Microsoft Releases Outlook Patches, Fixes Broken Update

During the heat of Black Hat last week, Microsoft pushed out patches for Outlook that address three newly reported vulnerabilities. Last week’s update also included fixes for six of eight vulnerabilities left unpatched after issues were reported with the June Patch Tuesday update. The most seriou...

CVE-2016-9719: Improper Input Validation

IBM InfoSphere Master Data Management Server 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click...

Botnet Tweeting, Spamming Porn Shut Down

An adult-themed botnet was found by researchers and dismantled by Twitter last month. The Twitter-based botnet consisted of 86,262 bot accounts, and over the past six months blasted out 8.6 million tweets that attempted to lure males to pornographic, dating, hookup and cheating-spouse websites...

CVE-2017-7666

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...

CVE-2017-7666

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...

Cross site request forgery (csrf)

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...

CVE-2017-7666: Improper Neutralization of Input During Web Page Generation

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...

CVE-2017-7666

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...

CVE-2017-7666

CVE-2017-7666 affects Apache OpenMeetings 1.0.0 and exposes CSRF, XSS, click‑jacking, and MIME-based attacks. The issue is addressed in OpenMeetings 3.3.0; remediation is to upgrade to at least 3.3.0. Exploitation details are not provided in the supplied documents.

CVE-2017-7666

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...

NemucodAES Ransomware, Kovter Click-Fraud Malware Spreading in Same Campaigns

Two malware families, NemucodAES and Kovter, are being packaged together in .zip attachments and delivered via active spam campaigns. Researcher Brad Duncan said, “together these two pieces of malware could deliver a nasty punch.” Duncan, a handler at the SANS Institute Internet Storm Center, sai...

PT-2017-17872

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions 1.0.0 through 3.2.x Description The issue allows for Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks. Recommendations For versions 1.0.0 through 3.2.x, update to version...

A week in security (Jun 12 – Jun 18)

Last week was very busy for the Labs, with a look at so-called numeric tech support scams, a visit to the huge Infosec Europe conference, an exploration of Mac Malware as a Service, and a walk through the myths of online bullying. Elsewhere: A huge click-farm is busted Jaff Ransomware is thwarted...

Disk Pulse 9.7.26 Buffer Overflow

!/usr/bin/python Exploit Title: Disk Pulse v9.7.26 - Add Directory Local Buffer Overflow Date: 12-06-2017 Exploit Author: abatchy17 -- @abatchy17 Vulnerable Software: Disk Pulse v9.7.26 Freeware, Pro, Ultimate Vendor Homepage: http://www.diskpulse.com/ Version: 9.7.14 Software Link:...

Judy Android Malware Infects Over 36.5 Million Google Play Store Users

Security researchers have claimed to have discovered possibly the largest malware campaign on Google Play Store that has already infected around 36.5 million Android devices with malicious ad-click software. The security firm Checkpoint on Thursday published a blog post revealing more than 41...

WordPress adsense-click-fraud-monitoring phpwhois cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports personal blog sites on PHP and MySQL servers. adsense-click-fraud-monitoring is one of the malicious click monitoring plugins. phpwhois is a package containing Whois libraries fo...

McAfee Network Data Loss Prevention Clickjacking Vulnerability (CNVD-2017-07549)

McAfee Network Data Loss Prevention is a data leakage protection solution. McAfee Network Data Loss Prevention NDLP suffers from a single-click hijacking vulnerability in the server implementation, which can be exploited by remote attackers to inject arbitrary web script or HTML via the HTTP...

CVE-2015-3998

phpwhois version 4.2.5 used in the WordPress adsense-click-fraud-monitoring plugin version 1.7.5 is documented to have a cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary script or HTML via the query parameter to whois.php. The linked reports confirm the affected componen...

CVE-2015-3998: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php...

PT-2017-6718

Name of the Vulnerable Software and Affected Versions phpwhois version 4.2.5 adsense-click-fraud-monitoring plugin version 1.7.5 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML via the query parameter to "whois.php" API endpoint. This can lead to...