Zero-Day Coverage Update – Week of July 23, 2018

We’re at the end of July and the Zero Day Initiative ZDI has published 873 advisories so far. That’s 273 advisories this month alone – and that’s just the tip of the iceberg! Earlier this week, ZDI announced the Targeted Incentive Program, which brings over $1,500,000 USD in special bounty awards...

Security Bulletin: Security exposure in IBM Cognos Incentive Compensation Management (CVE-2014-0107)

Summary There is a security vulnerability whereby a remote attacker could bypass security restrictions in Apache Xalan-Java within IBM Cognos Incentive Compensation Management 8.x and 7.x. Vulnerability Details CVE IDs: CVE-2014-0107 DESCRIPTION: Apache Xalan-Java could allow a remote attacker to...

Samsung wants you to hack its devices and get up to $200,000

By Waqas Its a fact that Android is one of the most This is a post from HackRead.com Read the original post: Samsung wants you to hack its devices and get up to $200,000...

DJI Launches Drone Bug Bounty Program

The lack of security in commercial drones has been well documented, but one Chinese manufacturer is working to fix that by incentivizing researchers who can poke holes in the software its drones run on. One of the largest unmanned aerial vehicle manufacturers, Dà-Jiāng Innovations Science and...

telunjuk.com XSS vulnerability

Vulnerable URL: https://www.telunjuk.com/jual?q=...

Zero-Day Market Economics Favor Incentives for Defensive Tools

There’s a security truism that goes something like this: Defenders must protect all machines against all vulnerabilities, while attackers need only to find one way on to a system or network. It’s a nearly unwinnable game for those in charge of defending corporate networks and securing web-based...

Katie Moussouris on Starting a Bug Bounty Program

At last week’s Security Analyst Summit, HackerOne’s Katie Moussouris explains one of the key things that companies that want to start a bounty or vulnerability incentive program should know: There is no one size fits all...

Lessons Learned in Building a Vulnerability Coordination Program

CANCUN – Bounty programs are mislabeled creatures, too often pigeonholed as a payoff for finding individual vulnerabilities in software. Wrong. “The name bug bounty is actually a false categorization of what is truly just an incentive program,” said Katie Moussouris, chief policy officer at...

Microsoft Internet Explorer Memory Corruption (MS15-009: CVE-2015-0068)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. A remote attacker can exploit this issue by enticing a use...

Unfixed Redirect vulnerability at vakbarat.index.hu

Security researcher TinKode, has submitted on 16/12/2010 a Redirect vulnerability affecting vakbarat.index.hu, which at the time of submission ranked 1421 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2011. It is currently unfixed. If y...

The Difficulty of Surveillance Crowdsourcing

Internet Eyes is a U.K. startup designed to crowdsource digital surveillance. People pay a small fee to become a “Viewer.” Once they do, they can log onto the site and view live anonymous feeds from surveillance cameras at retail stores. If they notice someone shoplifting, they can alert the stor...

Unfixed XSS vulnerability at www.5dao.cn

Security researcher DerickTham, has submitted on 07/12/2007 a cross-site-scripting XSS vulnerability affecting www.5dao.cn, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/12/2007. It is currently...