Adobe Patches Flash Zero Day Exploited by Black Oasis APT

Adobe today released an out-of-band Flash Player update addressing a zero-day vulnerability being exploited by a little-known Middle Eastern APT group. The group known as Black Oasis was, as recently as this month, using exploits for the flaw to drop FinSpy as a payload. Sold by the controversial...

Hackers Use New Flash Zero-Day Exploit to Distribute FinFisher Spyware

FinSpy—the infamous surveillance malware is back and infecting high-profile targets using a new Adobe Flash zero-day exploit delivered through Microsoft Office documents. Security researchers from Kaspersky Labs have discovered a new zero-day remote code execution vulnerability in Adobe Flash,...

Cyberespionage Group Steps Up Campaigns Against Japanese Firms

Researchers are learning more about the cyberespionage group Bronze Butler. While the gang has been targeting Japanese heavy industry since 2012, not much is known about the group’s current modus operandi. In a report released Thursday by the Counter Threat Unit at SecureWorks, a subsidiary of De...

Microsoft Edge Chakra JIT Failed RegexHelper::StringReplace Call

Microsoft Edge: Chakra: JIT: RegexHelper::StringReplace must call the callback function with updating ImplicitCallFlags CVE-2017-11802 The "String.prototype.replace" method can be inlined in the JIT process. So in the method, all the calls which may break the JIT assumptions must be invoked with...

Friday Squid Blogging: International Squid Awareness Day

It's International Cephalopod Awareness Days this week, and Tuesday was Squid Day. I can't believe I missed it. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Ukraine Police Warns of New NotPetya-Style Large Scale CyberAttack

Remember NotPetya? The Ransomware that shut down thousands of businesses, organisations and banks in Ukraine as well as different parts of Europe in June this year. Now, Ukrainian government authorities are once again warning its citizens to brace themselves for next wave of "large-scale"...

open62541/fuzz_binary_message: Crash in UA_SecureChannel_processChunk

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=6734765949452288 Project: open62541 Fuzzer: libFuzzeropen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: libfuzzerubsanopen62541 Platform Id: linux Crash Type: UNKNOWN REA...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of October 9, 2017

Even though “Patch Tuesday” isn’t supposed to exist anymore, here I am blogging about it. As I looked at the October updates from Microsoft, the usual suspects were there. But this month was a little different. We usually see critical vulnerabilities on the browser side, but Microsoft Office is i...

Microsoft windows October release of the 62 flaws vulnerability bug patch, and repair of the National researchers submitted the 0-day flaw vulnerability bug-vulnerability warning-the black bar safety net

Microsoft on Tuesday's Patch Tuesday on the breath announced a 62 bug. the bug of the patch, which contains a has been applied to the major Office 0-day exploits flaws in the bug, this is by memory of the destruction occasioned by the long-distance code to perform vulnerability flaws bug（...

The flaws exploit the bug using the kit Exploit Kit simple history introduction-vulnerability warning-the black bar safety net

Malicious Trojan virus software as well as the rest of the unpopular French there are many ways to get into your computer, but in snapped past few years, the most popular of the two wrist is an e-mail to seduce and application vulnerability flaws bug the application kit. Now, the scum mail of...

Trend Micro OfficeScan 11.0/XG (12.0) - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Trend Micro OfficeScan Remote Code Execution", 'Description' = %q This module exploits the authentication bypass and command injection vulnerabili...

Microsoft Issues Patches For Severe Flaws, Including Office Zero-Day & DNS Attack

As part of its "October Patch Tuesday," Microsoft has today released a large batch of security updates to patch a total of 62 vulnerabilities in its products, including a severe MS office zero-day flaw that has been exploited in the wild. Security updates also include patches for Microsoft Window...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of October 2, 2017

Have you ever read something online and you read a word as something else? Sometimes the weight of our eyelids makes our eyes deceive us after hours staring at a computer screen. As I stated to read a Zero Day Initiative blog published this week by Simon Zuckerbraun, instead of reading the word...

3 vulnerable WordPress plugins affecting 21,000 websites

By Waqas 21,000 Websites Affected after Exploiting of Three WordPress Plugins Zero-day This is a post from HackRead.com Read the original post: 3 vulnerable WordPress plugins affecting 21,000 websites...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of September 25, 2017

A couple of years back, I remember working at a tradeshow booth and giving a demo to someone who was interested in our solution. He said, “Your solution is great, but I need something that will not let anyone from the outside in my network and I need something that will not let my employees do...

Fan your face for 20! Apple system macOS High Sierra（10.13 announced before the release of the again exposed oday vulnerability flaws bug-a vulnerability warning-the black bar safety net

In Apple's estimation of 9 on 25 September the launch of its desktop and notebook computers the latest version of the manipulation of the system-macOS High Sierra（10.13 the previous several hours, a network security seminar staff announced on Twitter a video showing him in the macOS High Sierra...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Google Android

-CVE-2017-0785-BlueBorne-PoC CVE-2017-0785 BlueBorne PoC Gener...

Microsoft Edge Chakra Incorrect Parse

Microsoft Edge: Chakra incorrectly parses object patterns CVE-2017-8729 When the Chakra's parser meets "", at first, Chakra treats it as an object literal without distinguishing whether it will be an object literali.e., a: 0x1234 or an object patterni.e., a = a: 1234. After finishing to parse it...

Locky ransomware campaign launched 20M attacks in a single day

By Uzair Amir Another ‘Aggressive’ Locky ransomware campaign launched with 20 million attacks This is a post from HackRead.com Read the original post: Locky ransomware campaign launched 20M attacks in a single day...

world-snow-day.com XSS vulnerability

Open Bug Bounty ID: OBB-300729 Description| Value ---|--- Affected Website:| world-snow-day.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...