Code Injection in baidu/cup

Description CUP, common useful python-lib. Currently, Most popular python lib in baidu Vulnerability description untrusted loading of data by the pickle.load function leading to Arbitrary code execution. Proof of Concept Run exploit.py import os import pickle os.system'pip3 install cup' from...

VMware Fixes Critical Flaw in ESXi Hypervisor

VMware has hurried out fixes for a critical flaw in its ESXi hypervisor, a few weeks after it was found during China’s Tianfu Cup hacking competition. The use-after-free vulnerability CVE-2020-4004 has a CVSS score of 9.3 out of 10, making it critical. It exists in the eXtensible Host Controller...

Tianfu Cup 2020: Hackers pwn Windows, iPhone, Chrome for big bucks

By Sudais Asif In total, ethical hackers earned $1.2 million in the bug bounty competition. This is a post from HackRead.com Read the original post: Tianfu Cup 2020: Hackers pwn Windows, iPhone, Chrome for big bucks...

Windows 10, iOS, Chrome, Firefox and Others Hacked at Tianfu Cup Competition

Multiple software products from Adobe, Apple, Google, Microsoft, Mozilla, and Samsung were successfully pwned with previously unseen exploits in Tianfu Cup 2020, the third edition of the international cybersecurity contest held in the city of Chengdu, China. "Many mature and hard targets have bee...

Windows 10, iOS, Chrome, Firefox and Others Hacked at Tianfu Cup Competition

Multiple software products from Adobe, Apple, Google, Microsoft, Mozilla, and Samsung were successfully pwned with previously unseen exploits in Tianfu Cup 2020, the third edition of the international cybersecurity contest held in the city of Chengdu, China. "Many mature and hard targets have bee...

Denial Of Service (DoS)

tomcat-coyote is vulnerable to denial of service DoS. The vulnerability is caused due to lack of proper handling of sequence of HTTP/2 requests, leading to a high CUP consumption and an application crash...

Tianfu Cup Round-Up: Safari, Chrome, D-Link Routers and Office 365 Successfully Hacked

Hackers over the weekend successfully compromised widely used software and hardware–including browsers Safari and Chrome, D-Link routers and the Office 365 suite–using zero-day vulnerabilities at the annual Tianfu Cup gathering. The hacking competition, held in Chengdu, China, is very similar to...

In-the-wild iOS Exploit Chain 5

Posted by Ian Beer, Project Zero TL;DR This exploit chain is a three way collision between this attacker group, Brandon Azad from Project Zero, and @S0rryMybad from 360 security. On November 17th 2018, @S0rryMybad used this vulnerability to win $200,000 USD at the TianFu Cup PWN competition...

New OTT Service Changing How New Zealanders Watch Sports

Communications service providers are looking for new ways to gain an edge in today's competitive market. In sports-crazed New Zealand, one of the country's largest telecom providers just launched an all-sports video service to attract new subscribers. Spark Sport is a new over-the-top OTT offerin...

ThreatList: Phishing Attacks Doubled in 2018

Phishing attempts more than doubled in 2018, as bad actors sought to trick victims into handing over their credentials. They used both old tricks – such as scams tied to current events – as well as other stealthy, fresher tactics. Researchers with Kaspersky Lab said in a Tuesday report that durin...

Spam and phishing in 2018

Numbers of the year The share of spam in mail traffic was 52.48%, which is 4.15 p.p. less than in 2017. The biggest source of spam this year was China 11.69%. 74.15% of spam emails were less than 2 KB in size. Malicious spam was detected most commonly with the Win32.CVE-2017-11882 verdict. The...

#OTTuesday: iTV on Live Streaming the World Cup

Imagine you're iTV. One of the UK's biggest commercial broadcasters. You have the rights for the World Cup and England has made the semi-finals. The whole country is watching. How do you make sure you're meeting the gold standard of delivering a glitch-free, "TV-like experience" over the internet...

VMSA-2018-0030:VMware Workstation and Fusion updates address an integer overfLOW issue.

VMSA-2018-0030 VMware Workstation and Fusion updates address an integer overflow issue. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0030 VMware Security Advisory Severity: Critical VMware Security Advisory Synopsis: VMware Workstation and Fusion updates address an...

This Week in Security News: Hijacks and Healthcare

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Singapore looks into the effectiveness of virtual browsers in an attempt to reduce cyberattacks on healthcare systems. Also, cybercriminals...

HTTPS+TLS and IPv6-enablement both in the majority for World Cup streaming

The underlying protocols of the Internet continue to evolve, and massive events such as the World Cup are a great opportunity to see this in action. A single-match peak for live video streaming of 22.5 Tbps was set on Akamai on Tuesday July 10 during the semi-final in Russia between France and...

HTTP+TLS and IPV6-Enablement Both in the Majority for World Cup Streaming

The underlying protocols of the Internet continue to evolve, and massive events such as the World Cup are a great opportunity to see this in action...

HTTP+TLS and IPV6-Enablement Both in the Majority for World Cup Streaming

The underlying protocols of the Internet continue to evolve, and massive events such as the World Cup are a great opportunity to see this in action...

A WordPress SPAMbot Wants You to Bet on the 2018 FIFA World Cup

Our researchers recently picked up on a spike in SPAM activity directed at sites powered by WordPress, which, naturally, led them to take a closer look. Turns out the attack was launched by a botnet and implemented in the form of comment SPAM - meaningless, generic text generated from a template...

quefaire.be XSS vulnerability

Open Bug Bounty ID: OBB-641494 Description| Value ---|--- Affected Website:| quefaire.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

World Cup 2018: malware attacks gunning for goal

World Cup 2018 is upon us and in full swing, bringing together 32 nations for a month of footballing to see who'll be crowned World Champion. With the tournament underway, we thought it'd be fun to see which of the footballing powerhouses also expended a similar amount of energy fighting off...