Spoofing

RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major...

CVE-2022-21676

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io...

Amazon Web Service outage is impacting major websites

By Waqas Amazon Web Service AWS is suffering a major service outage that is affecting popular platforms in regions where the company provides services. This is a post from HackRead.com Read the original post: Amazon Web Service outage is impacting major websites...

Ransomware in the CIS

Introduction These days, when speaking of cyberthreats, most people have in mind ransomware, specifically cryptomalware. In 2020–2021, with the outbreak of the pandemic and the emergence of several major cybercriminal groups Maze, REvil, Conti, DarkSide, Avaddon, an entire criminal ecosystem took...

CVE-2021-0306

In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which allows an app to gain the android.permission.ACTIVITYRECOGNITION permission without user confirmation. This could lead to local escalation of privilege with no...

Talos Vulnerability Discovery Year in Review — 2020

While major attacks like ransomware and COVID-19-themed campaigns made headlines across the globe this year, many attacks were prevented through simple practices of finding, disclosing and patching vulnerabilities. Cisco Talos' Systems Vulnerability Research Team discovered 231 vulnerabilities th...

Record Levels of Software Bugs Plague Short-Staffed IT Teams in 2020

2020 is shaping up to be a banner year for software vulnerabilities, leaving security professionals drowning in a veritable sea of patching, reporting and looming attacks, many of which they can’t even see. A trio of recent reports tracking software vulnerabilities over the past year underscore t...

Introducing VideoBytes, by Malwarebytes Labs

We have exciting news for avid readers of Malwarebytes Labs: This week, we’re launching a new, monthly video series that will feature the research, insights, and commentary of our own Adam Kujawa, security evangelist and a director for Malwarebytes Labs. Welcome to VideoBytes, our little corner o...

Product release: Virtuozzo Hybrid Infrastructure 3.5 Update 5 (3.5.5-26)

This update provides a new feature as well as improvements and bug fixes. Vulnerability id: VSTOR-34750 After failed VM evacuations, resource allocations are duplicated. Vulnerability id: VSTOR-30767 An update to a new major release may fail with the error "Updates to multiple product versions ar...

Spam and phishing in 2019

Figures of the year The share of spam in mail traffic was 56.51%, which is 4.03 p.p. more than in 2018. The biggest source of spam this year was China 21.26%. 44% of spam e-mails were less than 2 KB in size. Malicious spam was detected most commonly with the Exploit.MSOffice.CVE-2017-11882 verdic...

Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

Encryption flaws in a common anti-theft feature expose vehicles from major manufacturers...

store.majorcineplex.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1072541 Security Researcher Rbcafe Helped patch 258 vulnerabilities Received 3 Coordinated Disclosure badges Received 7 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting store.majorcineplex.com websi...

How to Scale Addressable Advertising with Low Latency for Live Streaming

Written by: David Springfall, Founder and CTO of Yospace Under David's technical and strategic leadership, Yospace pioneered server-side ad insertion and established itself as the global leader in OTT stream monetisation. The Yospace technology supports full one-to-one personalisation and provide...

Microsoft DirectWrite - Invalid Read in SplicePixel While Processing OTF Fonts

Microsoft DirectWrite is a modern Windows API for high-quality text rendering. A majority of its code resides in the DWrite.dll user-mode library. It is used by a variety of widely used desktop programs such as the Chrome, Firefox and Edge browsers and constitutes an attack surface for memory...

The Fight Against Robocalls Gets Powerful New Allies

All the state attorneys general, along with 12 major companies, promise to finally make serious moves against robocalls...

Internet connected cars can be hacked to gridlock major cities

By Sudais Hacking Internet Connected Cars - a near possibility for cybercriminals to cause major havoc. This is a post from HackRead.com Read the original post: Internet connected cars can be hacked to gridlock major cities...

icsmaster

This repository is an offensive tool for ICS Industrial Control Systems security research and exploitation. It contains a collection of resources, including papers, exploits, firmware, Nmap scripts, and tools, related to ICS security. The repository is maintained by GeneBlue and appears to be a...

Arbitrary Code Execution

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Privilege Escalation

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

CVE-2019-10953

ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets...