CVE-2019-13549

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not provide a sufficient level of protection against unauthorized configuration changes. Primary operations, namely turning the cooling unit on an...

CVE-2018-14679

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service uninitialized data dereference and application crash...

PT-2019-6429

Name of the Vulnerable Software and Affected Versions elfutils version 0.177 Description The issue is related to a denial-of-service vulnerability in the libcpu component of elfutils, caused by application crashes due to out-of-bounds write, off-by-one error, and reachable assertion. Attackers ca...

Bring your own LOLBin: Multi-stage, fileless Nodersok campaign delivers rare Node.js-based malware

We’ve discussed the challenges that fileless threats pose in security, and how Microsoft Defender Advanced Threat Protection Microsoft Defender ATP employs advanced strategies to defeat these sophisticated threats. Part of the slyness of fileless malware is their use of living-off-the-land...

The Phishing Industry

As I mentioned in my previous blog post, phishing attacks are now being created and executed on an industrial scale. Malicious actors are increasingly using highly sophisticated off-the-shelf phishing kits that allow them to deliver very targeted, short-lived attacks. These campaigns direct victi...

EulerOS 2.0 SP3 : zip (EulerOS-SA-2019-2059)

According to the version of the zip package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service invalid free and application crash o...

PT-2019-14735

Name of the Vulnerable Software and Affected Versions Embedthis GoAhead version 2.5.0 Description An issue was discovered where certain pages, such as "goform/login" and "config/log off page.htm", create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker...

EulerOS Virtualization for ARM 64 3.0.2.0 : zip (EulerOS-SA-2019-1925)

According to the version of the zip package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - DISPUTED Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service...

EulerOS 2.0 SP2 : zip (EulerOS-SA-2019-1876)

According to the version of the zip package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service invalid free and application crash o...

EulerOS 2.0 SP5 : libx11 (EulerOS-SA-2019-1884)

According to the versions of the libx11 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libX11: Crash on invalid reply in XListExtensions in ListExt.c CVE-2018-14598 - libX11: Off-by-one error in XListExtensions in ListExt.c...

PT-2019-14604

Name of the Vulnerable Software and Affected Versions Tripp Lite PDUMH15AT version 12.04.0053 Description The issue allows unauthenticated POST requests to the "/Forms/" directory. This can be exploited to change the manager or admin password, or to shut off power to an outlet. Recommendations Fo...

PYSEC-2019-126

DISPUTED In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inethttpserver, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. T...

The Hottest Malware Hits of the Summer

It's been a summer of ransomware hold-ups, supply chain attacks and fileless attacks flying under the radar of old-school security. With malware running amok while we were lying on the beach, here's a recap of the most burning strains and trends seen in the wild during the months of July and Augu...

The Hottest Malware Hits of the Summer

It's been a summer of ransomware hold-ups, supply chain attacks and fileless attacks flying under the radar of old-school security. With malware running amok while we were lying on the beach, here's a recap of the most burning strains and trends seen in the wild during the months of July and Augu...

Scientific Linux Security Update : Xorg on SL7.x x86_64 (20190806)

Security Fixes : - libX11: Crash on invalid reply in XListExtensions in ListExt.c CVE-2018-14598 - libX11: Off-by-one error in XListExtensions in ListExt.c CVE-2018-14599 - libX11: Out of Bounds write in XListExtensions in ListExt.c CVE-2018-14600 - libxkbcommon: Invalid free in...

New ‘Off-Facebook Activity Tool’ lets users control data collected by websites

By Sudais Off-Facebook Activity lets users see a summary of the apps and websites that send Facebook information about their activity. This is a post from HackRead.com Read the original post: New ‘Off-Facebook Activity Tool’ lets users control data collected by websites...

Facebook’s New Privacy Feature Comes With a Loophole

"Off-Facebook Activity" will give users more control over their data, but Facebook needs up to 48 hours to aggregate your information into a format it can share with advertisers...

Use This Privacy Tool to View and Clear Your 'Off-Facebook Activity' Data

Well, here we have great news for Facebook users, which is otherwise terrible for marketers and publishers whose businesses rely on Facebook advertisement for re-targeted conversations. Following the Cambridge Analytica scandal, Facebook has taken several privacy measures in the past one year wit...

Use This Privacy Tool to View and Clear Your 'Off-Facebook Activity' Data

Well, here we have great news for Facebook users, which is otherwise terrible for marketers and publishers whose businesses rely on Facebook advertisement for re-targeted conversations. Following the Cambridge Analytica scandal, Facebook has taken several privacy measures in the past one year wit...

NewStart CGSL MAIN 4.06 : spice-server Vulnerability (NS-SA-2019-0092)

The remote NewStart CGSL host, running version MAIN 4.06, has spice-server packages installed that are affected by a vulnerability: - Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslotgetvirt. This may lead to a denial of service, o...