Exposure of Sensitive Information to an Unauthorized Actor

A bypass vulnerability in Active Storage for Google Cloud Storage and Disk services allow an attacker to modify the content-disposition and content-type parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie...

Widespread Malvertising Campaign Hijacks 300 Million Sessions

A massive malvertising campaign targeting iOS devices hijacked a whopping 300 million browser sessions in just 48 hours. Researchers at Confiant recorded the campaign Nov. 12, and said that the threat actor behind the campaign is still active to this day. A malicious landing page According to...

IT threat evolution Q3 2018

Targeted attacks and malware campaigns Lazarus targets cryptocurrency exchange Lazarus is a well-established threat actor that has conducted cyber-espionage and cybersabotage campaigns since at least 2009. In recent years, the group has launched campaigns against financial organizations around th...

BGP Route Hijacking

Yes, we can minimize the BGP Hijacking Risk Every day we see something new about the global security threat. It is hard to keep track of all the various ways your network can be attacked. But there are some threat-vectors which need particular attention. "Did you know that a threat-actor with 20...

PoC Exploit Compromises Microsoft Live Accounts via Subdomain Hijacking

A proof-of-concept PoC attack details how an attacker can gain access a victim’s Microsoft Live webmail session, without having the person’s credentials. It relies upon the hijack of a Microsoft-owned Live.com website subdomain. The PoC, developed by CyberInt, demonstrates what it characterizes a...

The vulnerability of Adobe Acrobat and Adobe Reader PDF viewer/editor programs, related to writing beyond the buffer in memory, allows a perpetrator to execute arbitrary code.

The vulnerability of Adobe Acrobat and Adobe Reader PDF viewer/editor programs lies in the writing of data beyond the buffer limit in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created PDF file...

sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting

A new PowerShell downloader dubbed sLoad is making the rounds, sporting impressive reconnaissance tactics and a penchant for geofencing, which indicate increasing sophistication when it comes to targeting efforts. First spotted in May 2018, sLoad typically delivers the Ramnit banking trojan but h...

be.venneborg:play26-refined_2.11 (>=0.2.0 <=0.3.0), be.venneborg:play27-refined_2.11 (=0.3.0) +573 more potentially affected by CVE-2018-16115 via com.typesafe.akka:akka-actor_2.11 (>=2.5.0 <=2.5.15)

com.typesafe.akka:akka-actor2.11 MAVEN version =2.5.0, =0.2.0, =0.1.1, =1.4-P26-B3, =1.4-P26-B4 - com.andrewgapic:spark-streaming-twitch =1.0.0 and more Source cves: CVE-2018-16115 Source advisory: OSV:GHSA-MR95-9RR4-668F...

ai.agnos:reactive-sparql_2.12 (>=0.3.0 <=0.3.1), ai.snips:play-mongo-bson_2.12 (>=0.5 <=0.5.1) +1141 more potentially affected by CVE-2018-16115 via com.typesafe.akka:akka-actor_2.12 (>=2.5.0 <=2.5.15)

com.typesafe.akka:akka-actor2.12 MAVEN version =2.5.0, =0.3.0, =0.5, =0.2.0, =0.1.0, =0.1.0, =0.14.0, =0.17.0 and more Source cves: CVE-2018-16115 Source advisory: OSV:GHSA-MR95-9RR4-668F...

Cryptographically Weak Pseudo-Random Number Generator (PRNG) in akka-actor

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS both classic and Artery Remoting. Akka allows configuration of custom random number generators. For historical reasons, Akka included t...

Tracking Tick Through Recent Campaigns Targeting East Asia

This blog post is authored by Ashlee Benge and Jungsoo An, with contributions from Dazhuo Li. Summary Since 2016, an advanced threat group that Cisco Talos is tracking has carried out cyberattacks against South Korea and Japan. This group is known by several different names: Tick, Redbaldknight a...

Threats in the Netherlands

Introduction On October 4, 2018, the MIVD held a press conference about an intercepted cyberattack on the OPWC in the Netherlands, allegedly by the advanced threat actor Sofacy also known as APT28 or Fancy Bear, among others. According to the MIVD, four suspects were caught red handed trying to...

CVE-2018-8848

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor...

CVE-2018-8848

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor...

Lucy Gang Debuts with Unusual Android MaaS Package

There’s a fresh bloom in the malware-as-a-service garden: Researchers have uncovered a new Russian-speaking threat actor hawking a proprietary cyber-weapon dubbed “Black Rose Lucy.” The offering is a malware-as-a-service MaaS bundle with two parts, consisting of a controlling web interface which...

CVE-2018-14829

Rockwell Automation RSLinx Classic is affected in versions 4.00.01 and earlier. The CVE-2018-14829 vulnerability arises from handling malformed CIP packets sent to TCP port 44818, which can cause the application to stop responding and crash; there is also potential for a buffer overflow that coul...

CVE-2018-14829

Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote threat actor to intentionally send a malformed CIP packet to Port 44818, causing the software application to stop responding and crash. This vulnerability also has the potential to exploit a buffe...

CVE-2018-14829

Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote threat actor to intentionally send a malformed CIP packet to Port 44818, causing the software application to stop responding and crash. This vulnerability also has the potential to exploit a buffe...

CVE-2018-14821

Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intentionally send a malformed CIP packet to Port 44818, causing the RSLinx Classic application to terminate. The user will need to manually restart the software t...

Directory Traversal in augustine

Affected versions of augustine resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system. Proof of...