63 New Flaws (Including 0-Days) Windows Users Need to Patch Now

It's Patch Tuesday once again…time for another round of security updates for the Windows operating system and other Microsoft products. This month Windows users and system administrators need to immediately take care of a total of 63 security vulnerabilities, of which 12 are rated critical, 49...

Patch Tuesday: Microsoft Addresses Two Zero-Days in 60-Flaw Roundup

Microsoft has rolled out its August Patch Tuesday fixes, addressing 19 critical vulnerabilities, including fixes for two zero-day vulnerabilities that are under active attack. Overall, the company patched a total of 60 flaws, spanning Microsoft Windows, Edge, Internet Explorer IE, Office, .NET...

amhsnewspaper.com XSS vulnerability

Open Bug Bounty ID: OBB-657053 Description| Value ---|--- Affected Website:| amhsnewspaper.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

EU Fines Google Record $5 Billion in Android Antitrust Case

Google has been hit by a record-breaking $5 billion antitrust fine by the European Union regulators for abusing the dominance of its Android mobile operating system and thwarting competitors. That's the largest ever antitrust penalty. Though Android is an open-source and free operating system,...

arrivealive.co.za XSS vulnerability

Open Bug Bounty ID: OBB-636364 Description| Value ---|--- Affected Website:| arrivealive.co.za Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Microsoft Windows Defender AV: Number of days before spyware definitions are outdated

This test checks the setting for policy OpenVAS Vulnerability Test $Id: defavdaysbeforespywareoutdated.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Windows Defender AV: Define the number of days before spyware definitions are considered out of date Authors: Emanuel Moss Copyright:...

imagicom.it XSS vulnerability

Open Bug Bounty ID: OBB-614785 Description| Value ---|--- Affected Website:| imagicom.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

storebrand.no XSS vulnerability

Open Bug Bounty ID: OBB-612298 Description| Value ---|--- Affected Website:| storebrand.no Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Instacart: CSRF Trial 14 days express subscription

Description ======== When a new user has been registered, Instacart pops up a message offering the user for a limited time 14 days express trial, in which the user may decide to skip and subscribe later on decision. The research has found that the express trial subscription endpoint does not...

How to mitigate rapid cyberattacks such as Petya and WannaCrypt

In the first blog post of this 3-part series, we introduced what rapid cyberattacks are and illustrated how rapid cyberattacks are different in terms of execution and outcome. In the second blog post, we provided some details on Petya and how it worked. In this final blog post, we will share:...

February 1, 2018 – Morning Cyber Coffee Headlines – “Super Bowl” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! February 1, 2018 - Headlines Carbon Black in the News: Kim Jong Nam met...

saintdenissurloire.fr XSS vulnerability

Open Bug Bounty ID: OBB-459585 Description| Value ---|--- Affected Website:| saintdenissurloire.fr Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

librawspeed: Heap-buffer-overflow in rawspeed::RawImageData::transferBadPixelsToMap

Detailed report: https://oss-fuzz.com/testcase?key=4689297217159168 Project: librawspeed Fuzzer: afllibrawspeedTiffDecoderFuzzer-Rw2Decoder Fuzz target binary: TiffDecoderFuzzer-Rw2Decoder Job Type: aflasanlibrawspeeduntrusted Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

The researchers published the iOS kernel exploit code-exploit warning-the black bar safety net

From the mobile security company Zimperium researchers Adam Donenfeld published zIVA kernel exploit program PoC code. zIVA affect iOS 10.3.1 and prior versions, an attacker can by zIVA using the code to get any read-write and root access. Apple 5 months to fix the vulnerability Apple to 5 months ...

Foxit to Fix PDF Reader Zero Days by Friday

In an about-face, Foxit Software says it will fix a pair of zero days in its PDF reader Foxit Reader and PhantomPDF, its PDF editing software. Foxit said it would push a patch for Reader and PhantomPDF, bringing the software to version 8.3.2, later this week—by Friday at the latest. The fixes com...

Updates to Sofacy, Turla Highlight 2017 Q2 APT Activity

Attackers behind advanced persistent threat campaigns have kept busy over the past several months, adding new ways to bypass detection, crafting new payloads to drop, and identifying new zero days and backdoors to help them infect users and maintain persistence on machines. Juan Andres...

sef.pt XSS vulnerability

Open Bug Bounty ID: OBB-266275 Description| Value ---|--- Affected Website:| sef.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

July 7, 2017 – Morning Cyber Coffee Headlines – “Spiderman” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 7, 2017 - Headlines Carbon Black in the News: Residents of these states ar...

Humax Digital HG100R 2.0.6 XSS / Information Disclosure

Humax Digital HG100R multiple vulnerabilities Device: Humax HG100R Software Version: VER 2.0.6 - Backup file download CVE-2017-7315 An issue was discovered on Humax Digital HG100R 2.0.6 devices, a modem commonly used by ISPs to provide ADSL internet service to household and small business users...

Platinum APT First to Abuse Intel Chip Management Feature

Advanced attackers operating in Southeast Asia are abusing a feature in Intel chips to quietly load malware and exploits onto compromised machines. Microsoft on Thursday published its latest research into a group it calls Platinum, which is keen on using previously untapped resources to stealthil...