ISC Releases Security Advisories for DHCP, BIND

The Internet Systems Consortium ISC has released updates or workarounds that address vulnerabilities in versions of ISC Dynamic Host Configuration Protocol DHCP and Berkeley Internet Name Domain BIND. A remote attacker could exploit these vulnerabilities to cause a denial-of-service condition...

Cellebrite Unlocks iPhones for the US Government

Forbes reports that the Israeli company Cellebrite can probably unlock all iPhone models: Cellebrite, a Petah Tikva, Israel-based vendor that's become the U.S. government's company of choice when it comes to unlocking mobile devices, is this month telling customers its engineers currently have th...

scimetrica.com XSS vulnerability

Open Bug Bounty ID: OBB-569470 Description| Value ---|--- Affected Website:| scimetrica.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Developer of NanoCore RAT that targeted Canada, US & Steam jailed

By Waqas The developer of NanoCore RAT remote access Trojan has been sentenced This is a post from HackRead.com Read the original post: Developer of NanoCore RAT that targeted Canada, US & Steam jailed...

merriam-webster.com XSS vulnerability

Open Bug Bounty ID: OBB-566650 Description| Value ---|--- Affected Website:| merriam-webster.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

HackerOne: Program profile_metrics.json contains time to triage for deptofdefense even it's turned off

Hello Hackerone Security Team, Summary 1 Well, in your previous report, it was revealing about Time to Triage for WordPress which you fixed it. 2 However, the program US dept of defense doesn't have profile metrics which we can't display any certain info. But, still profilemetrics.json leaks the...

FTC Releases Article on Choosing VPN Apps for Mobile Phones

The Federal Trade Commission FTC has issued guidance to consumers considering using a Virtual Private Network VPN for their mobile phones. Some mobile phone users choose to use VPNs to shield the information on their phones when using public Wi-Fi networks. NCCIC/US-CERT encourages consumers to...

Cisco Releases Security Updates for Multiple Products

Cisco has released several updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review the following Cisco Security Advisories and...

IC3 Issues Alert on Increase in W-2 Phishing Campaigns

The Internet Crime Complaint Center IC3 has issued an alert on the increase in W-2-related phishing campaigns. Fraudsters often use tax-related phishing emails to get victims to provide personally identifiable information, click on a malicious link, or pay a ransom. NCCIC/US-CERT encourages...

Browsealoud plugin hacked to mine Monero on 4,000 Govt websites

By Waqas There were thousands of UK and US government websites mining Monero This is a post from HackRead.com Read the original post: Browsealoud plugin hacked to mine Monero on 4,000 Govt websites...

Microsoft Releases February 2018 Security Updates

Microsoft has released updates to address vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review Microsoft's February 2018 Security Update Summary and...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe Experience Manager, Acrobat, and Reader. A remote attacker could exploit these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review Adobe Security Bulletin APSB18-...

U.S. Arrests 13, Charges 36 in ‘Infraud’ Cybercrime Forum Bust

The U.S. Justice Department announced charges on Wednesday against three dozen individuals thought to be key members of 'Infraud," a long-running cybercrime forum that federal prosecutors say cost consumers more than a half billion dollars. In conjunction with the forum takedown, 13 alleged Infra...

Cisco Releases Security Updates for Multiple Products

Cisco has released several updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review the following Cisco Security Advisories and...

Poor Security at the UK National Health Service

The Guardian is reporting that "every NHS trust assessed for cyber security vulnerabilities has failed to meet the standard required." This is the same NHS that was debilitated by WannaCry. EDITED TO ADD 2/13: More news. And don't think that US hospitals are much better...

CVE-2018-4878

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the...

Adobe Releases Security Updates for Flash Player

Adobe has released security updates to address vulnerabilities in Flash Player. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review Adobe Security Bulletin APSB18-03 and apply the necessary...

British Hacker 'Lauri Love' will not be extradited to US, Court Rules

British citizen and hacker Lauri Love, who was accused of hacking into United States government websites, will not be extradited to stand trial in the U.S., the High Court of England and Wales ruled today. Love, 33, is facing a 99-year prison sentence in the United States for allegedly carrying o...

Cisco Releases Security Updates

Cisco has released an updated advisory and security updates to address a vulnerability affecting its Adaptive Security Appliance software. A remote attacker could exploit this vulnerability to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review Cisco's...

Jackpotting Attacks Against US ATMs

Brian Krebs is reporting sophisticated jackpotting attacks against US ATMs. The attacker gains physical access to the ATM, plants malware using specialized electronics, and then later returns and forces the machine to dispense all the cash it has inside. The Secret Service alert explains that the...