This Week in Security News: Spam Campaigns and Vulnerable Infrastructures

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, see how cybercriminals have learned to become more creative with malware through spam campaigns. Also, understand why securing energy and...

Apple's New MacBook Disconnects Microphone "Physically" When Lid is Closed

Apple introduces a new privacy feature for all new MacBooks that "at some extent" will prevent hackers and malicious applications from eavesdropping on your conversations. Apple's custom T2 security chip in the latest MacBooks includes a new hardware feature that physically disconnects the...

Apple's T2 Security Chip Makes It Harder to Tap MacBook Mics

By cutting off the microphone at the hardware level, recent MacBook devices minimize the chance that someone can eavesdrop...

DEBIAN-CVE-2018-16376

An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2encodepacket in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact...

UBUNTU-CVE-2017-14039

A heap-based buffer overflow was discovered in the opjt2encodepacket function in lib/openjp2/t2.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact...

DEBIAN-CVE-2017-14039

A heap-based buffer overflow was discovered in the opjt2encodepacket function in lib/openjp2/t2.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact...

CVE-2017-14039

OpenJPEG 2.2.0 is affected by CVE-2017-14039 in the opj_t2_encode_packet function (lib/openjp2/t2.c): a heap-based buffer overflow causes an out-of-bounds write, potentially enabling remote denial of service or other impact. Multiple vendor advisories (e.g., Debian DSA-4013, Mageia MGASA-2017-048...

dvb-t2-portal.de XSS vulnerability

Open Bug Bounty ID: OBB-264457 Description| Value ---|--- Affected Website:| dvb-t2-portal.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

AWS OpenVPN Deployment Tool: AutoVPN

AWS OpenVPN Deployment Tool Dependencies: boto and paramiko python packages and aws .credentials file on system 1. Clone repo to system. 2. Execute autovpn with -C -k and -r options to deploy to AWS ./autovpn -C -r us-east-1 -k macbook 3. OpenVPN config files are downloaded to current working...

CVE-2014-7945

OpenJPEG before r2908, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service out-of-bounds read via a crafted PDF document, related to j2k.c, jp2.c, and t2.c...

CVE-2014-10019

Multiple cross-site request forgery CSRF vulnerabilities in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem allow remote attackers to hijack the authentication of administrators for requests that 1 change the SSID or 2 change the password via a crafted request...

CVE-2014-10018

Cross-site scripting XSS vulnerability in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem allows remote attackers to inject arbitrary web script or HTML via the essid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem allows remote attackers to inject arbitrary web script or HTML via the essid parameter...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem allow remote attackers to hijack the authentication of administrators for requests that 1 change the SSID or 2 change the password via a crafted request...

CVE-2014-10018

Cross-site scripting XSS vulnerability in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem allows remote attackers to inject arbitrary web script or HTML via the essid parameter...

CVE-2014-10018

CVE-2014-10018 is an XSS vulnerability in the Teracom T2-B-Gawv1.4U10Y-BI modem, specifically in webconfig/wlan/country.html/country, where the essid parameter can be manipulated to inject arbitrary web script or HTML. The connected records confirm only the generic description and lack explicit t...

CVE-2014-10019

The CVE-2014-10019 entry concerns CSRF vulnerabilities in Teracom T2-B-Gawv1.4U10Y-BI modem, specifically in webconfig/wlan/country.html/country. An attacker could remotely hijack administrator authentication to perform requests that (1) change the SSID or (2) change the password via crafted requ...

CVE-2014-10019

Multiple cross-site request forgery CSRF vulnerabilities in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem allow remote attackers to hijack the authentication of administrators for requests that 1 change the SSID or 2 change the password via a crafted request...

Teracom Modem T2-B-Gawv1.4U10Y-BI - Stored XSS Vulnerability

No description provided by source. Exploit Title: Teracom Modem Stored XSS Vulnerability Date: 19-01-2014 Author: Rakesh S Software Link: http://www.teracom.in/ Version: T2-B-Gawv1.4U10Y-BI Tested on: Windows 7 Code : GET...

servicetags NSE Script

Attempts to extract system information OS, hardware, etc. from the Sun Service Tags service agent UDP port 6481. Based on protocol specs from Example Usage nmap -sU -p 6481 --script=servicetags Script Output | servicetags: | URN: urn:st:3bf76681-5e68-415b-f980-abcdef123456 | System: SunOS |...