23900 matches found
Adobe Releases Security Updates for Flash Player
Adobe has released security updates to address vulnerabilities in Flash Player. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review Adobe Security Bulletin APSB18-03 and apply the necessary...
New Flash Player zero-day comes inside Office document
Update 2018-02-06: Adobe has released a patch for this vulnerability. More information is available here. We tested this zero-day with a proof-of concept that was made available. Rather than launching it from within Office, we turned it into a drive-by download attack. The animation below shows...
A week in security (January 29 – February 04)
Last week on Labs, we looked into PUPs stealing and using mainstream logos of security and tech companies to further gain user trust, GandCrab and Scarab ransomware variants in the wild, and a new Mac malware called OSX.CreativeUpdater that can be distributed via MacUpdate. We also profiled...
registo.dns.pt XSS vulnerability
Open Bug Bounty ID: OBB-553456 Description| Value ---|--- Affected Website:| registo.dns.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosu...
Adobe Flash Player for Mac <= 28.0.0.137 Use-after-free Remote Code Execution (APSA18-01) (APSB18-03)
The version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 28.0.0.137. It is, therefore, affected by a remote code execution vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106607; scriptversion"1.13";...
Adobe Flash Player <= 28.0.0.137 Use-after-free Remote Code Execution (APSA18-01) (APSB18-03)
The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 28.0.0.137. It is, therefore, affected by a use-after-free vulnerability that allows arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
Adobe Flash Player Use After Free (APSB18-03: CVE-2018-4878)
A remote code execution vulnerability exists in Adobe Flash Player. The vulnerability is due to a use-after-free error in Adobe Flash Player while handling a specially crafted SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted file wit...
reinhardbuchta.com XSS vulnerability
Open Bug Bounty ID: OBB-552440 Description| Value ---|--- Affected Website:| reinhardbuchta.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
skolten.info XSS vulnerability
Open Bug Bounty ID: OBB-552436 Description| Value ---|--- Affected Website:| skolten.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
scholastic.ca XSS vulnerability
Open Bug Bounty ID: OBB-552424 Description| Value ---|--- Affected Website:| scholastic.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
alleytalk.com XSS vulnerability
Open Bug Bounty ID: OBB-552418 Description| Value ---|--- Affected Website:| alleytalk.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
sacajawea.idahostatesman.com XSS vulnerability
Open Bug Bounty ID: OBB-552409 Description| Value ---|--- Affected Website:| sacajawea.idahostatesman.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
www1.zagreb.hr XSS vulnerability
Open Bug Bounty ID: OBB-552407 Description| Value ---|--- Affected Website:| www1.zagreb.hr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
dreamingtreeproductions.com XSS vulnerability
Open Bug Bounty ID: OBB-552404 Description| Value ---|--- Affected Website:| dreamingtreeproductions.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
virginiadot.org XSS vulnerability
Open Bug Bounty ID: OBB-552346 Description| Value ---|--- Affected Website:| virginiadot.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...
stjoeslivingston.org XSS vulnerability
Open Bug Bounty ID: OBB-552345 Description| Value ---|--- Affected Website:| stjoeslivingston.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...
danishcrown.com XSS vulnerability
Open Bug Bounty ID: OBB-552342 Description| Value ---|--- Affected Website:| danishcrown.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...
airandspace.si.edu XSS vulnerability
Open Bug Bounty ID: OBB-552337 Description| Value ---|--- Affected Website:| airandspace.si.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...
Attacks Leveraging Adobe Zero-Day (CVE-2018-4878) – Threat Attribution, Attack Scenario and Recommendations
On Jan. 31, KISA KrCERT published an advisory about an Adobe Flash zero-day vulnerability CVE-2018-4878 being exploited in the wild. On Feb. 1, Adobe issued an advisory confirming the vulnerability exists in Adobe Flash Player 28.0.0.137 and earlier versions, and that successful exploitation coul...
