April 25, 2019—KB4493453 (Preview of Monthly Rollup)

None None...

Is Privacy Really iPhone? Researchers Weigh in on Apple's Targeted Ad Tracking

Apple has a consistent track record of implementing privacy controls, which it has been touting via a series of saturating “Privacy? That’s iPhone” television ads. Yet, though it may be deservedly capitalizing on the increasing privacy-consciousness of consumers out there and the negative headlin...

Ellen DeGeneres giveaway scam spreading on social media

Scammers are pushing multiple fake Facebook profiles of Ellen DeGeneres, popular US TV show host and producer, with the goal of tricking people into jumping through a few money-making hoops. This isn’t a sophisticated scam. It isn’t hacking the Gibson. It won’t be the focus of a cutting edge...

Cobalt Strike. Walkthrough for Red Teamers

What is Cobalt Strike? Raphael Mudge is the creator of Cobalt Strike CS, around 2010 he released a tool titled Armitage, which is described by wikipedia as a graphical cyber-attack management for the Metasploit Project, to put this more bluntly, Armitage is a gui that allows you to easily navigat...

CVE-2018-4436

A certificate validation issue existed in configuration profiles. This was addressed with additional checks. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2...

CVE-2018-4436

CVE-2018-4436 involves a certificate validation issue in configuration profiles on Apple devices. Affected products/versions include iOS, tvOS, and watchOS prior to versions 12.1.1, 12.1.1, and 5.1.2 respectively. Root cause (per the sources) is improper certificate validation within configuratio...

CVE-2018-4436

A certificate validation issue existed in configuration profiles. This was addressed with additional checks. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2...

Logic flaw vulnerability exists in UsualToolCMS of Chengdu Comfidonte Network Technology Co.

UsualToolCMS UTCMS is a content management system and rapid site building framework. A logic flaw vulnerability exists in UsualToolCMS v8.0 build 190101. The vulnerability stems from the program not verifying the identity of the data passed by the processing user. An attacker could overstep his/h...

PT-2019-16736 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: moodle versions 3.1 to 3.1.15 moodle versions 3.4 to 3.4.6 moodle versions 3.5 to 3.5.3 moodle versions 3.6 to 3.6.1 Description: A flaw was found in the software where the /userpix/ page did not properly escape users' full names. These names...

CVE-2019-6592

On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles...

FaceTime - Texture Processing Memory Corruption

FaceTime - Texture Processing Memory Corruption There is a memory corruption issue that occurs when processing a malformed RTP video stream in FaceTime. It appears to be related to processing textures. thread 7, stop reason = EXCBADACCESS code=EXCI386GPFLT frame 0: 0x00007fff56baaa92...

Website uses Artificial Intelligence to create utterly realistic human faces

By Waqas A new way for cybercriminals to create fake social media profiles and carry identity scams using Artificial Intelligence powered tool? A couple of months ago it was reported that NVIDIA has developed a tool that uses Artificial Intelligence to create extremely realistic human faces which...

Exposed: Instagram, OKCupid, Mumsnet All Face Data Concerns

It has once again been busy on the data privacy/exposure front as the week kicks off, with Instagram, dating site OKCupid and the UK’s powerhouse discussion site, Mumsnet, all making recent news. A report on GDPR breach notifications rounds out the latest. First up, Instagram users are apparently...

Security Advisory 0039

Security Advisory 0039 PDF Date: January 16th, 2019 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | January 16th, 2019 | Initial Release The CVE-IDs tracking this issue are CVE-2018-16873, CVE-2018-16874 and CVE-2018-16875 Description This advisory is to document the impact of...

Microsoft Windows 10 - SSPI Network Authentication Session 0 Privilege Escalation

Windows: SSPI Network Authentication Session 0 EoP Platform: Windows 10 1803/1809 not tested earlier versions Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: Session boundary Summary: Performing an NTLM authentication to the same machine results in a network...

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Date: 12/31/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on...

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on: Ubuntu 18.04 CVE:...

The vulnerability of Microsoft Exchange Server’s mail server, related to insecure management of privileges, allows a hacker to modify user profile data.

The vulnerability of Microsoft Exchange Server is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor, operating remotely, to modify user profiles through a specially crafted request...

Christmas tech scams roundup

There’s a fair few Christmas tech scams floating around out there as 2018 winds up, and we thought it’d be a good time to warn you about them. It’s the usual mish-mash of phone antics, social media shenanigans, and click bait. Shall we begin? This scam looks divine BOOM reports on a collection of...

Apple iOS and tvOS Profiles Certificate Configuration Vulnerability

Apple iOS and tvOS are both products of Apple Inc. Apple iOS is an operating system for mobile devices; tvOS is an operating system for smart TVs. profiles are a component of profiles. A security vulnerability exists in the Profiles component in Apple iOS versions prior to 12.1.1 and tvOS version...