Apple Releases Security Update for iOS

Apple has released iOS 11.0.2 to address vulnerabilities in previous versions of iOS. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Apple security page for iOS 11.0.2 and...

October is National Cybersecurity Awareness Month

October is National Cybersecurity Awareness Month NCSAM. NCSAM is a collaborative effort between DHS and its public and private partners--including the National Cyber Security Alliance NCSA--to raise awareness about the vital role cybersecurity plays in the lives of U.S. citizens. US-CERT will be...

DNSSEC Key Signing Key Rollover Postponed

The Internet Corporation for Assigned Names and Numbers ICANN has announced that the change to the Root Zone Key Signing Key KSK scheduled for October 11, 2017, has been postponed. A new date for the Key Roll has not yet been determined. DNSSEC is a set of DNS protocol extensions used to digitall...

maxionwheelsandrims.com XSS vulnerability

Vulnerable URL: http://www.maxionwheelsandrims.com/contact-us Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9804940 VIP website status:| No Coordinated Disclosure Timeline:...

Mozilla Releases Security Updates

Mozilla has released security updates to address multiple vulnerabilities in Firefox ESR 52.4 and Firefox 56. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the Mozilla Security Advisories...

Razer US: Reflected XSS in deals.razerzone.com via the interesting parameter.

Summary --- deals.razerzone.com is vulnerable to Reflected XSS via the interesting parameter. Affected Code --- html var ThisPageOn = "recommended", pageNum = 2, isLoading = false, delIntresItem = 0, delNotIntresItem = 0, delOwnedItem = 0, intres = -1 abba alert1 ; var ownedLang = "OWNED",...

Razer US: Reflected XSS on the https://deals.razerzone.com/json/translation endpoint

Thanks to SP1D3RS for the great report and working with the team on this one. This was a trivial POST-XSS, caused by using text/html Content-Type on the JSON endpoint, and ability to control the part of the response using unsanitized input. Why I disclosed it if this is a trivial issue? I pretty...

Oracle Patches Apache Struts, Reminds Users to Update Equifax Bug

Oracle released fixes for a handful of recently patched Apache Struts 2 vulnerabilities, including a critical remote code execution vulnerability CVE-2017-9805 that could let an attacker take control of an affected system, late last week. The Apache Software Foundation patched the RCE...

Apple Releases Security Update for iOS

Apple has released iOS 11.0.1 to address vulnerabilities in previous versions of iOS. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Apple security page for iOS 11.0.1 and...

Oracle Patches Apache Vulnerabilities

Oracle has released security updates to address Apache Struts 2 vulnerabilities found across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the Oracle Security Alert and...

Stored Cross-Site Scripting Vulnerability in the YoYo Housing App

YouYouGoodHouse app is a rental app created by Chengdu GoodHouse Technology Co. A stored cross-site scripting vulnerability exists in the "About Us" section of the YouYouHaoRooms app. An attacker can insert malicious js code into the page to obtain user cookies and other information, resulting in...

Razer US: Reflected XSS in razer-id.razerzone.com

The researcher discovered a reflective XSS that allowed the injection of a javascript scheme into a URL on the razer-id server. This was reported on 9/21 and the fix deployed to production on 10/19...

Google Releases Security Updates for Chrome

Google has released Chrome version 61.0.3163.100 for Windows, Mac, and Linux. This update addresses multiple vulnerabilities that an attacker may exploit to cause a denial-of-service condition. US-CERT encourages users and administrators to review the Chrome Releases page and apply the necessary...

Iranian APT33 Targets U.S. Firms with Destructive Malware

The Iranian group known as APT33 is believed to be behind a cyberespionage campaign targeting aerospace, petrochemical and energy sector firms located in the United States, Saudi Arabia and South Korea. The group’s latest attack leverages a dropper called DropShot that is tied to the StoneDrill...

Joomla! Releases Security Update

Joomla! has released version 3.8.0 of its Content Management System CMS software to address a vulnerability. A remote attacker could exploit this vulnerability to obtain access to sensitive information. US-CERT encourages users and administrators to review the Joomla! Security Release and apply t...

FTC Releases Alerts on Protecting Against Identity Theft

The Federal Trade Commission FTC has released two alerts to educate consumers on recommended protections against identity theft after the recent data breach at Equifax. Users should consider placing security freezes with the three major credit reporting agencies: Equifax, Transunion, and Experian...

WordPress Releases Security Update

WordPress versions prior to 4.8.2 are affected by multiple vulnerabilities. A remote attacker could exploit some of these vulnerabilities to take control of an affected website. US-CERT encourages users and administrators to review the WordPress Security Release and upgrade to WordPress 4.8.2. Th...

IC3 Issues Alert on Disaster-Related Fraud

The Internet Crime Complaint Center IC3 has released an announcement on fraudulent cyber activity related to natural disasters. IC3 reports that scammers have recently used email and social-networking sites to solicit money from disaster victims with scams on false temporary housing and job...

Samba Releases Security Updates

The Samba Team has released security updates to address several vulnerabilities in Samba. An attacker could exploit any of these vulnerabilities to obtain access to potentially sensitive information. US-CERT encourages users and administrators to review the Samba Security Announcements for...

Avast’s Piriform Releases Security Update for CCleaner

Piriform, a subsidiary of Avast, has released CCleaner 5.34 and has pushed v1.07.3214 to CCleaner Cloud users. These versions do not contain the Floxif malware found in the 32-bit versions of CCleaner 5.33.6162 and CCleaner Cloud 1.07.3191. Floxif malware collects information from the victim's...