3679 matches found
Debian DSA-4289-1 : chromium-browser - security update
Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-16065 Brendon Tiszka discovered an out-of-bounds write issue in the v8 JavaScript library. - CVE-2018-16066 cloudfuzzer discovered an out-of-bounds read issue in blink/webkit. - CVE-2018-16067 Zhe Jin discovered ...
Tor Browser 8.0 - Everything you Need to Safely Browse the Internet
Tor Browser 8.0, is the first stable release based on Firefox 60 ESR, is now available from the Tor Browser Project page and also from distribution directory. This release is all about users first. Tor Browser 8.0 comes with a series of user experience improvements that address a set of long-term...
USN-3761-1 firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. CVE-2018-12375, CVE-2018-12376, CVE-2018-12377, CVE-2018-12378 It was...
Misconfigured Tor sites using SSL certificates exposing public IP addresses
By Waqas Tor is a browser known to keep the IP addresses of its users private and confidential due to which users can surf the web anonymously. However, according to RiskIQ’s threat researcher Yonathan Klijnsma, it is possible to identify the IP addresses of Tor users. Klijnsma states that...
Tiny Island Atoll’s Domain Used in Widespread Ad Fraud
A scam campaign involving “.tk” domains has been active since at least May 2018, redirecting unsuspecting users to fake blogger sites that are collectively bringing in close to $22,000 per month in advertising revenue. The same actors have also been spotted running a tech-support scam in tandem,...
CVE-2018-14899
On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect users to malicious sites...
Design/Logic Flaw
On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect users to malicious sites...
DNC: Highly Publicized ‘Phishing Attempt’ Was Only a Security Test
A day after the Democratic National Committee riled up security researchers and the press, it’s walking back an assertion that there was an attempt to compromise its voter database. Though it seemed like the event was the latest in a series of malicious efforts designed to harvest credentials...
Dark Tequila Banking Malware Uncovered After 5 Years of Activity
Security researchers at Kaspersky Labs have uncovered a new, complex malware campaign that has been targeting customers of several Mexican banking institutions since at least 2013. Dubbed Dark Tequila, the campaign delivers an advanced keylogger malware that managed to stay under the radar for fi...
Micro Focus NetIQ eDirectory Open Redirect Vulnerability
Micro Focus NetIQ eDirectory is an identity management infrastructure platform from Micro Focus UK that combines identity management architecture and directory services technology. The platform provides authentication policies, data backup and recovery services, and data disaster recovery. An ope...
Detecting Phishing Sites with Machine Learning
Really interesting article: A trained eye or even a not-so-trained one can discern when something phishy is going on with a domain or subdomain name. There are search tools, such as Censys.io, that allow humans to specifically search through the massive pile of certificate log entries for sites...
Google Chrome URL Spoofing Vulnerability (CNVD-2018-17052)
Google Chrome is a web browser developed by the American company Google Google. A URL spoofing vulnerability exists in Omnibox in Google Chrome. A remote attacker can exploit this vulnerability to spoof URLs by tricking users into visiting specially crafted websites...
Google Starts Labeling All HTTP Sites as ‘Not Secure’
Websites that insist on sticking with HTTP will have a public relations issue on their hands, beginning today: All of them, without exception, will be labeled as insecure by Google Chrome from now on. Anyone using the Chrome web browser will be served up a warning message anytime they surf to an...
Rocket.Chat: XSS (stored) Wizard is saving executable code
issue: xssstored Stored XSS occurs when a web application gathers input from a user which might be malicious, and then stores that input in a data store for later use. The stored input is not correctly filtered. As a consequence, the malicious data will appear to be part of the web site and run...
Online generators… of dashed expectations
Quite recently, we and hence our security solutions started to designate an entire class of sites — gift card generators — as fraudulent, despite their not stealing any money or personal data from visitors. Why? Let's try to unpick these sites and see how they work. How it works Ads for all kinds...
A WordPress SPAMbot Wants You to Bet on the 2018 FIFA World Cup
Our researchers recently picked up on a spike in SPAM activity directed at sites powered by WordPress, which, naturally, led them to take a closer look. Turns out the attack was launched by a botnet and implemented in the form of comment SPAM - meaningless, generic text generated from a template...
CVE-2013-0594
Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. IBM X-Force ID: 83383...
Dirhunt - Find Web Directories Without Bruteforce
Dirhunt is a web crawler optimize for search and analyze directories. This tool can find interesting things if the server has the "index of" mode enabled. Dirhunt is also useful if the directory listing is not enabled. It detects directories with false 404 errors , directories where an empty inde...
CoinHive URL Shortener Abused to Secretly Mine Cryptocurrency Using Hacked Sites
Security researchers have been warning about a new malicious campaign that leverages an alternative scheme to mine cryptocurrencies without directly injecting the infamous CoinHive JavaScript into thousands of hacked websites. Coinhive is a popular browser-based service that offers website owners...
