Privilege escalation

Use of potentially dangerous function in Intel BIOS platform sample code for some IntelR Processors may allow an authenticated user to potentially enable escalation of privilege via local access...

A week in security (June 8 – 14)

Last week on Malwarebytes Labs, we looked into nasty search hijackers that worried a lot of Chrome users; a list of considerations for MSPs when looking for an RMM platform; the complaint faced by ParetoLogic, the company that issues SpeedyPC, a product that claims to find and remove various PC...

A week in security (April 13 – 19)

Last week on Malwarebytes Labs, we looked at how to avoid Zoom bombing, weighed the risks of surveillance versus pandemics, and dug into a spot of WiFi credential theft. Other cybersecurity news: Malware creeps back into the home: With a pandemic forcing much of the workforce into remote position...

ZZZCMS zzzphp input validation error vulnerability (CNVD-2020-14279)

ZZZCMS zzzphp is a content management system CMS. An input validation error vulnerability exists in the 'parserIfLabel' function of the inc/zzztemplate.php file in ZZZCMS zzzphp version 1.7.3, which can be exploited by a remote attacker to bypass the 'danger key' function to execute arbitrary cod...

A week in security (August 12 – 18)

Last week on Malwarebytes Labs, we took a look at the potential pitfalls of facial recognition technology, looked at ways domestic abuse survivors can secure their data, and explored the education threat landscape. We also kicked off a series looking at the Hidden Bee infection chain, and put...

Government shutdown impacts .gov websites, puts Americans in danger

If you are in the United States, then you likely already know that we are on our 24th day of a government shutdown. While it is considered a "partial" shutdown, there are still plenty of government workers who are furloughed, which impacts the services they run—both online and off. Last week,...

Microsoft Warns of Two Apps That Expose Private Keys

Microsoft on Tuesday warned users that digital certificates were disclosed in two apps, which could allow a bad actor to remotely spoof websites or content. Headset software company Sennheiser HeadSetup, Microsoft said, had inadvertently installed the root certificates onto two apps, HeadSetup an...

A week in security (October 8 – 14)

Last week, we warned you away from some dubious Doctor Who streams, explained how Endpoint Detection and Response may not be enough, and explored what happens during a confusing supply chain story. We also showed you how to keep up with security, explained the risks of fake browser updates, and...

danger-media.de XSS vulnerability

Open Bug Bounty ID: OBB-644952 Description| Value ---|--- Affected Website:| danger-media.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Medtronic MyCareLink Patient Monitor Exposes Dangerous Method or Function Vulnerability

MyCareLink Patient Monitor is a patient monitor product developed by Medtronic, Inc. The Medtronic MyCareLink Patient Monitor has an Exposed Danger Method or Function vulnerability that can be exploited by an attacker with physical access to the device to access debugging functions of the monitor...

CVE-2018-4163

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit"...

Friday Squid Blogging: Squid Product Recall

Lidl is recalling two of its packaged squid products because of the presence of struvite salt crystals. The danger is unclear. The article says that struvite crystals "may be mistaken as glass fragments," which isn't actually dangerous. It also says: "As these salt crystals may cause injury, the...

Journalists Generally Do Not Use Secure Communication

This should come as no surprise: Alas, our findings suggest that secure communications haven't yet attracted mass adoption among journalists. We looked at 2,515 Washington journalists with permanent credentials to cover Congress, and we found only 2.5 percent of them solicit end-to-end encrypted...

Port Scan Attack Detector: PSAD

Port Scan Attack Detector The Port Scan Attack Detector psad is a lightweight system daemon written in is designed to work with Linux iptables/ip6tables/firewalld firewalling code to detect suspicious traffic such as port scans and sweeps, backdoors, botnet command and control communications, and...

Best tips :: HCG Game cheats Drops - Avoid Expensive Injections

As menopause decreases the degrees of estrogen, it ought to come as no real surprise more and more fat are going to be deposited around the entire body and particularly from the abdominal area. The metabolism will suffer too, causing excess weight gain and reduced vitality. While every one of the...

Enemy Strike - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Enemy Strike published at the 'play' market has multiple vulnerabilities...

IOT security: LED lights there are multiple security vulnerabilities-vulnerability warning-the black bar safety net

Recently, there are foreign security experts found Zengge company WIFI LED lamp in the presence of a plurality of security vulnerabilities. Shenzhen levy Aurora Mega science and technologyZENGGE is a set of LED Controller product development, manufacturing, sales and engineering design,...

eBay Fixes Reflected File Download Flaw

For many years, eBay has been one of the bigger targets for phishers and many other kinds of attackers and they have been honing their tactics and improving them along the way. Much of their effectiveness depends on convincing users that they’re on the real eBay site and the site recently fixed a...

Linux Bash find significant security vulnerabilities to modify the method-vulnerability warning-the black bar safety net

GMT 9 August 2 5, message, Linux users today and got a“surprise”it! The Red Hat security team on Linux in the widely used Bash shell, found a subtle but dangerous security vulnerabilities. The vulnerability called the“Bash Bug”or“Shellshock”is. When the user normal access, the vulnerability allow...

Debian ‘x11-common’ Init script insecure temporary file creation vulnerability-vulnerability warning-the black bar safety net

Vulnerability causes Design errors The level of danger Low The impact of the system Debian x11-common 1:7.5+8 Not affected system Hazards A local attacker could exploit the vulnerability could elevate privileges or destruction of the system. Attack required conditions The attacker must have acces...