Flexera FlexNet Publisher, a stack-based buffer overflow vulnerability analysis CVE-2 0 1 5-8 2 7 7-a vulnerability warning-the black bar safety net

Recently, the security personnel in Flexera FlexNet PublisherLicense Managerdiscovered a stack-based buffer overflow vulnerabilities CVE ID: CVE-2 0 1 5-8 2 7 7, The CNNVD number: CNNVD-2 0 1 6 0 2-4 4 1, and can lead to remote code execution, and will be based on different software products...

Vulnerability acquisition platform Zerodium publication of various types of software and digital intrusion method price list-vulnerability warning-the black bar safety net

! 1 1 May 1 8, Zerodium（0day brokers published a variety of from a network of criminals to buy and then resell to the needs of the target software and intrusion methods of the price list. Vulnerabilities platform released a price list Zerodium CEO Chaouki bekrar has said: “0day trading the first...

Google Calls Proposed U.S. Wassenaar Rules 'Not Feasible'

As the clock winds down on the comment period for the United States government’s proposed implementation of the Wassenaar Arrangement export controls for intrusion software, Google officials say that the rules would have a “significant negative impact” on security research. The Department of...

U.S. Government Wades Into Vulnerability Disclosure

Security researchers and software vendors have spent decades trying to work out the process of vulnerability disclosure, with limited success. Now the federal government is joining the fray in hopes of getting the two sides to play nice. The National Telecommunications and Information...

Hacking Team attack code analysis Part 1: Flash 0day-vulnerability warning-the black bar safety net

The recent special offers by attacks techniques for network monitoring hacking company Hacking Team is black, contains the company's email, documents, and the attack Code of 400G data leakage. 360Vulcan Team the first time to obtain the relevant information, and for which exploit code is analyzed...

Microsoft Censures Google Publishing Windows Vulnerability

Microsoft yesterday excoriated Google for disclosing information about a Windows security vulnerability just days ahead of the Patch Tuesday release slated to fix the bug. The rebuke came in the form of a Technet blogpost calling for better coordinated vulnerability disclosure. In reality, the ti...

Bugcrowd Releases Open Source Vulnerability Disclosure Framework

The problems that come from doing security research on modern Web applications and other software aren’t just challenging for researchers, but also for the companies on the receiving end of their advisories. Companies unaccustomed to dealing with researchers can find themselves in a difficult...

Full Disclosure Security Mailing List Shuts Down

The Full Disclosure security mailing list, which has been one of the main discussion forums for vulnerability and exploit information for 12 years, is shutting down because “‘one of our own’ would undermine the efforts of the last 12 years”, one of the creators said. John Cartwright, one of the...

Google sets 7 Day deadline For vulnerability disclosure

Google will release details of any zero-day flaws it finds in software, if the affected vendor fails to issue a patch or disclose the issue itself within a week. Now, Google is shortening that timeline a good bit to just 7 days. “Based on our experience...we believe that more urgent action within...

As Bug Bounty Programs Mature, Still More Room For Growth

Google’s recent announcements that the company is doubling some of the rewards in its Chromium Vulnerability Reward Program and will also be committing up to $2 million for another round of the Pwnium contest in a couple of months brought a round of cheers from the security research community. Th...

VUPEN Says Rumors of Hack Are False

Claims surfaced earlier this week that the French security firm VUPEN, which is known for selling zero-day vulnerabilities to third parties, had been compromised and more than 100 of the company’s secret bugs had been leaked. However, VUPEN’s CEO said that the claims were totally false and there...

Google: Bug Bounty Program Has Made Users Safer

In the 15 months since Google began offering rewards to researchers who report vulnerabilities in its Web applications, the company has paid out more than $400,000 in bug bounties. That’s a lot of money, even for Google, and the company is counting the program as a huge success. Google’s reward...

Offensive Research Continuing to Advance

MIAMI BEACH–It’s the accepted wisdom these days that many of the traditional security defenses organizations depend on just aren’t effective at deterring attackers. But this glosses over the fact that the last few years have included some major advances in defensive technologies, including the...

SSL/TLS Protocol Vulnerability

US-CERT is aware of a vulnerability affecting the Secure Socket Layer SSL and Transport Layer Security TLS protocols. Exploitation of this vulnerability may allow an attacker to decrypt encrypted SSL/TLS traffic and obtain sensitive information. Microsoft has released Security Advisory 2588513 to...

Adobe Says It Is Breaking Ties To Diginotar

Software giant Adobe said on Thursday that it was removing Diginotar’s Qualified CA certificate from the Adobe Approved Trust List AATL, according to a company blog post. The move would effect Adobe Reader and Adobe Acrobats Versions 9 and X. It is just the latest move by major software vendors t...

Internet System Consortium releases BIND Patches

The Internet System Consortium has released updates for BIND to address multiple vulnerabilities. CVE-2011-2464 affects the following versions: 9.6.3; 9.6-ESV-R4 and later; 9.7.0 and later; 9.7.1 and later; 9.7.2 and later; 9.7.3 and later; 9.7.4b1; 9.8.0 and later; and 9.8.1b1. CVE-2011-2465...

OpenSSL Releases OpenSSL 1.0.0b

OpenSSL has released OpenSSL 1.0.0b to address a vulnerability that may allow an attacker to execute arbitrary code. US-CERT recommends that users and administrators of this product update to OpenSSL version 1.0.0b or apply the workaround provided in the OpenSSL security advisory. Because OpenSSL...

Vulnerability Broker Draws Line in Disclosure Sand

Looking to put pressure on software vendors who procrastinate on fixing security flaws, the world’s biggest broker of vulnerability data is drawing a line in the sand. Starting August 4, TippingPoint’s Zero Day Initiative ZDI will enforce a six-month deadline for patches on all vulnerabilities...

Microsoft Says No to Paying Bug Bounties

Microsoft has no plans to follow in the footsteps of Mozilla and Google and pay researchers cash rewards for the bugs that they find in Microsoft’s products. In the wake of both Mozilla and Google significantly increasing their bug bounties to the $3,000 range, there have been persistent rumors i...

Gartner to Businesses: Eliminate Windows XP by 2012

As Microsoft prepares to pull the plug on support for Windows XP SP2, a move that stops the release of security updates for that operating system, research firm Gartner is urging businesses to start planning and testing Windows 7 this year with a plan to completely eliminate Windows XP by the end...