Hackers Exploit Zero-Day Magento Vulnerability to Steal Your Credit Cards

Hackers are increasingly exploiting an unknown flaw to siphon payment card information from e-commerce websites that use Magento, the most popular e-commerce platform owned by eBay. Security researchers at Sucuri are still investigating the attack vector, but they believe that cyber criminals are...

On the Cisco Default SSH Keys, OPM Hack, the Adobe Zero Day, and More

Dennis Fisher and Mike Mimoso talk about the Cisco default SSH keys, more details of the OPM data breach, the Adobe 0-day and why we never hear about bad APT groups, only the really good ones. Download: digitalunderground208.mp3 Music by Chris Gonsalves...

This Unbreakable Encryption Could Save the Internet

The Awareness to encrypt your private data, chat conversations as well as communication is booming like never before that soon the world will mark some day as the International Encryption Day. This may or may not be possible in future, but Toshiba is all set to create a next level of encryption...

Adobe Releases Emergency Patch for Flash Zero-Day Vulnerability

Adobe has rolled out an emergency software patch for its Flash Player to patch a critical zero-day vulnerability that is already exploited by the hackers in the wild. The company said the flaw could potentially allow hackers to take control of the affected system and that it had evidence of...

Adobe Patches Flash Zero Day Attacked by Clandestine Wolf

Adobe today released an out-of-band patch for a Flash Player zero-day vulnerability being used in targeted attacks by an APT gang known for its storehouse of exploits targeting unpatched browser-based vulnerabilities. The group, named by FireEye as APT3 and responsible for the so-called Clandesti...

Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign

Adobe has already released a patch for CVE-2015-3113 with an out-of-band security bulletin . FireEye recommends that Adobe Flash Player users update to the latest version as soon as possible. FireEye MVX detects this threat as a web infection, the IPS engine reports the attack as CVE-2015-3113, a...

HP Releases Details, Exploit Code for Unpatched IE Flaws

Researchers at HP’s Zero Day Initiative have disclosed full details and proof-of-concept exploit code for a series of bugs they discovered that allow attackers to bypass a key exploit mitigation in Internet Explorer. The disclosure is a rarity for ZDI. The company typically does not publish...

Zero-Day Exploits for Stealing OS X and iOS Passwords

I think you'll agree with me when I say: Apple devices are often considered to be more safe and secure than other devices that run on platforms like Windows and Android, but a recent study will make you think twice before making this statement. A group of security researchers have uncovered...

Tango DropBox v3.1 PRO - ActiveX Heap Spray Exploit

Document Title: =============== Tango DropBox v3.1 PRO - ActiveX Heap Spray Exploit References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1529 View Video: https://www.youtube.com/watch?v=jOCGPNzqkXg Release Date: ============= 2015-06-17 Vulnerability Laboratory ID VL-ID:...

US Navy Soliciting Zero Days

The National Security Agency may find and purchase zero days, but that doesn’t mean it’s sharing its hoard with other government agencies such as the U.S. Navy, which apparently is in the market for some unpatched, undisclosed vulnerabilities of its own. A request for proposal posted last...

TinySRP Buffer Overflow

Dear Fulldisclosure, I submitted the below vulnerability to the HP Zero Day Initiative. They responded that they are not interested in vulnerabilities in this "product". Further, I tried to contact one of the authors Eric A. Young; the email bounced. I am busy with my day job and do not have the...

Wassenaar, Bug Bounties and Vulnerability Rewards Programs

Bug bounties have gone from novelty to necessity, not only for enterprises looking to take advantage of the skills of an organized pool of vulnerability hunters, but also for a slew of independent researchers who make a living contributing to various vendor and independent bounty and reward...

Unity Web Player Zero-Day Vulnerability Disclosed

Some detail has been disclosed about a zero-day vulnerability in the Unity Web Player browser plugin that can allow an attacker to use a victim’s credentials to read messages or otherwise abuse their access to online services. The partial disclosure was made after nearly six months of bug-report...

Apple Mac OSX Zero-Day Bug Allows Hackers to Install RootKit Malware

A zero-day software vulnerability discovered deep in the firmware of many Apple computers could allows an attacker to modify the system’s BIOS and install a rootkit, potentially gaining complete control of the victim’s Mac. The critical vulnerability, discovered by well-known OS X security...

Apple Blocks Older Versions of Flash Player

On the heels of a major Adobe Flash Player update two weeks ago, Apple last night updated its blacklist to include older versions of the software. In its advisory, Apple said it will begin blocking out-of-date versions of Flash in its Safari browser. “If you’re using an out-of-date version of the...

APT Group Embeds C&C Data on TechNet Pages

The so-called Deputy Dog APT group has surfaced again with a means of keeping its command and control servers under wraps that involves Microsoft’s TechNet online resources. New research published last week by Microsoft and FireEye revealed targeted attacks against organizations have been...

MacKeeper Zero Day Remote Code Execution Vulnerability

A controversial piece of security and maintenance software for Mac OS X computers, known as MacKeeper, has been found to be vulnerable to a critical remote code execution vulnerability. MacKeeper antivirus software for Mac OS X is designed to improve Mac performance and security, but it is infamo...

MacKeeper URL Handler Remote Code Execution Exploit

Exploit for macOS platform in category remote exploits !/usr/bin/python """ SecureMac has released an advisory on a vulnerability discovered today with MacKeeper. The advisory titled MacKeeper URL handler remote code execution vulnerability and proof-of-concept Zero-Day contains the latest...

WordPress Sites Backdoored, Leaking Credentials

WordPress site administrators just cannot come up for air. With a raft of WordPress vulnerabilities—most of them in plugins—to address, now comes word that a number of sites running the content management system have been compromised and are sending credentials via a backdoor to a criminal group...

MacKeeper - URL Handler Remote Code Execution

MacKeeper - URL Handler Remote Code Execution !/usr/bin/python """ SecureMac has released an advisory on a vulnerability discovered today with MacKeeper. The advisory titled MacKeeper URL handler remote code execution vulnerability and proof-of-concept Zero-Day contains the latest information...