The vulnerability of the Internet Explorer web browser’s script handler allows a hacker to execute arbitrary code.

The vulnerability of the Internet Explorer web browser’s script handler is related to memory-related object handling flaws. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially created web page...

Microsoft Patch Tuesday, March 2020 Edition

Microsoft Corp. today released updates to plug more than 100 security holes in its various Windows operating systems and associated software. If you abuse Windows, please take a moment to read this post, backup your systems, and patch your PCs. All told, this patch batch addresses at least 115...

Firefox Bug Opens iPhone AirPods to Third-Party Snooping

Five high-severity bugs were fixed in the Firefox web browser with the release of version 74 by the Mozilla Foundation on Tuesday. In addition, Mozilla reported a quirky moderate-severity flaw that allows hackers to target iPhone users and collect data tied to connected AirPods, if in use. In...

The vulnerability of the Windows Common Log File System (CLFS) driver in the Windows operating system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Windows Common Log File System CLFS driver in the operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created application...

The vulnerability of the Windows Error Reporting service on Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the Windows Error Reporting service on Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges through a specially created application...

Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

Encryption flaws in a common anti-theft feature expose vehicles from major manufacturers...

The vulnerability of Oracle Java SE’s 2D software platform allows a hacker to gain full control over the application.

The vulnerability of the Oracle Java SE 2D software platform is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker operating remotely to gain full control over the application...

The vulnerability of the OpenId Connect service’s framework for Apache CXF allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the OpenId Connect service for Apache CXF web services is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Cisco Data Center Network Manager, a system for network management at data centers, allows a malicious individual to gain unauthorized access to JBoss EAP.

The vulnerability of the Cisco Data Center Network Manager system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to JBoss EAP from a remote location...

The vulnerability of the Intel Chipset Device installation service is related to deficiencies in the authentication mechanism, allowing attackers to trigger a service failure.

The vulnerability of the Intel Chipset Device installation service is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a perpetrator to cause a service failure...

Gamer Alert: Serious Nvidia Flaw Plagues Graphics Driver

Nvidia issued patches for high-severity vulnerabilities in its graphics driver, which can be exploited by a local attacker to launch denial-of-service DoS or code-execution attacks. Nvidia’s graphics processing unit GPU display driver is used in devices targeted for enthusiast gamers; it’s the...

This Week in Security News: Trend Micro Detects a 10 Percent Rise in Ransomware in 2019 and New Wi-Fi Encryption Vulnerability Affects Over a Billion Devices

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, read about how Trend Micro detected a 10 percent rise in ransomware attacks in 2019. Also, learn about a new Wi-Fi encryption vulnerability...

CVE-2019-5323

There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an administrative user are not properly sanitized before being parsed by AirWave. If conditions are met, an attacker can obtain command execution on the host...

IoT Insecurity: When Your Vacuum Turns on You

SAN FRANCISCO – Hackable Internet of Things IoT devices are on full display this week at the RSA Conference 2020. They include everything from baby monitors to Wi-Fi chips. One such device is a connected vacuum cleaner, the Trifo Ironpie M6. According to researchers with Checkmarx, the vacuum has...

Unpatched Security Flaws Open Connected Vacuum to Takeover

SAN FRANCISCO – Researchers have discovered several high-severity vulnerabilities in a connected vacuum cleaner. The security holes could give remote attackers the capability to launch an array of attacks — from a denial of service DoS attack that renders the vacuum unusable, to viewing private...

Hefei Yilang Network Technology Co., Ltd. website building system has logical flaws and vulnerabilities

Hefei Yilang Network Technology Co., Ltd. is a company specializing in Internet technology services, development and application. Hefei a wave of network technology limited company building system there are logical flaws in the vulnerability, the attacker can use the loophole to obtain super...

Adobe Patches Critical Bugs Affecting Media Encoder and After Effects

Adobe today released out-of-band software updates for After Effects and Media Encoder applications that patch a total of two new critical vulnerabilities. Both critical vulnerabilities exist due to out-of-bounds write memory corruption issues and can be exploited to execute arbitrary code on...

Cross site scripting

Multiple cross-site request forgery CSRF and cross-site scripting XSS vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add an administrator account via an addnew action to admin/administratorsadd.php; or 2 conduct...

Iranian Hackers Exploiting VPN Flaws to Backdoor Organizations Worldwide

A new report published by cybersecurity researchers has unveiled evidence of Iranian state-sponsored hackers targeting dozens of companies and organizations in Israel and around the world over the past three years. Dubbed "Fox Kitten," the cyber-espionage campaign is said to have been directed at...

A Dozen Vulnerabilities Affect Millions of Bluetooth LE Powered Devices

A team of cybersecurity researchers late last week disclosed the existence of 12 potentially severe security vulnerabilities, collectively named 'SweynTooth ,' affecting millions of Bluetooth-enabled wireless smart devices worldwide—and worryingly, a few of which haven't yet been patched. All...