Microsoft Edge CVE-2017-11844 Information Disclosure Vulnerability

Description Microsoft Edge is prone to an information disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Edge Recommendations Run all software as a nonprivileged user with minimal acce...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

November 2, 2017 – Morning Cyber Coffee Headlines – “Houston Astros” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! November 2, 2017 - Headlines Leaked Data From Massive Malaysian Breach 'Likely...

Chain of 11 Bugs Takes Down Galaxy S8 at Mobile Pwn2Own

The mobile version of the annual Pwn2Own contest wrapped up today in Tokyo with an unprecedented attack chain leveling the Samsung Galaxy S8. Researchers from MWR Labs used 11 vulnerabilities across six different mobile applications to execute code on Samsung’s flagship device and exfiltrate data...

Tales from the blockchain

Cryptocurrency has gradually evolved from an element of a new world, utopian economy to a business that has affected even those sectors of society least involved in information technology. At the same time, it has acquired a fair number of "undesirable" supporters who aim to enrich themselves at...

Flaw in Google Bug Tracker Exposed Reports About Unpatched Vulnerabilities

Google’s Issue Tracker, also known internally as the “Buganizer,” contained until recently a vulnerability that would allow an external party access to any unpatched bug listed and described in the database. Alex Birsan, a software developer and hobbyist bug-hunter, collected more than $15,000 in...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of October 23, 2017

Just like Bugs Bunny wears disguises to avert his enemies, there’s another “wascally” rabbit causing trouble in the form of ransomware. Bad Rabbit is the latest ransomware campaign hitting Eastern European countries with what looks like a variant of the Petya/NotPetya ransomware. Bad Rabbit sprea...

October 26, 2017 – Morning Cyber Coffee Headlines – “Continental Congress” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 26, 2017 - Headlines Carbon Black in the News: Protecting elections fro...

Hackers Prepping IOTroop Botnet with Exploits

Hackers moved one step closer to launching full-scale DDoS attacks using millions of IoT devices herded into the botnet known as Reaper or IOTroop. Researchers at NewSky Security warn that hackers are swapping scripts on forums that can scan the internet for vulnerable IoT devices and dump defaul...

Brilliant Gallery - Highly critical - Multiple Vulnerabilities - SA-CONTRIB-2017-079

This module enables you to display any number of galleries based on images located in the files folder. The module doesn't sufficiently sanitize various database queries which may allow attackers to craft requests resulting in an SQL injection vulnerability. This vulnerability could be exploited...

The best Burp plugin I’ve ever seen

Wanted to share with you what IMHO is the most promising Burp Suite plugin that just might transform it to the best penetration tool ever. It’s the Vulners plugin, available for free at github . If you are lazy like me, a build is available here: Installation It’s easy if you know how to deal wit...

Making Microsoft Edge the most secure browser with Windows Defender Application Guard

Innovation in the attack space is constant as adversaries increase in both determination and sophistication. In response to increased investments in defense, attackers are adapting and improving tactics at breakneck speed. The good news is that defenders are also innovating and disrupting long...

CVE-2017-14143

creationtimestamp| type| source ---|---|--- 2017-10-23 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43028 2018-01-24 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43876 2018-05-29 15:50:33+00:00| seen|...

Oracle Critical Patch Update - October 2017

A Critical Patch Update CPU is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update...

Hackers Use New Flash Zero-Day Exploit to Distribute FinFisher Spyware

FinSpy—the infamous surveillance malware is back and infecting high-profile targets using a new Adobe Flash zero-day exploit delivered through Microsoft Office documents. Security researchers from Kaspersky Labs have discovered a new zero-day remote code execution vulnerability in Adobe Flash,...

SUSE SLES11 Security Update : kernel (SUSE-SU-2017:2723-1)

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix the following issues : - Stack corruption could have lead to local privilege escalation bsc1059525, CVE-2017-1000253. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisor...

Cyberespionage Group Steps Up Campaigns Against Japanese Firms

Researchers are learning more about the cyberespionage group Bronze Butler. While the gang has been targeting Japanese heavy industry since 2012, not much is known about the group’s current modus operandi. In a report released Thursday by the Counter Threat Unit at SecureWorks, a subsidiary of De...

PT-2017-11411 · Juniper Networks · Contrail

The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and ha...

NXP Semiconductors MQX RTOS

CVSS v3 8.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: NXP Semiconductors Equipment: MQX RTOS Vulnerabilities: Classic Buffer Overflow, Out-of-Bounds Read AFFECTED PRODUCTS The following versions of MQX Real-Time Operating System RTOS are used in NXP’s ColdFire...

Israel hacked Kaspersky to inform US about Russia stealing NSA exploits

By Waqas Israeli Spies Hacked Kaspersky and Found Russian Hackers Exploiting the This is a post from HackRead.com Read the original post: Israel hacked Kaspersky to inform US about Russia stealing NSA exploits...