Amazon Linux 2 : dhcp (ALAS-2018-984)

Buffer overflow in dhclient possibly allowing code execution triggered by malicious server An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running on DHCP client...

‘Hacking’ the Nespresso Prodigio and Jura E8 coffee machines

You’ll probably know by now that I have a particular interest in the security of IoT coffee machines and tea kettles. Sometimes security is so poor that we have to laugh. Such simple security issues. Now, when I’m feeling lazy and possibly a bit hung over, I really can’t be bothered to make coffe...

Intel Halts Spectre Fixes On Older Chips, Citing Limited Ecosystem Support

Intel has halted patches for an array of older chips that would protect them against the Spectre vulnerability, according to a recent microcode update. The microcode update shows that its older products – including Wolfdale, Bloomfield, Clarksfield, Gulftown, Harpertown, Jasper Forest, SoFIA 3GR,...

Microsoft's Meltdown Patch Made Windows 7 PCs More Insecure

Meltdown CPU vulnerability was bad, and Microsoft somehow made the flaw even worse on its Windows 7, allowing any unprivileged, user-level application to read content from and even write data to the operating system's kernel memory. For those unaware, Spectre and Meltdown were security flaws...

OPENSUSE-SU-2018:0819-1 Security update for Mozilla Thunderbird

This update for Mozilla Thunderbird to version 52.7 fixes multiple issues. The following bugs were fixed: - Searching message bodies of messages in local folders, including filter and quick filter operations, did not find content in message attachments - Better error handling for Yahoo accounts T...

Intentionally Insecure Webapp for Security Training: OWASP Juice Shop

OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in JavaScript which encompasses the entire OWASP Top Ten and other severe security flaws. Juice Shop is written in Node.js, Express and AngularJS. It was the first application written entirely in JavaScri...

Intel Details CPU ‘Virtual Fences’ Fix As Safeguard Against Spectre, Meltdown Flaws

Intel introduced hardware-based protections to its new chips to protect against the Spectre and Meltdown flaws that rocked the silicon industry when the vulnerabilities were made public in early 2018. Spectre and Meltdown, which account for three variants of a side-channel analysis security issue...

Hackers can Send Fake Emergency Alerts by Exploiting 4G LTE Protocol Flaws

By Waqas Researchers at the Purdue University and the University of Iowa, This is a post from HackRead.com Read the original post: Hackers can Send Fake Emergency Alerts by Exploiting 4G LTE Protocol Flaws...

US Air Force Hacked for Good at HackerOne’s Bug Bounty Event

By Uzair Amir 106 Security Flaws Identified in Operationally Significant DoD Websites under This is a post from HackRead.com Read the original post: US Air Force Hacked for Good at HackerOne's Bug Bounty Event...

Arista Networks EOS Multiple Vulnerabilities (SA0019)

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities : - A flaw exists in NTP in the receive function within file ntpd/ntpproto.c that allows packets with an origin timestamp of zero to bypass security checks. An unauthenticated, remote attacker...

USN-3583-2: Linux kernel (Trusty HWE) vulnerabilities

USN-3583-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 ESM. It was discovered that an out-of-bounds write vulnerability existed in the...

Intel Issues Updated Spectre Firmware Fixes For Newer Processors

Intel has issued updated microcode to help protect its newer processors from Spectre security exploits. The Santa Clara, Calif.-based company’s new microcode updates – which impact its newer chip platforms, such as Kaby Lake, Coffee Lake, and Skylake – have been released to OEM customers and...

Remote Code Execution on the Smiths Medical Medfusion 4000

Remote Code Execution on the Smiths Medical Medfusion 4000 In which we detail the process of vulnerability research on a life critical embedded system: a medical infusion pump. Table of Contents Remote Code Execution on the Smiths Medical Medfusion 4000 Table of Contents Summary Introduction Why ...

Microsoft Releases Patches for 16 Critical Flaws, Including a Zero-Day

If you think that only CPU updates that address this year's major security flaws—Meltdown and Spectre—are the only ones you are advised to grab immediately, there are a handful of major security flaws that you should pay attention to. Microsoft has issued its first Patch Tuesday for 2018 to addre...

Vulnerability Spotlight: Multiple Vulnerabilities in the CPP and Parity Ethereum Client

Vulnerabilities discovered by Marcin Noga of Cisco Talos. Overview Talos is disclosing the presence of multiple vulnerabilities in the CPP and the Parity Ethereum clients. TALOS-2017-0503 / CVE-2017-14457 describes a denial of service vulnerability and potential memory leak in libevm. The functio...

How to Protect your Device from Meltdown and Spectre?

By Waqas The devastating discovery about security flaws namely Meltdown and Spectre This is a post from HackRead.com Read the original post: How to Protect your Device from Meltdown and Spectre?...

Security Flaws in GPS Trackers Puts Millions of Devices’ Data at Risk

By Waqas Trackmadeddon attack puts millions of vulnerable GPS trackers at risk This is a post from HackRead.com Read the original post: Security Flaws in GPS Trackers Puts Millions of Devices Data at Risk...

Moderate: Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update

An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 8.0 Liberty. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Tiredful API - An intentionally designed broken web application based on REST API

Tiredful API is intentionally designed broken app. The aim of this web app is to teach developers, QA or security professionals about flaws present in webservices REST API due to insecure coding practice. Who can use Tiredful API? Web developers Web Pentesters Security Professionals Student What ...

SUSE-SU-2017:3267-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP2 Realtime kernel was updated to 4.4.95 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-12153: A security flaw was discovered in the nl80211setrekeydata function in net/wireless/nl80211.c in the Linux kernel This function...