Cb Customer Spotlight Series: Q&A with Integral’s Sean McFeely

Featuring Sean McFeely, Sr. Information Analyst at Valvoline’s Integral Defense This year at Cb Connect 2018, we had our first ever Developer Day to recognize our vibrant partner and developer ecosystem. We had an amazing group of 100 developers attend, culminating in a hackathon. Sean McFeely, S...

Adobe Fixes Acrobat and Reader Flaw With Publicly-Available PoC

Adobe on Tuesday released three patches – including a fix for a flaw in Adobe Acrobat and Reader that exposes hashed passwords that already has a proof-of-concept PoC exploit code publicly available. The information disclosure vulnerability, CVE-2018-15979, exists in Adobe Acrobat and Reader for...

XAMPP Control Panel 3.2.2 - Buffer Overflow (SEH) (Unicode)

XAMPP Control Panel 3.2.2 - Buffer Overflow SEH Unicode Exploit Title: XAMPP Control Panel 3.2.2 - Buffer Overflow SEH Unicode Exploit Author: Gionathan "John" Reale 0-day DoS exploit, Semen Alexandrovich Lyhin 1-day fully working exploit. Shellcode Author: Giuseppe D'Amore EDB:28996 Date:...

zlib/example_dict_fuzzer: Use-of-uninitialized-value in slide_hash

Project: https://github.com/madler/zlib.git Detailed report: https://oss-fuzz.com/testcase?key=5725547573805056 Project: zlib Fuzzer: libFuzzerzlibexampledictfuzzer Fuzz target binary: exampledictfuzzer Job Type: libfuzzermsanzlib Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

Russian exploit developer publicly disclosed VirtualBox zero-day vulnerability

By Waqas An independent IT security researcher and exploit developer from Russia has publicly revealed a zero-day vulnerability in all versions of VirtualBox VB 5.2.20 and prior. VB is commonly used open source virtualization software that has been developed by Oracle. According to the analysis o...

Unpatched VirtualBox Zero-Day Vulnerability and Exploit Released Online

An independent exploit developer and vulnerability researcher has publicly disclosed a zero-day vulnerability in VirtualBox—a popular open source virtualization software developed by Oracle—that could allow a malicious program to escape virtual machine guest OS and execute code on the operating...

Unpatched VirtualBox Zero-Day Vulnerability and Exploit Released Online

An independent exploit developer and vulnerability researcher has publicly disclosed a zero-day vulnerability in VirtualBox —a popular open source virtualization software developed by Oracle—that could allow a malicious program to escape virtual machine guest OS and execute code on the operating...

Researchers wishing to publish Microsoft Edge browser 0-day sandbox escape vulnerability-vulnerability warning-the black bar safety net

In recent days, according to Twitter nickname is@Yux1xi（Yushi Liang security researchers revealed that he plans to publish on a Microsoft browser Microsoft Edge 0-day vulnerability that can be achieved for Edge browser remote code execution RCE, and@Yux1xi also claimed that he and his Russian...

skia/api_raster_n32_canvas: Crash in fuzz_paint_text_encoding

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5640570907656192 Project: skia Fuzzer: libFuzzerskiaapirastern32canvas Fuzz target binary: apirastern32canvas Job Type: libfuzzermsanskia Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

libreoffice/ww8fuzzer: Heap-use-after-free in SwPaM::Start

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5746388701282304 Project: libreoffice Fuzzer: libFuzzerlibreofficeww8fuzzer Fuzz target binary: ww8fuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-fre...

Bluetooth Chip Bugs Affect Enterprise Wi-Fi, as Hackers Exploit Cisco 0-Day

In this latest roundup of cyber security news, we look at serious Bluetooth chip-level bugs, a zero-day vulnerability on Cisco software, a raft of Apple security fixes, and a massive customer data breach at Cathay Pacific. Enterprise Wi-Fi access points vulnerable to Bluetooth bug A pair of...

Cisco Security Appliance Zero-Day Found Actively Exploited in the Wild

Attackers are actively exploiting a zero-day vulnerability in certain Cisco security products, to cause a denial-of-service DoS condition. The as-yet-unpatched flaw CVE-2018-15454 has an 8.6 CVSS score and is rated high-severity. It exists in the Session Initiation Protocol SIP inspection engine ...

ThreatList: Fewer Big DDoS Attacks in Q3, Overall Rate Holds Steady

When it comes to distributed denial of service DDoS attacks, the third quarter of 2018 marked an apparent lull in the action, with fewer huge, multi-day attacks than in previous quarters. Researchers however warn against having a false sense of security: The total number of attacks in the quarter...

Cross site request forgery (csrf)

CSRF exists in zbusers/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 Zero, which allows remote attackers to execute arbitrary PHP code...

day-finder.com XSS vulnerability

Open Bug Bounty ID: OBB-691649 Description| Value ---|--- Affected Website:| day-finder.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Windows ‘Deletebug’ Zero-Day Allows Privilege Escalation, Destruction

A proof-of-concept exploit for a Windows zero-day that works on fully patched Windows 10 machines has been released by a security researcher. It allows an attacker to delete any kind of file on a victim machine, including system data. The flaw no CVE has been assigned since it was just exposed on...

ThreatList: Ransomware, EKs and Trojans lead the Way in Q3 Malware Trends

When it comes to malware activity, businesses took a big hit in the third quarter, with detection trending upward by a whopping 55 percent, according to new research. Consumers saw an uptick too, but only a modest one: volume was up just 4 percent quarter-over-quarter for this segment. Overall,...

Hacker Discloses New Windows Zero-Day Exploit On Twitter

A security researcher with Twitter alias SandboxEscaper—who two months ago publicly dropped a zero-day exploit for Microsoft Windows Task Scheduler—has yesterday released another proof-of-concept exploit for a new Windows zero-day vulnerability. SandboxEscaper posted a link to a Github page hosti...

Hacker Discloses New Windows Zero-Day Exploit On Twitter

A security researcher with Twitter alias SandboxEscaper—who two months ago publicly dropped a zero-day exploit for Microsoft Windows Task Scheduler—has yesterday released another proof-of-concept exploit for a new Windows zero-day vulnerability. SandboxEscaper posted a link to a Github page hosti...

StrongPity APT Changes Tactics to Stay Stealthy

The APT group behind the sophisticated malware known as StrongPity a.k.a. Promethium has changed its tactics, after various research groups analyzed the malware and exposed its methods of deployment. The efforts have allowed the group to return to hidden status, even after being labeled a known...