This Week in Security News: Security Researcher Discloses Four IBM Zero-Days After Company Refused to Patch and Trend Micro Integrates with Amazon AppFlow

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, read about a security researcher who has published details about four zero-day vulnerabilities impacting an IBM security product after the...

standa.lt Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1149436 Security Researcher EvilOperator Helped patch 4 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting standa.lt website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO...

Russian Hackers Went After San Francisco International Airport

Plus: Windows zero days, Covid-19 spam, and more of the week's top security news...

Microsoft Issues Patches for 3 Bugs Exploited as Zero-Day in the Wild

It's April 2020 Patch Tuesday , and during these challenging times of coronavirus pandemic, this month's patch management process would not go easy for many organizations where most of the resources are working remotely. Microsoft today released the latest batch of software security updates for a...

sanatahsap.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1142629 Security Researcher geeknik Helped patch 8696 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting sanatahsap.com website and...

nekkyo-singapore.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1137943 Security Researcher g0bl1nsec Helped patch 3754 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting nekkyo-singapore.com...

kalibar.rs Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1135921 Security Researcher DakkarKey Helped patch 407 vulnerabilities Received 6 Coordinated Disclosure badges Received 14 recommendations , a holder of 6 badges for responsible and coordinated disclosure, found a security vulnerability affecting kalibar.rs website and it...

webmasterstudio.md Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1134897 Security Researcher g0bl1nsec Helped patch 3754 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting webmasterstudio.md websit...

rentsj.ca Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1133977 Security Researcher KhanJanny Helped patch 3053 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting rentsj.ca website and it...

An Elite Spy Group Used 5 Zero-Days to Hack North Koreans

South Korea is a prime suspect for exploiting the secret software vulnerabilities in a sophisticated espionage campaign...

Threat Source newsletter (Feb. 6, 2020)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. There’s never been a better time to be into cyber security podcasts. Our Podcasts page on TalosIntelligence.com got a facelift this week...

Threat Source newsletter (Jan. 30, 2020)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. Be sure to pay close attention Tuesday for some changes we have coming to Snort.org. We’ll spare you the details for now, but please bea...

Threat Source newsletter (Jan. 23, 2020)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. Despite tensions starting to fizzle between the U.S. and Iran, people are still worried about cyber conflict. What would that even look...

days-fashion-b2c.webshopapp.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1053186 Security Researcher kun-fly Helped patch 667 vulnerabilities Received 7 Coordinated Disclosure badges Received 43 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

freetype2:cff-render-ftengine: Invalid-builtin-use in FT_Outline_Get_Orientation

Detailed Report: https://oss-fuzz.com/testcase?key=5735696199581696 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: cff-render-ftengine Job Type: libfuzzerubsanfreetype2 Platform Id: linux Crash Type: Invalid-builtin-use Crash Address: Crash State: FTOutlineGetOrientation...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...

CVE-2012-5193

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...

qpdf:dct_fuzzer: Use-of-uninitialized-value in ycck_cmyk_convert

Project: https://github.com/qpdf/qpdf.git Detailed Report: https://oss-fuzz.com/testcase?key=5646580451639296 Project: qpdf Fuzzing Engine: libFuzzer Fuzz Target: dctfuzzer Job Type: libfuzzermsanqpdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

wireshark:fuzzshark_ip_proto-udp: Heap-use-after-free in wmem_strbuf_get_str

Project: https://code.wireshark.org/review/wireshark Detailed Report: https://oss-fuzz.com/testcase?key=5193372674818048 Project: wireshark Fuzzing Engine: afl Fuzz Target: fuzzsharkipproto-udp Job Type: aflasanwireshark Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

This Week in Security News: IoT Devices Are a Target in Cybercriminal Underground

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn how fileless malware abuses PowerShell. Also, read how Trend Micro researchers are pulling back the curtain on the cybercriminal...