File Upload Vulnerability in Super CMS

Super CMS content management system by the SEO Research Center moonseo.cn in order to solve the problem of website optimization and development of a set of products. Super CMS has a file upload vulnerability that can be exploited by attackers to upload malicious w files and gain server privileges...

Unpatched Fujitsu Wireless Keyboard Bug Allows Keystroke Injection

UPDATE Fujitsu is stopping sales for its popular wireless keyboard after a researcher discovered it is vulnerable to keystroke injection attacks that could allow an adversary to take control of a victim’s system. Researchers with Germany-based SySS reported on Friday that the high-severity...

Local privilege escalation via the Windows I/O Manager: a variant finding collaboration

The Microsoft Security Response Center MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services to help make our customers and the global online community more secure. We appreciate the excellent vulnerability research reported to us regularly from the...

Local privilege escalation via the Windows I/O Manager: a variant finding collaboration

The Microsoft Security Response Center MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services to help make our customers and the global online community more secure. We appreciate the excellent vulnerability research reported to us regularly from the...

Call for Papers | Microsoft BlueHat Shanghai 2019

The Microsoft Security Response Center MSRC recently announced our first BlueHat security conference in Shanghai which will take place on May 29-30, 2019. After 15 years of BlueHat events in Redmond, Washington and Israel, we are thrilled to expand to a new location. We work with many talented...

Breaking the Bank: Weakness in Financial AI Applications

Currently, threat actors possess limited access to the technology required to conduct disruptive operations against financial artificial intelligence AI systems and the risk of this targeting type remains low. However, there is a high risk of threat actors leveraging AI as part of disinformation...

Practical advice for earning higher Microsoft bounty awards

This year at the Nullcon International Security Conference I shared practical advice for how security researchers can maximize the impact of their security vulnerability submissions and earn higher bounty awards under the Microsoft Bounty Program. For those who couldn’t be there, I had two core...

Practical advice for earning higher Microsoft bounty awards

This year at the Nullcon International Security Conference I shared practical advice for how security researchers can maximize the impact of their security vulnerability submissions and earn higher bounty awards under the Microsoft Bounty Program. For those who couldn’t be there, I had two core...

Forrester: Ransomware Set to Resurge As Firms Pay Off Attacks

SAN FRANCISCO – Ransomware may be poised to return as a top scourge for companies, as more and more of them pay up after an attack in an effort to minimize the cost of recovery. That’s just one insight gleaned from an interview at RSA Conference 2019 last week with Josh Zelonis, senior analyst at...

Applicants data of 3 elite US colleges hacked for ransom

By Ryan De Souza Recently it was reported that Chinese hackers are aiming to target around 26 leading research academies to steal research about maritime technology, the majority of which happen to be based in the USA. In the same week, three mainstream private colleges have claimed that their...

RSA Conference 2019: The Expanding Automation Platform Attack Surface

SAN FRANCISCO – Automation platforms are increasingly being used to chain multiple IoT devices together to create user-friendly smart applications – but that’s also creating unpredictable attack surfaces that can be hard to manage. A Trend Micro report released at RSA Conference 2019 warns that...

Friday Squid Blogging: Squid Proteins Can Be an Alternative to Plastic

Is there anything squids aren't good for? Academic paper. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Android Messaging: A Few Bugs Short of a Chain

Posted by Natalie Silvanovich, Project Zero About a year and a half ago, I did some research into Android messaging and mail clients. At the time, I didn’t blog about it, because though I found bugs, I wasn’t able to assemble them into a credible attack. However, in the spirit of writing about...

Digital Signatures in PDFs Are Broken

Researchers have demonstrated spoofing of digital signatures in PDF files. This would matter more if PDF digital signatures were widely used. Still, the researchers have worked with the various companies that make PDF readers to close the vulnerabilities. You should update your software. Details...

RSAC 2019: Joomla! Flaw Exploited to Create Mass Phishing Infrastructure

SECOND UPDATE Editor’s Note: It has come to our attention that Check Point’s findings are being questioned by Joomla! and others in the open-source ecosystem. Our story accurately reflects Check Point’s report — but it’s clear that the news isn’t about Jmail or the vulnerability which is at least...

RSAC 2019: Microsoft Zero-Day Allows Exploits to Sneak Past Sandboxes

SAN FRANCISCO – A previously unknown bug in Microsoft Office has been spotted being actively exploited in the wild; it can be used to bypass security solutions and sandboxes, according to findings released at the RSA Conference 2019. The bug exists in the OLE file format and the way it’s handled ...

The Overlooked Security Threat of Sign-In Kiosks

New research from IBM shows that several visitor management systems had a rash of vulnerabilities...

Holes in 4G and 5G Networks Could Let Hackers Track Your Location

New research shows how nearby attackers can see where you are, send you spoofed carrier messages, and more...

6 Pieces of Tech Every Office Needs

By Carolina Before you start buying any technology or furniture for your office, you must put in some planning and research time. There are so many options to consider and each one will have a direct impact on the functionality of your workspace and, as result, how productive you and your team ar...

Friday Squid Blogging: A Tracking Device for Squid

Really: After years of "making do" with the available technology for his squid studies, Mooney created a versatile tag that allows him to research squid behavior. With the help of Kakani Katija, an engineer adapting the tag for jellyfish at California's Monterey Bay Aquarium Research Institute...