CVE-2017-17058

The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all of the template...

moneyadviceservice.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-440153 Description| Value ---|--- Affected Website:| moneyadviceservice.org.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Potential Phishing Scams Related to Equifax Data Breach

The Federal Trade Commission FTC has released an alert on phishing attacks related to the Equifax data breach. Phishing attacks try to trick message recipients into sharing sensitive information with cyber criminals. FTC warns consumers to be wary of calls or emails purporting to be from Equifax...

Hurricane-Related Scams

As the peak of the 2017 hurricane season approaches, US-CERT warns users to be watchful for various malicious cyber activity targeting both disaster victims and potential donors. Users should exercise caution when handling emails that relate to recent hurricanes, even if those emails appear to...

Threat Outbreak Alert RuleID30304: Email Messages Distributing Malicious Software on August 24, 2017

Medium Alert ID: 54937 First Published: 2017 August 24 17:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30304 may contain the following files: Name |...

Apache Httpd < 2.4.28 : Use-after-free when using <Limit > with an unrecognized method in .htaccess ("OptionsBleed")

When an unrecognized HTTP Method is given in an directive in an .htaccess file, and that .htaccess file is processed by the corresponding request, the global methods table is corrupted in the current worker process, resulting in erratic behaviour. This behavior may be avoided by listing all unusu...

mystagdo.com XSS vulnerability

Vulnerable URL: http://mystagdo.com/pictures/feysal/advice.asp?advice=1"...

SEI Issues Advice on Ransomware

The Software Engineering Institute SEI of Carnegie Mellon University has released a blog post on best practices for preventing and responding to ransomware. This common malware captures, encrypts, and holds your data to extort a ransom. SEI’s top recommendation to thwart ransomware attacks is to...

Threat Outbreak Alert RuleID29039: Email Messages Distributing Malicious Software on May 8, 2017

Medium Alert ID: 53750 First Published: 2017 May 8 19:45 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29039 may contain the following files: Name | Size ...

Threat Outbreak Alert RuleID28821: Email Messages Distributing Malicious Software on April 20, 2017

Medium Alert ID: 53521 First Published: 2017 April 20 17:27 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28821 may contain the following files: Name | Si...

IRS Warns of Last-Minute Tax Scams

The Internal Revenue Service IRS has released an alert warning of phishing email scams targeting last-minute tax filers. The alert describes common features of these cyber crimes and includes recommendations to protect against them: strengthen passwords, recognize phishing attempts, and forward...

GitLab: Race condition in GitLab import, giving access to other people their imports due to filename collision

Vulnerability details There's a race condition in the Import::GitlabProjectsControllercreate endpoint that allows an attacker to gain access to someone else's import file. The race condition happens when there's a collision in two or more file names uploaded at the same time, before the import ge...

Threat Outbreak Alert RuleID28331: Email Messages Distributing Malicious Software on March 16, 2017

Medium Alert ID: 53049 First Published: 2017 March 16 14:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28331 may contain the following files: Name | Si...

PT-2017-17360 · Unknown +2 · Audio File Library +2

Name of the Vulnerable Software and Affected Versions: Audio File Library version 0.3.6 Description: The issue allows remote attackers to cause a denial of service, resulting in a divide-by-zero error and crash, via a crafted file. This is due to a problem in the runPull function in...

Threat Outbreak Alert RuleID24894: Email Messages Distributing Malicious Software on September 9, 2016

Medium Alert ID: 48828 First Published: 2016 September 9 14:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24894 may contain the following files: Name |...

Threat Outbreak Alert RuleID24374: Email Messages Distributing Malicious Software on August 18, 2016

Medium Alert ID: 48522 First Published: 2016 August 18 15:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24374 may contain the following files: Name |...

Threat Outbreak Alert RuleID24320: Email Messages Distributing Malicious Software on August 18, 2016

Medium Alert ID: 48514 First Published: 2016 August 18 14:12 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24320 may contain the following files: Name |...

Threat Outbreak Alert RuleID24066: Email Messages Distributing Malicious Software on August 4, 2016

Medium Alert ID: 48378 First Published: 2016 August 4 18:30 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24066 may contain the following files: Name | Si...

Oops! TP-Link forgets to Renew and Loses its Domains Used to Configure Router Settings

To make the configuration of routers easier, hardware vendors instruct users to browse to a domain name rather than numeric IP addresses. Networking equipment vendor TP-LINK uses either tplinklogin.net or tplinkextender.net for its routers configuration. Although users can also access their route...

Threat Outbreak Alert RuleID23692: Email Messages Distributing Malicious Software on July 3, 2016

Medium Alert ID: 46970 First Published: 2016 July 5 13:23 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23692 may contain the following files: Name | Size...