Microsoft Windows VCF Remote Code Execution

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-VCF-FILE-INSUFFICIENT-WARNING-REMOTE-CODE-EXECUTION.txt + ISR: ApparitionSec + Zero Day Initiative Program Vendor www.microsoft.com Product A VCF file is a...

Social Security Number scammers are at it again

The Federal Trade Commission FTC once again sounded the alarm in mid-December about the latest Social Security Number SSN scam that continues to affect thousands of Americans. While most of us were only able to read about this type of scam in the past, the FTC now has an audio recording of an SSN...

(0Day) Microsoft Windows vcf File Insufficient UI Warning Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing...

CVE-2018-6096

A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

CVE-2018-6097

Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter full screen without showing a warning via a crafted HTML page...

CVE-2018-6097

Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter full screen without showing a warning via a crafted HTML page...

Aussie govt emergency service hacked to send fake warning alerts

By Waqas A hacker managed to infiltrate Australian emergency warning system Early Warning Network EWN. The hacker accessed the system and sent countless messages to random citizens informing them that “you’ve been hacked.” However, the warning service’s managing director Kerry Plowright claims th...

Hackers Infiltrate Early Warning Network System to Send Spam

Hackers were able to access the Early Warning Network, a large-scale emergency warning system in Australia, and then send alarming spam messages to subscribers. According to the Early Warning Network EWN, a hacker accessed its system over the weekend and then sent “nuisance messages” via text,...

Australia’s Early Warning Network compromised

An early warning network designed to notify subscribers about dangerous weather in Australia has been compromised. The hacker sent many bogus messages via phone, SMS, and email, telling users that the service had been hacked. Early Warning Network, a service used by local governments to send...

GHSA-CF66-XWFP-GVC4 Missing Origin Validation in webpack-dev-server

Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...

Thousands of Google Chromecast Devices Hijacked to Promote PewDiePie

A group of hackers has hijacked tens of thousands of Google's Chromecast streaming dongles, Google Home smart speakers and smart TVs with built-in Chromecast technology in recent weeks by exploiting a bug that's allegedly been ignored by Google for almost five years. The attackers, who go by...

Fedora 28 : nghttp2 (2018-bdefa5e5bb)

update to the latest upstream release fixes CVE-2018-1000168 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

FTC Warns of Netflix Phishing Scam Making Rounds

The Federal Trade Commission FTC is warning of a new phishing scam reeling in Netflix customers and stealing their payment information. According to a post published by the FTC, Wednesday, the spotted scam purports to be an email from Netflix. The email claims that the victim’s account was put on...

RHEL 7 : kernel (RHSA-2018:3843)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3843 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: NULL pointer dereference in...

Kaspersky: Web protection component in Anti-Virus products family ignores HSTS security policy

Summary Kaspersky Internet Security seems to ignore the Strict-Transport-Security HTTP header. This allows Man-in-the-Middle attacks on websites that would normally be immune to them. The only requirement is the user confirming the certificate override, something that can be achieved by social...

WordPress Snap Creek Duplicator Code Injection Exploit

When the WordPress plugin Snap Creek Duplicator restores a backup, it leaves dangerous files in the filesystem such as installer.php and installer-backup.php. These files allow anyone to call a function that overwrite the wp-config.php file AND this function does not sanitize POST parameters befo...

Semrush: protocol & Ports are not shown in third-party site redirect warning page

Summary: protocol & Ports are not shown in third-party site redirect warning page Vulnerable Endpoint :- https://www.semrush.com/redirect?url=ftp://evil.com:1337 Description: I noticed 311330 this report where you guys fixed a open redirect report by adding a external third-party site redirect...

Bing Warns VLC Media Player Site is ‘Suspicious’ in Likely False-Positive Gaff

Microsoft’s Bing search engine warned its users the official VLC media player website was “suspicious” and dissuaded users from visiting the popular destination, suggesting the site contained “malicious software.” The site is no longer listed as unsafe. In a red warning message presented to users...

The United States Postal Service, the Amazon company due to API defects lead to a large number of customer data exposure-vulnerability warning-the black bar safety net

The United States is an annual holiday shopping carnival on Friday officially kicked off, and at the same time, the United States Postal Service and Amazon but there were two security incidents, both with the API using the improper about this event affected millions of people, at the same time...

Part of the middleware vulnerability summary-vulnerability warning-the black bar safety net

! Do the spectators for a long time, found that there has been no better middleware vulnerability of the summary of the article, just recently doing this to learn, this only summarizes a small portion of the middleware common vulnerabilities for learning reference, follow-up will complement the...