versions of a RAT, otherwise known as a remote access trojan, that has been written entirely in Python and is wrapped into a standalone executable. The RAT is impacting users of a Brazilian...

qpid-proton: reactor sends messages in clear if ssl is requested but not available

The 1 proton.reactor.Connector, 2 proton.reactor.Container, and 3 proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain...

CVE-2017-0911

Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the...

PT-2018-5138

Name of the Vulnerable Software and Affected Versions Twitter Kit for iOS versions 3.0 through 3.2.1 Description The issue concerns a callback verification flaw in the "Login with Twitter" component, allowing an attacker to provide alternate credentials. During the "Login with Twitter"...

CVE-2017-0911: Trust of System Event Data

Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the...

Updated golang packages fix security vulnerabilities

An arbitrary command execution flaw was found in the way Go's "go get" command handled the checkout of source code repositories. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side CVE-2017-15041. It w...

Facebook Password Stealing Apps Found on Android Play Store

Even after many efforts made by Google last year, malicious apps always somehow manage to make their ways into Google app store. Security researchers have now discovered a new piece of malware, dubbed GhostTeam, in at least 56 applications on Google Play Store that is designed to steal Facebook...

Fourth Fappening Hacker Admits to Stealing Celebrity Pics From iCloud Accounts

Almost three years after the massive leakage of high-profile celebrities' photos—well known as "The Fappening" or "Celebgate" scandal—a fourth hacker has been charged with hacking into over 250 Apple iCloud accounts belonged to Hollywood celebrities. A federal court has accused George Garofano, 2...

GHSA-7PX7-7XJX-HXM8 Marked vulnerable to XSS from data URIs

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...

marked data: URI parser cross-site scripting vulnerability

marked is an American software developer Christopher Jeffrey developed a Markdown parser and compiler written in JavaScript. data:URI parser is one of the URI Uniform Resource Identifier parser. A cross-site scripting vulnerability exists in the data: URI parser in marked 0.3.6 and earlier. A...

Two Romanians Charged With Hacking Police CCTV Cameras Before Trump Inauguration

Remember how some cybercriminals shut down most of Washington D.C. police's security cameras for four days ahead of President Donald Trump's inauguration earlier this year? Just a few days after the incident, British authorities arrested two people in the United Kingdom, identified as a British m...

Stack overflow

Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler...