TippingPoint Threat Intelligence and Zero-Day Coverage – Week of October 2, 2017

Have you ever read something online and you read a word as something else? Sometimes the weight of our eyelids makes our eyes deceive us after hours staring at a computer screen. As I stated to read a Zero Day Initiative blog published this week by Simon Zuckerbraun, instead of reading the word...

3 vulnerable WordPress plugins affecting 21,000 websites

By Waqas 21,000 Websites Affected after Exploiting of Three WordPress Plugins Zero-day This is a post from HackRead.com Read the original post: 3 vulnerable WordPress plugins affecting 21,000 websites...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of September 25, 2017

A couple of years back, I remember working at a tradeshow booth and giving a demo to someone who was interested in our solution. He said, “Your solution is great, but I need something that will not let anyone from the outside in my network and I need something that will not let my employees do...

Fan your face for 20! Apple system macOS High Sierra（10.13 announced before the release of the again exposed oday vulnerability flaws bug-a vulnerability warning-the black bar safety net

In Apple's estimation of 9 on 25 September the launch of its desktop and notebook computers the latest version of the manipulation of the system-macOS High Sierra（10.13 the previous several hours, a network security seminar staff announced on Twitter a video showing him in the macOS High Sierra...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Google Android

-CVE-2017-0785-BlueBorne-PoC CVE-2017-0785 BlueBorne PoC Gener...

Microsoft Edge Chakra Incorrect Parse

Microsoft Edge: Chakra incorrectly parses object patterns CVE-2017-8729 When the Chakra's parser meets "", at first, Chakra treats it as an object literal without distinguishing whether it will be an object literali.e., a: 0x1234 or an object patterni.e., a = a: 1234. After finishing to parse it...

Locky ransomware campaign launched 20M attacks in a single day

By Uzair Amir Another ‘Aggressive’ Locky ransomware campaign launched with 20 million attacks This is a post from HackRead.com Read the original post: Locky ransomware campaign launched 20M attacks in a single day...

world-snow-day.com XSS vulnerability

Open Bug Bounty ID: OBB-300729 Description| Value ---|--- Affected Website:| world-snow-day.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

dlplibs: Index-out-of-bounds in WKS4Chart::updateChart

Detailed report: https://oss-fuzz.com/testcase?key=4881481551839232 Project: dlplibs Fuzzer: libFuzzerdlplibswdbfuzzer Fuzz target binary: wdbfuzzer Job Type: libfuzzerubsandlplibs Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: WKS4Chart::updateChart...

openthread: Stack-buffer-overflow in ot::NetworkData::PrefixTlv::GetSubTlvs

Detailed report: https://oss-fuzz.com/testcase?key=5490815742771200 Project: openthread Fuzzer: libFuzzeropenthreadip6-send-fuzzer Fuzz target binary: ip6-send-fuzzer Job Type: libfuzzerasanopenthread Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7fb823a8eb22 Crash...

dlplibs: Index-out-of-bounds in WKS4Chart::sendCharts

Detailed report: https://oss-fuzz.com/testcase?key=5151574194126848 Project: dlplibs Fuzzer: libFuzzerdlplibswksfuzzer Fuzz target binary: wksfuzzer Job Type: libfuzzerubsandlplibs Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: WKS4Chart::sendCharts WKS4Parser::par...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of September 11, 2017

In last week’s blog, I mentioned the Apache Struts vulnerability, which is still making headlines as estimates show that as many as 65 percent of Fortune 500 companies use it in some form. In addition, Equifax claims it has played a role in their breach affecting more than 143 million Americans. ...

openthread: Stack-buffer-overflow in ot::MeshCoP::CommissionerSessionIdTlv::GetCommissionerSessionId

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=6738146924429312 Project: openthread Fuzzer: libFuzzeropenthreadip6-send-fuzzer Fuzz target binary: ip6-send-fuzzer Job Type: libfuzzerasanopenthread Platform Id: linux Crash Type:...

FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY

FireEye recently detected a malicious Microsoft Office RTF document that leveraged CVE-2017-8759, a SOAP WSDL parser code injection vulnerability. This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents. FireEye analyzed a Microsoft...

Get $1M for reporting zero-day flaws in Tor to “help Govt fight crime”

By Waqas Usually, a bug bounty program helps companies secure their software and This is a post from HackRead.com Read the original post: Get $1M for reporting zero-day flaws in Tor to help Govt fight crime...

Zerodium Offering $1M for Tor Browser Zero Days

The exploit acquisition vendor Zerodium is doubling down again. Weeks after the company said it would pay $500,000 for zero days in private messaging apps such as Signal and WhatsApp, Zerodium said Wednesday it will pay twice that for a zero day in Tor Browser. The company said it will pay up to ...

Zerodium Offers $1 Million for Tor Browser 0-Days That It will Resell to Governments

It seems like Tor Browser zero-day exploits are in high demand right now—so much so that someone is ready to pay ONE MILLION dollars. Zerodium—a company that specialises in acquiring and reselling zero-day exploits—just announced that it will pay up to USD 1,000,000 for working zero-day exploits...

Immediately Patch Windows 0-Day Flaw That's Being Used to Spread Spyware

Get ready to install a fairly large batch of security patches onto your Windows computers. As part of its September Patch Tuesday, Microsoft has released a large batch of security updates to patch a total of 81 CVE-listed vulnerabilities, on all supported versions of Windows and other MS products...

The IoT Attack Vector “BlueBorne” Exposes Almost Every Connected Device (BlueBorne)

General Overview Armis Labs revealed a new attack vector endangering major mobile, desktop, and IoT operating systems, including Android, iOS, Windows, and Linux, and the devices using them. The new vector is dubbed “BlueBorne”, as it spread through the air airborne and attacks devices via...

Microsoft Patches .NET Zero Day Vulnerability in September Update

An actively exploited zero-day vulnerability tied to Microsoft’s .NET framework is one of 25 critical and 54 important vulnerabilities fixed by Microsoft in its September Patch Tuesday security bulletin. According to Microsoft, the .NET framework vulnerability CVE-2017-8759 allows attackers to...