CVE-2017-10074

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Hotspot. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2017-10101

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JAXP. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2017-10087

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Libraries. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

International Investigatory Group Also Target of Government Spyware

The same spyware that was used against Mexican journalists, lawyers, and even a child was also used against a group of international investigators. A collective known as the Interdisciplinary Group of Independent Experts GIEI, was hit by the spyware while in Mexico in 2016. The group was appointe...

Stellar.org: Bypassing Verify Humans Page

Hi Team, I was able to bypass verify Human dialog Box , while subscribing . Vulnerable request: ==================== POST /subscribe/post HTTP/1.1 Host: stellar.us9.list-manage.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:54.0 Gecko/20100101 Firefox/54.0 Accept:...

Average Cost of Breach Goes Down, For the First Time Ever

NEW YORK–The global average cost of a data breach last year dropped 11.4 percent from 2015 to $3.6 million. The reduction is attributed mostly to a strong U.S. dollar, with wins also offset by a 1.8 percent increase in the size of breaches in 2016. The numbers come from Peter Allor, senior cyber...

Mexican Journalists, Lawyers Focus of Government Spyware

Dozens of Mexican journalists, lawyers, and even a child, had their devices infected with commercially produced spyware during the past two years as part of an overarching campaign believed to be carried out by the nation’s government. The spyware, Pegasus, came in the form of text messages...

Mexican Govt. Allegedly Used Spyware Against Journalists, Activists & A Child

After the disclosure of sophisticated global espionage and disinformation campaign aimed to discredit enemies of the state, Citizen Lab researchers exposed the dirty game of the Mexican government and its politics. The report — "Government Spy: Systematic monitoring of journalists and human right...

Google Releases reCAPTCHA API for Android

Google announced today that it has made a new reCAPTCHA API available for Android. The API is part of Google Play Services, Google said, and developers can now add the verification to mobile applications to distinguish between bots and human users. The technology is more than a decade old and...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of May 29, 2017

“Anything that can go wrong will go wrong.” It’s not exactly clear how Murphy’s Law originated, but it seems to always make an appearance at the one time you can’t afford for anything to go wrong. Your laptop starts to malfunction right as you need to finish a project this happened to yours truly...

explo - Human And Machine Readable Web Vulnerability Testing Format

explo is a simple tool to describe web security issues in a human and machine readable format. By defining a request/condition workflow, explo is able to exploit security issues without the need of writing a script. This allows to share complex vulnerabilities in a simple readable and executable...

Security and Human Behavior (SHB 2017)

I'm in Cambridge University, at the tenth Workshop on Security and Human Behavior. SHB is a small invitational gathering of people studying various aspects of the human side of security, organized each year by Ross Anderson, Alessandro Acquisti, and myself. The 50 or so people in the room include...

Human Rights Watch Needs an Information Security Director

I'm sure it pays less than the industry average, and the stakes are much higher than the average. But if you want to be a Director of Information Security that makes a difference, Human Rights Watch is hiring...

CVE-2017-2681

Specially crafted PROFINET DCP packets sent on a local Ethernet segment Layer 2 to an affected product could cause a denial of service condition of that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected...

CVE-2017-2680

Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment Layer 2. Human interaction is required to recover the systems. PROFIBUS interfaces are not affected...

PT-2017-3763 · Siemens · Hmi Mobile Panels +4

Name of the Vulnerable Software and Affected Versions: Siemens PROFINET DCP versions affected versions not specified SIMATIC HMI Multi Panels and HMI Mobile Panels affected versions not specified S7-300/S7-400 devices affected versions not specified Description: The issue is related to insufficie...

The vulnerability of the Linux operating system, which allows a hacker to trigger a service failure

The vulnerability in the driver/hid/hid-cp2112.c kernel of the Linux operating system exists due to improper cleaning or release of resources. Exploiting this vulnerability allows an attacker, operating locally, to trigger a service failure using unpredictable vectors, without considering that a...

Why Care About Data-Centric Security?

It’s no surprise that data breaches are evolving and becoming increasingly more complex. According to the Verizon 2017 Data Breach Investigation Report, data breaches are “complex affairs often involving some combination of human factors, hardware devices, exploited configurations or malicious...

The vulnerability of the QEMU hardware emulation software, which allows a hacker to trigger a service failure

The vulnerability of the Human Monitor interface in the QEMU hardware emulation software allows data to be written beyond the specified buffer limits. Exploiting this vulnerability can enable a malicious actor to cause service failures data writing beyond memory boundaries, application terminatio...

CVE-2017-3356

Vulnerability in the Oracle Marketing component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via...