FLIR Systems FLIR Brickstream 3D+ Unauthenticated Config Download File Disclosure

Summary Thermal Imaging Camera For Continuous Condition and Safety Monitoring FLIR AX8 is a thermal sensor with imaging capabilities. Combining thermal and visual cameras in a small, affordable package, the AX8 provides continuous temperature monitoring and alarming capabilities to protec critica...

FLIR Systems FLIR Brickstream 3D+ Unauthenticated RTSP Stream Disclosure

Summary Thermal Imaging Camera For Continuous Condition and Safety Monitoring FLIR AX8 is a thermal sensor with imaging capabilities. Combining thermal and visual cameras in a small, affordable package, the AX8 provides continuous temperature monitoring and alarming capabilities to protec critica...

Zero-day exploit (CVE-2018-8453) used in targeted attacks

Yesterday, Microsoft published their security bulletin, which patches CVE-2018-8453, among others. It is a vulnerability in win32k.sys discovered by Kaspersky Lab in August. We reported this vulnerability to Microsoft on August 17, 2018. Microsoft confirmed the vulnerability and designated it...

Microsoft Patches Zero-Day Under Active Attack by APT

Microsoft has issued a patch for a zero-day bug being actively exploited in the wild, as part of its Patch Tuesday security bulletin. The vulnerability is an elevation-of-privilege flaw, rated important, affecting the Windows Win32k component. The zero-day CVE-2018-8453, found by Kaspersky Lab,...

Virus Bulletin 2018: Saudi Dissident Spyware Attack Belies Bigger Threat

MONTREAL – This week, news broke that a well-known Saudi dissident has been targeted by the notorious Pegasus spyware – after he gained permanent citizen status in Canada. While this fits into pattern of ongoing attacks on “civil society” members i.e., journalists, social justice activists,...

Facebook - Instagram Business Access Token Vulnerability

Document Title: =============== Facebook - Instagram Business Access Token Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2152 URL: https://www.youtube.com/watch?v=tdLKRky1Da4 News & Press:...

Facebook - Instagram Business Access Token Demo PoC

Document Title: =============== Facebook - Instagram Business Access Token Demo PoC References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2153 View: https://www.youtube.com/watch?v=4Obsd1Qw7uU News & Press:...

Ex-NSA Developer Gets 5.5 Years in Prison for Taking Top Secret Documents Home

A former NSA employee has been sentenced to five and a half years in prison for illegally taking a copy of highly classified documents and hacking tools to his home computer between 2010 and 2015, which were later stolen by Russian hackers. Nghia Hoang Pho, 68, of Ellicott City, Maryland—who work...

Pegasus Spyware Used in 45 Countries

Citizen Lab has published a new report about the Pegasus spyware. From a ZDNet article: The malware, known as Pegasus or Trident, was created by Israeli cyber-security firm NSO Group and has been around for at least three years -- when it was first detailed in a report over the summer of 2016. Th...

ThreatList: Malware Samples Targeting IoT More Than Double in 2018

It’s no secret that connected devices are posing a security threat in the commercial, consumer and industrial worlds. A fresh report on this expanding threat landscape shows that attacks are accelerating, with MikroTik routers, Telnet password-cracking and the Mirai botnet dominating the...

Powerful Android and iOS Spyware Found Deployed in 45 Countries

One of the world's most dangerous Android and iPhone spyware program has been found deployed against targets across 45 countries around the world over the last two years, a new report from Citizen Lab revealed. The infamous spyware, dubbed Pegasus, is developed by NSO Group—an Israeli company whi...

Dangerous Pegasus Spyware Has Spread to 45 Countries

The infamous Pegasus spyware, which targets iPhones and Android devices, has allegedly infiltrated 45 different countries across the globe — and six of those countries have used surveillance malware in the past to abuse human rights, a group of researchers claimed Tuesday. Researchers from The...

Re-IP rules do not work in Veeam Availability Orchestrator lab test

Challenge In rare cases, when you perform a failover, Re-IP rules are applying correctly, however, when you perform a lab test these rules would not be applied. Solution To resolve that: 1. Make sure that no plans are currently running 2. Open Veeam Availability Orchestrator UI Configuration VAO...

citysymphonies.media.mit.edu XSS vulnerability

Open Bug Bounty ID: OBB-675503 Description| Value ---|--- Affected Website:| citysymphonies.media.mit.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Threat Landscape for Industrial Automation Systems in H1 2018

For many years, Kaspersky Lab experts have been uncovering and researching cyberthreats that target a variety of information systems – those of commercial and government organizations, banks, telecoms operators, industrial enterprises, and individual users. In this report, Kaspersky Lab Industria...

SSA-2018-0906074602

New mozilla-thunderbird packages are available for Slackware 14.2 to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-thunderbird-60.0-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more information,...

Slackware 14.2 mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 14.2 to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-thunderbird-60.0-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more information,...

Go Pro Fusion Studio 1.2 Privilege Escalation

Summary Go Pro Fusion Studio is a feature rich editing software that allows you to transform your content into pro-quality videos. Description The application suffers from an unquoted search path issue impacting the service 'GoProFusionDeviceDetectionService' for Windows deployed as part of GoPro...

Lazarus Group’s AppleJeus MacOS malware targeting cryptocurrency exchanges

By Waqas Lazarus Group is believed to be backed by the North Korean government and now it is using AppleJeus MacOS Malware. Security researchers from the Global Research and Analysis Team at Kaspersky Lab have discovered the first-ever Lazarus deployed malware for MacOS. It is reported that Lazar...

Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware

Overview Lazarus has been a major threat actor in the APT arena for several years. Alongside goals like cyberespionage and cybersabotage, the attacker has been targeting banks and other financial companies around the globe. Over the last few months, Lazarus has successfully compromised several...