Facebook Will Verify the Physical Location of Ad Buyers with Paper Postcards

It's not a great solution, but it's something: The process of using postcards containing a specific code will be required for advertising that mentions a specific candidate running for a federal office, Katie Harbath, Facebook's global director of policy programs, said. The requirement will not...

Integrate Your Ticketing System into Database Security to Prevent DBA Privilege Abuse

Many of the recent high-profile data security breaches were made by trusted insiders. They are often database administrators DBAs who are highly privileged and trusted insiders with access to sensitive data. In this blog post, I will discuss the inherent risk introduced by highly privileged...

World's Biggest Botnet Just Sent 12.5 Million Emails With Scarab Ransomware

A massive malicious email campaign that stems from the world's largest spam botnet Necurs is spreading a new strain of ransomware at the rate of over 2 million emails per hour and hitting computers across the globe. The popular malspam botnet Necrus which has previously found distributing Dridex...

The vulnerability of the OpenSMTPD mail daemon on the Fedora operating system allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the OpenSMTPD mail daemon in the Fedora operating system is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to cause service failures or execute arbitrary code using the structures reqcavrfysmtp, reqcavrfymta, and...

ALPINE-CVE-2017-1000256

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default...

DEBIAN-CVE-2017-1000256

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default...

CVE-2017-1000256

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default...

libvirt TLS Certificate Validation Vulnerability

libvirt is a set of free , open source support for the mainstream virtualization tools under Linux C function library . A TLS certificate validation vulnerability exists in Libvirt 2.3.0 and later. The vulnerability is caused by an error in the default configuration "verify-peer=no" passed to QEM...

CVE-2014-3706

ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...

UBUNTU-CVE-2015-7687

Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service crash or execute arbitrary code via vectors involving reqcavrfysmtp and reqcavrfymta...

Play Protect: Android’s new security system is now available

Play Protect, a security suite for Android devices, was originally introduced in mid-May of this year during the Google I/O conference. And in just a couple of months, the tech giant has made it available for all their mobile users. Play Protect is the amalgamation of Google’s Android security...

The vulnerability of the xfrm_replay_verify_len function in the Linux operating system allows a hacker to trigger a service failure or gain superuser privileges.

The vulnerability of the xfrmreplayverifylen function in the Linux operating system arises due to the lack of verification of the XFRMMSGNEWAE size after updates. Exploiting this vulnerability can allow a local attacker to gain superuser privileges or cause service failures...

First Android-Rooting Trojan With Code Injection Ability Found On Google Play Store

A new Android-rooting malware with an ability to disable device’ security settings in an effort to perform malicious tasks in the background has been detected on the official Play Store. What's interesting? The app was smart enough to fool Google security mechanism by first pretending itself to b...

Site Verify - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2017-051

The Site Verify module enables privilege users to verify a site with services like Google Webmaster Tools using meta tags or file uploads. The module doesn't sufficiently sanitize input or restrict uploads. This vulnerability is mitigated by the fact that an attacker must have a role with the...

Citrix Cloud Connector Installation does not complete: Unable to validate certificate chain

Citrix Cloud Connector does not complete its initial installation or is unable to upgrade to the latest Cloud Connector version. The installation is blocked because it’s not able to validate the code signing certificate of the Citrix Cloud Components downloaded, which may be due to the certificat...

LibreSSL TLS Certificate Validation Vulnerability

LibreSSL is an open source implementation of the Secure Sockets Layer SSL and Transport Layer Security TLS protocols. A certificate validation vulnerability exists in LibreSSL TLS. A remote attacker can exploit this vulnerability by relying on SSLgetverifyresult, resulting in LibreSSL lacking TLS...

Denial Of Service (DoS)

crypto/dsa in github.com/golang/go is vulnerable to denial of service DoS attacks. These attacks are possible due to a flaw in the Verify function in crypto/dsa/dsa.go. It doesn't properly check parameters passed to the big integer library. This flaw can be exploited through a a public key given ...

Android Security Bulletin—May 2017Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Nexus devices through an over-the-air OTA update. The Google device firmware images have also been released to the Google Developer...

MantisBT Arbitrary Password Reset Vulnerability

MantisBT is a Web-based bug tracking system. An arbitrary password reset vulnerability exists in MantisBT verify.php, which allows remote attackers to exploit the vulnerability by submitting a special request to reset an arbitrary password with unauthorized access...

DEBIAN-CVE-2017-7414

In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit...