The vulnerability of Safari browser and iOS operating system allows attackers to carry out spoofing attacks.

The vulnerability of Safari browser and iOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks by replacing the requested page due to lack of authentication checks...

Fake EFF Site Used in Spear Phishing Campaign

Attackers, possibly associated with the Russian government, registered a phony Electronic Frontier Foundation domain earlier this month in an attempt to dupe users into thinking correspondence from the site was coming from the well-known privacy watchdog. The scheme, largely carried out via spear...

Oracle Patches Java Zero Day

Oracle has released its quarterly patch update, which includes fixes for nearly 200 vulnerabilities. The most notable bug fixed in this release is the Java zero day that’s been used in an ongoing attack campaign. The massive release from Oracle has patches for a long list of products, but the Jav...

FiverrScript CSRF Vulnerability (Add New Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: FiverrScript CSRF Vulnerability add New admin Author: Mahmoud Gamal @Zombiehelp54 Google Dork: intext:Powered by FiverrScript Date: 10/06/2015 Exploit Author: Scriptolution Vendor Homepage: http://scriptolution.com Software Link...

CSRF/XSS In Manage Engine Asset Explorer

=============================================================================== CSRF/Stored XSS Vulnerability in Manage Engine Asset Explorer =============================================================================== . contents:: Table Of Content Overview ======== Title :CSRF/Stored XSS...

Manage Engine Asset Explorer 6.1.0 Build: 6110 - Cross-Site Request Forgery

Manage Engine Asset Explorer 6.1.0 Build: 6110 - Cross-Site Request Forgery =============================================================================== CSRF/Stored XSS Vulnerability in Manage Engine Asset Explorer ===============================================================================...

White House, State Department Counted Among CozyDuke APT Victims

A data-mining advanced persistent threat hit a handful of high profile targets last year, including the White House’s computer network. Dubbed CozyDuke, the APT’s toolset shares several similarities with fellow APTs MiniDuke, CosmicDuke and OnionDuke. Kurt Baumgartner and Costin Raiu, researchers...

Dyre Wolf Banking Malware Stole More Than $1 Million

Security researchers have uncovered an active cyber attack campaign that has successfully stolen more than $1 Million from a variety of targeted enterprise organizations using spear phishing emails, malware and social engineering tricks. The campaign, dubbed "The Dyre Wolf" by researchers from...

IRS Issues Warning for a Scam Targeting Tax Preparers

The Internal Revenue Service IRS has issued a press release addressing a new spear phishing scam targeting tax preparers and other tax professionals. Scam operators often use fraudulent e-mails to entice their targets to reveal login credentials. US-CERT encourages users and administrators to...

Researchers: PlugX More Prominent Than Ever

Existing in some form since 2008, the popular remote access tool PlugX has as notorious a history as any malware, but according to researchers the tool saw a spike of popularity in 2014 and is the go-to malware for many adversary groups. Many attacks, especially those occurring during the latter...

IC3 Issues Alert on University Employee Payroll Scam

The Internet Crime Complaint Center IC3 has issued an alert addressing a spear phishing scam targeting university employees and their payroll accounts. Scam operators use fraudulent e-mails and websites to entice employees to reveal login credentials. Users are encouraged to review the IC3 Alert...

FBI Director says 'Sloppy' Sony Hackers Left Clues that Point to North Korea

The hackers group responsible for the last year’s largest hacking attack on Sony Pictures Entertainment left many clues which proves that the Sony's hackers, who called themselves Guardians of Peace GOP, linked to North Korea, as claimed by the Federal Bureau of Investigation FBI. Speaking at the...

Two XSS Vulnerabilities in SupportCenter Plus

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in a web-based customer support software SupportCenter Plus. These vulnerabilities can be exploited to perform Cross-Site Scripting attacks against authenticated users of the vulnerable software. 1 Cross-Site Scripting XSS ...

Global Internet Authority ICANN Has Been Hacked

The Internet Corporation for Assigned Names and Numbers ICANN has been hacked by unknown attackers that allowed them to gain administrative access to some of the organization's systems, the organization confirmed. The attackers used "spear phishing" campaign to target sensitive systems operated b...

Attackers Compromise ICANN, Zone Files System

Unknown hackers were able to compromise vital systems belonging to ICANN, the organization that manages the global top-level domain system, and had access to the system that manages the files with data on resolving specific domain names. The attack apparently took place in November and ICANN...

WordPress yURL ReTwitt WP 1.4 CSRF / XSS

Title: CSRF/XSS Vulnerability in yURL ReTwitt WP Plugin Author: Manideep K CVE-ID: CVE-2014-9341 Plugin Homepage: https://wordpress.org/plugins/yurl-retwitt/ Version Affected: 1.4 probably lower versions Severity: High About Plugin: This plugin will allow your readers to publish a RT Re-Twitt on...

Red October Attackers Return With CloudAtlas APT Campaign

The attackers behind the Red October APT campaign that was exposed nearly two years ago have resurfaced with a new campaign that is targeting some of the same victims and using similarly constructed tools and spear phishing emails. Red October emerged in January 2013 and researchers found that th...

Operation Cleaver — Iranian Hackers Targeting Critical Infrastructure Worldwide

For over past two years, Iranian hackers have infiltrated computer networks of some of the world's top organizations including airlines, defense contractors, universities, military installations, hospitals, airports, telecommunications firms, government agencies, and energy and gas companies,...

Destructive BlackEnergy Malware Plug-Ins Target Cisco Routers

BlackEnergy, a converted crimeware tool, operates behind a laundry list of plug-ins for Linux and Windows systems that allows it to be used to attack Cisco networking devices, steal digital certificates, brick systems it infects, and skillfully hide from security analysts. Researchers from...

Russian APT28 Group Linked to NATO, Political Attacks

A Russian APT group tied to ongoing attacks against military and political targets in Eastern Europe and against NATO could also have ties to the MiniDuke espionage campaign uncovered more than a year ago. Dubbed APT28 by FireEye in a report published last night, the Russian hackers have targeted...