More on the Vulnerabilities Equities Process

Richard Ledgett -- a former Deputy Director of the NSA -- argues against the US government disclosing all vulnerabilities: Proponents argue that this would allow patches to be developed, which in turn would help ensure that networks are secure. On its face, this argument might seem to make sense ...

Microsoft Patches Critical Windows Search Vulnerability

Microsoft patched more than two dozen remote code execution vulnerabilities today, many of them rated critical. One was a RCE bug that allowed an attacker to take complete control of a server or workstation via Windows Search. The fixes were part of Microsoft’s August Patch Tuesday update that...

APT Trends report Q2 2017

Introduction Since 2014, Kaspersky Lab's Global Research and Analysis Team GReAT has been providing threat intelligence reports to a wide-range of customers worldwide, leading to the delivery of a full and dedicated private reporting service. Prior to the new service offering, GReAT published...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of July 31, 2017

During the DefCon Conference last week, a Windows SMB vulnerability was revealed by researchers from RiskSense. The 20-year-old bug can be found in Windows 2000 up to Windows 10. Microsoft has indicated that it will not be issuing a patch for the vulnerability as it doesn't meet their bar for...

Will The Real Security Community Please Stand Up

Threatpost Op-Ed is a regular feature where experts contribute essays and commentary on what’s happening in security and privacy. Black Hat 2017 was a vocabulary lesson for white-hats, and yes, words matter. Words such as nihilism, empathy and inclusion have to matter, because what you’re doing n...

NSA Collects MS Windows Error Information

Back in 2013, Der Spiegel reported that the NSA intercepts and collects Windows bug reports: One example of the sheer creativity with which the TAO spies approach their work can be seen in a hacking method they use that exploits the error-proneness of Microsoft's Windows. Every user of the...

Cisco DPC3939 Comcast Firmware Information Disclosure Vulnerability

The Cisco DPC3939 XB3 is a wireless home voice gateway product from Cisco USA.Comcast is a set of firmware developed by Comcast that runs in devices such as gateways and modems. A security vulnerability exists in the Comcast firmware in the Cisco DPC3939 using the...

Default credentials

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to compute password-of-the-day values via unspecified vectors...

CVE-2017-9486

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to compute password-of-the-day values via unspecified vectors...

CVE-2017-9486

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to compute password-of-the-day values via unspecified vectors...

CVE-2017-9486

CVE-2017-9486 affects Cisco DPC3939 devices running the Comcast firmware dpc3939-P20-18-v303r20421746-170221a-CMCST. The published records consistently describe the issue as a vulnerability in the Comcast firmware that allows remote attackers to compute the password-of-the-day (POTD) values via u...

CVE-2017-9486

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to compute password-of-the-day values via unspecified vectors...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of July 24, 2017

This week, I attended the Black Hat conference in Las Vegas, Nevada. 2017 marked the 20th anniversary of the Black Hat conference. A lot has certainly changed since I started attending back in 2002. I’m sure that many will have their opinions on the central themes that they saw at the conference...

Zero-Day Vulnerabilities against Windows in the NSA Tools Released by the Shadow Brokers

In April, the Shadow Brokers -- presumably Russia -- released a batch of Windows exploits from what is presumably the NSA. Included in that release were eight different Windows vulnerabilities. Given a presumed theft date of the data as sometime between 2012 and 2013 -- based on timestamps of the...

30-day-change.com XSS vulnerability

Open Bug Bounty ID: OBB-270261 Description| Value ---|--- Affected Website:| 30-day-change.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Microsoft Is Paying Up To $250,000 With Its New Bug Bounty Program

Microsoft has finally launched a new dedicated bug bounty program to encourage security researchers and bug hunters for finding and responsibly reporting vulnerabilities in its latest Windows versions of operating systems and software. Being the favourite target of hackers and cyber criminals,...

Adobe is Finally Killing FLASH — At the End of 2020!

Finally, Adobe is Killing FLASH — the software that helped make the Internet a better place with slick graphics, animation, games and applications and bring online video to the masses, but it has been hated for years by people and developers over its buggy nature. But the end of an era for Adobe...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of July 17, 2017

If you conduct a search on the Web for the number of languages spoken around the world, you’ll see numbers ranging anywhere from 6,000-7,000. I figure I’m doing okay since I can speak English and Spanish, sign the English alphabet, recite the Greek alphabet, and read music. There are roughly over...

Mail.ru: uninitilized server memory disclosure via ImageMagick in my.mail.ru and cloud.mail.ru

0-day Image Magic application / library vulnerability led to process's uninitialized memory region disclosure via converted image file. Region's address was not directly controlled by attacker. Vulnerability was reported for 2 projects: cloud.mail.ru is in bug bounty scope, but, as a mitigation...

gdal: Heap-buffer-overflow in putcontig8bitYCbCr42tile

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6163325639458816 Project: gdal Fuzzer: aflgdalgtiffmmap Fuzz target binary: gtiffmmap Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6110000004cb Crash...