The Evolution of Darknets

This is interesting: To prevent the problems of customer binding, and losing business when darknet markets go down, merchants have begun to leave the specialized and centralized platforms and instead ventured to use widely accessible technology to build their own communications and operational...

[SECURITY] Fedora 28 Update: matrix-synapse-0.34.0.1-2.fc28

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...

Cisco AsyncOS S/MIME DoS

The vulnerability of the Secure/Multipurpose Internet Mail Extensions S/MIME function in the Cisco AsyncOS operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by sending a specially crafted...

[SECURITY] Fedora 29 Update: matrix-synapse-0.34.0.1-1.fc29

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...

Prices for Zero-Day Exploits Are Rising

Companies are willing to pay ever-increasing amounts for good zero-day exploits against hard-to-break computers and applications: On Monday, market-leading exploit broker Zerodium said it would pay up to $2 million for zero-click jailbreaks of Apple's iOS, $1.5 million for one-click iOS jailbreak...

CVE-2017-18358

creationtimestamp| type| source ---|---|--- 2019-01-15 18:57:32+00:00| seen| https://t.me/cibsecurity/2036...

Authorization Bypass

qpid-cpp is vulnerable to authorization bypass attacks. The vulnerability exists as qpid-cpp does not properly verify credentials during the joining of a cluster. This allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by using a valid...

Zerodium Offers to Buy Zero-Day Exploits at Higher Prices Than Ever

Well, there's some good news for hackers and vulnerability hunters, though terrible news for tech manufacturers! Exploit vendor Zerodium is now willing to offer significantly higher payouts for full, working zero-day exploits that allow stealing of data from WhatsApp, iMessage and other online ch...

Zerodium Offers to Buy Zero-Day Exploits at Higher Prices Than Ever

Well, there's some good news for hackers and vulnerability hunters, though terrible news for tech manufacturers! Exploit vendor Zerodium is now willing to offer significantly higher payouts for full, working zero-day exploits that allow stealing of data from WhatsApp, iMessage and other online ch...

Denial of Service Vulnerability in the OSI Layer of the SISCO_MMS_Lite Suite MMS Protocol

MMSLite is a communication component development library based on the IEC61850 standard for substation network communication developed by SISCO, mainly used for Intelligent Electronic Devices IEDs such as Remote Terminal Units RTUs, Automatic Relays, Programmable Logic Controllers PLCs and so on....

CVE-2018-16879

CVE-2018-16879 affects Ansible Tower 3.x prior to 3.3.3. The issue is a RabbitMQ misconfiguration where a secure channel is not used for messaging celery workers, enabling potential data leakage of sensitive information (e.g., passwords) and denial-of-service actions such as deletion of projects ...

americanmessaging.net XSS vulnerability

Open Bug Bounty ID: OBB-716601 Description| Value ---|--- Affected Website:| americanmessaging.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Design/Logic Flaw

The Leagoo Z5C Android device with a build fingerprint of sp7731c1h1032v4bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed app with a package name of com.android.messaging versionCode=1000110, versionName=1.0.001, android.20170630.092853-0 containing an exported...

CVE-2018-14986

The Leagoo Z5C Android device with a build fingerprint of sp7731c1h1032v4bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed app with a package name of com.android.messaging versionCode=1000110, versionName=1.0.001, android.20170630.092853-0 containing an exported...

[SECURITY] Fedora 29 Update: mosquitto-1.5.5-1.fc29

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

CVE-2018-16879

Tower does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files...

Facebook Admits Giving Partners Access to Messages

UPDATE Facebook has admitted that it dealt several messaging partnerships with tech giants, giving them read, write and delete access for Facebook messages. The confirmation comes on the heels of a bombshell New York Times article, Tuesday, which leveraged internal documents to show that Facebook...

Beers with Talos EP 43: Espionage, Encryption, and CISO Square One

Beers with Talos BWT Podcast Ep. 43 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 43 show notes: Recorded Dec. 7, 2018. Several of us are under the weather, but the show must go on. We did our best, as alway...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R10 security and bug fix update

An update is now available for Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Volkswagen Giveaway Scam Peddles Ad Networks

A fake Volkswagen campaign is making its way across social media platforms, luring in victims with promises of a free Volkswagen car giveaway – but instead redirecting them to third-party ad servers. Victims are first sent messages via WhatsApp or Facebook, purporting to be from Volkswagen and...