Data: E-Retail Hacks More Lucrative Than Ever

For many years and until quite recently, credit card data stolen from online merchants has been worth far less in the cybercrime underground than cards pilfered from hacked brick-and-mortar stores. But new data suggests that over the past year, the economics of supply-and-demand have helped to...

APT trends report Q1 2019

For just under two years, the Global Research and Analysis Team GReAT at Kaspersky Lab has been publishing quarterly summaries of advanced persistent threat APT activity. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published an...

CVE-2018-14980

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/USPhone/ASUSX0081:7.0/NRD90M/USPhone-14.14.1711.92-20171208:user/release-keys contains the android framework i.e., systemserver with a package name of android versionCode=24, versionName=7.0 that has been modified by ASUS or...

CVE-2018-14983

The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys contains the android framework i.e., systemserver with a package name of android versionCode=24, versionName=7.0 that has been modified by Sony or another entity in the supp...

Authentication flaw

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/USPhone/ASUSX0081:7.0/NRD90M/USPhone-14.14.1711.92-20171208:user/release-keys contains the android framework i.e., systemserver with a package name of android versionCode=24, versionName=7.0 that has been modified by ASUS or...

Authentication flaw

The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys contains the android framework i.e., systemserver with a package name of android versionCode=24, versionName=7.0 that has been modified by Sony or another entity in the supp...

CVE-2018-14983

The CVE concerns Sony Xperia L1 devices running Android 7.0 (build Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199) where the system_server in the core android package includes an exported broadcast receiver that lets apps on the device trigger a screenshot to be saved to external storage. This behav...

CVE-2018-14983

The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys contains the android framework i.e., systemserver with a package name of android versionCode=24, versionName=7.0 that has been modified by Sony or another entity in the supp...

CVE-2018-14980

The CVE-2018-14980 entries describe an Android framework issue on ASUS ZenFone 3 Max (ASUS_X008) running Android 7.0 NRD90M with a modified system_server that exports a broadcast receiver in the core android package. This receiver allows any locally co-located app to programmatically trigger a sc...

Point Blank Gamers Targeted with Backdoor Malware

The focus of the APT behind the ShadowHammer supply-chain attack that abused the ASUS computer update function turns out to be wider in scope than previously thought. Researchers have found similar digitally-signed binaries using the videogame industry as a delivery conduit for malware. Victims...

Supply Chain Hackers Snuck Malware Into Videogames

An aggressive group of supply chain hackers strikes again, this time further upstream...

CVE-2019-2709

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite subcomponent: Security. Supported versions that are affected are 6.3.7, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

CVE-2019-2567

Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite subcomponent: Active Model Generation. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl...

Design/Logic Flaw

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite subcomponent: Security. Supported versions that are affected are 6.3.7, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

Design/Logic Flaw

Vulnerability in the Oracle AutoVue 3D Professional Advanced component of Oracle Supply Chain Products Suite subcomponent: Format Handling - 2D. Supported versions that are affected are 21.0.0 and 21.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTT...

Design/Logic Flaw

Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite subcomponent: Active Model Generation. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl...

CVE-2019-2709

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite subcomponent: Security. Supported versions that are affected are 6.3.7, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

CVE-2019-2709

CVE-2019-2709 affects Oracle Transportation Management within Oracle Supply Chain Products Suite. Affects versions 6.3.7, 6.4.2 and 6.4.3. The vulnerability enables an unauthenticated attacker with network access over HTTP to potentially compromise data, with possible unauthorized updates, insert...

CVE-2019-2709

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite subcomponent: Security. Supported versions that are affected are 6.3.7, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

CVE-2019-2567

CVE-2019-2567 affects Oracle Configurator (Active Model Generation) in Oracle Supply Chain Products Suite. Affected: 12.1 and 12.2. Issue: unauthenticated attacker over HTTP can gain unauthorized access to Oracle Configurator data. CVSSv3 base score 7.5 (High) with confidentiality impact. Connect...