CVE-2018-18351

Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page...

CVE-2018-18351: Improper Input Validation

Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page...

SQL Injection Vulnerability in Taoyuan Enterprise Document Management System

Taoyuan enterprise document management system is in Taoyuan network hard disk V5.X mature platform, for enterprise, government, school, scientific research, media and other enterprise-level user applications for the development of professional electronic document network service system. There is ...

When It Comes To IoT Security, Liability Is Muddled

BOSTON—From hacked connected cars to power grids, the implications of IoT security issues seem to be getting graver – yet when it comes to pointing fingers for security troubles, many times victims don’t even know where to start. IoT experts said at the Security of Things Forum today said that a...

DEBIAN-CVE-2018-12029

A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passengerinstanceregistrydir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but befor...

Emlog blog system has an arbitrary file deletion vulnerability

emlog is a PHP and MySQL based blog and CMS builder. There is an arbitrary file deletion vulnerability in the Emlog blog system. The vulnerability is due to the program on the parameters of the filter is not strict due to the attacker by adding a malicious payload execution, you can delete...

Equifax Breach: Setting the Record Straight

Bloomberg published a story this week citing three unnamed sources who told the publication that Equifax experienced a breach earlier this year which predated the intrusion that the big-three credit bureau announced on Sept. 7. To be clear, this earlier breach at Equifax is not a new finding and...

This Retail Website Considers Password Security Optional

Most gaping security holes are terrible mistakes. But for one major Hong Kong-based online retailer called Strawberrynet, its security shortcomings are a feature. Like many ecommerce sites, registered users have an option for express checkout. What makes beauty-products website Strawberrynet uniq...

Cross-site scripting vulnerability in moodle course management system

Moodle Modular Object-Oriented Dynamic Learning Environment is a software package for creating online courses or websites. A cross-site scripting vulnerability exists in the Moodle course management system due to the program's lax filtering of link content. This allows an attacker to construct...

Yacht Security

Turns out, multi-million dollar yachts are no more secure than anything else out there: The ease with which ocean-going oligarchs or other billionaires can be hijacked on the high seas was revealed at a superyacht conference held in a private members club in central London this week. ... Murray, ...

WinSCP ftp client memory corruption vulnerability

WinSCP is a Windows environment using SSH open source graphical SFTP client . It also supports the SCP protocol. Its main function is to securely copy files between local and remote computers. A memory corruption vulnerability exists in WinSCP ftp client due to the software's lax input checking...

Design Vulnerability in Baidu Moplus SDK (WormHole Vulnerability)

The Moplus SDK is a public development kit developed in-house by Baidu, which is integrated into numerous Android applications. The "WormHole" vulnerability exists in Baidu's Moplus SDK, which is mainly used to enhance the expansion of Baidu's search engine in smart terminals, and to realize the...

Hacking CCTV Cameras to Launch DDoS Attacks

The connected devices, better known as the Internet of Things, have been attracting the significant interest of, not only users but also cyber criminals that are turning them into weapons for cyber war. Due to the insecure implementation of Internet-connected embedded devices, they are routinely...

Using Customer Premise Equipment to Take Over the Internet

It’s the ultimate what-if scenario: What if an attacker could own all the customer premises equipment CPE doled out by ISPs such as routers and modems? Would it be trivial with available scanning equipment and other tools to find vulnerable gear, and then modify and re-upload the firmware to be...

University of Michigan Health Systems Admits Patient Data Stolen

UPDATE – Some 4,000 University of Michigan Health Systems patients had their medical data compromised last month when a vendor’s laptop containing medication log files was stolen from a vehicle. That medication management provider, Mountain View, Calif.-based Omnicell, admits it violated both its...

Android Malware, Up 472 Percent, Seeing Fastest Growth Ever

As Android market share has shot up in recent months, so has the volume of malware designed for the mobile platform. There’s been a whopping 472 percent increase in Android malware samples in the last three months alone, according to research from Juniper Networks. While September saw a 28 percen...

fckeditor editor latest 0day-vulnerability warning-the black bar safety net

Shadow of the Eagle Affected version: latest pass to kill Vulnerability description: The filename suffix filter LAX, can lead to to upload 1. asp;jpg format file. Vulnerability test: By fckeditor editor upload image, select Browse Server. Upload 1. asp;jpg format of a word Trojan, the connecting...

Security Advisory FreeBSD-SA-02:25.bzip2

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:25 Security Advisory The FreeBSD Project Topic: bzip2 contains multiple security vulnerabilities Category: core/ports Module: bzip2 Announced: 2002-05-20 Credits: Volker...