Fast-Moving DDoS Botnet Exploits Unpatched ZyXel RCE Bug

A new variant of the Hoaxcalls botnet, which can be marshalled for large-scale distributed denial-of-service DDoS campaigns, is spreading via an unpatched vulnerability impacting the ZyXEL Cloud CNM SecuManager that was disclosed last month. That’s according to researchers at Radware, who also sa...

New iPhone Zero-Day Discovered

Last year, ZecOps discovered two iPhone zero-day exploits. They will be patched in the next iOS release: Avraham declined to disclose many details about who the targets were, and did not say whether they lost any data as a result of the attacks, but said "we were a bit surprised about who was...

SAS, sweet SAS

As you may already know from our social network posts, we have rescheduled the SAS 2020 conference for November 18-21 due to the COVID-19 pandemic and to ensure your safety. Though we still think that Barcelona is a great place to meet and it will not be a "real" SAS if we cannot hug, shake hands...

Google Releases Security Updates for Chrome

Google has released Chrome version 81.0.4044.122 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the...

Monero: Unix time unlock_time values have dangerous validation rules enabling a number of exploits

Initially found by TheCharlatan, discussed with and expanded on by Isthmus, impacts all releases of monero and monero wallets Description The unlocktime field in monero transaction dictates when a transaction's outputs can be spent again. This rule is enforced by the consensus code in...

Scientific Linux Security Update : okular on SL7.x x86_64 (20200407)

okular: Directory traversal in function unpackDocumentArchive in core/document.cpp C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135826; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Photon OS 3.0: File PHSA-2020-3.0-0080

An update of the file package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0080. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid135790;...

Scientific Linux Security Update : python on SL7.x x86_64 (20200407)

python: Cookie domain check returns incorrect results python: email.utils.parseaddr wrongly parses email addresses C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135831; scriptversion"1.3";...

Scientific Linux Security Update : python3 on SL7.x x86_64 (20200407)

python: Cookie domain check returns incorrect results python: email.utils.parseaddr wrongly parses email addresses C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135830; scriptversion"1.3";...

Photon OS 3.0: Python3 PHSA-2020-3.0-0078

An update of the python3 package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0078. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid135785;...

Scientific Linux Security Update : libxml2 on SL7.x x86_64 (20200407)

libxml2: Use after free triggered by XPointer paths beginning with range-to libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate function in xpath.c libxml2: DoS caused by incorrect error detection during XZ decompression libxml2: NULL pointer dereference in xmlXPathCompOpEval functio...

Mootbot Botnet Targets Fiber Routers with Dual Zero-Days

The Mootbot botnet has been using a pair of zero-day exploits to compromise multiple types of fiber routers. According to researchers, other botnets have attempted to do the same, but have so far failed. According to researchers at NetLab 360, the operators of the Mootbot botnet in late February...

CVE-2020-10882

creationtimestamp| type| source ---|---|--- 2020-04-15 16:34:56+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/tplinkarchera7c7lanrce.rb 2020-04-16 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48331 2020-11-08 22:54:08+00:00|...

Photon OS 1.0: Linux PHSA-2020-1.0-0287

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0287. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid135485...

Microsoft Issues Patches for 3 Bugs Exploited as Zero-Day in the Wild

It's April 2020 Patch Tuesday, and during these challenging times of coronavirus pandemic, this month's patch management process would not go easy for many organizations where most of the resources are working remotely. Microsoft today released the latest batch of software security updates for al...

Keep Zoombombing cybercriminals from dropping a load on your meetings

While shelter in place has left many companies struggling to stay in business during the COVID-19 epidemic, one company in particular has seen its fortunes rise dramatically. Zoom, the US-based maker of teleconferencing software, has become the web conference tool of choice for employees working...

Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation — Intelligence for Vulnerability Management, Part Two

One of the critical strategic and tactical roles that cyber threat intelligence CTI plays is in the tracking, analysis, and prioritization of software vulnerabilities that could potentially put an organization’s data, employees and customers at risk. In this four-part blog series, FireEye Mandian...

HTTP Request-splitting

SeaMonkey is vulnerable to HTTP request-splitting.A request-splitting flaw was found in the way in which SeaMonkey generates a digest authentication request. If a user opened a specially-crafted URL, it was possible to perform cross-site scripting attacks, web cache poisoning, or other, similar...

CentOS 7 : libqb (RHSA-2020:1189)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1189 advisory. - libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames under /dev/shm and /tmp without...

Dark_Nexus Botnet Compromises Thousands of ASUS, D-Link Routers

A new botnet has compromised hundreds of ASUS, D-Link and Dasan Zhone routers over the past three months, as well as Internet of Things IoT devices like video recorders and thermal cameras. The botnet, called darknexus based on a string it prints in its banner, uses processes similar to previous...