U.S. Dept Of Defense: Video player on ███ allows arbitrary remote videos to be played

Summary: A Flash video player hosted on ███████ can be provided with an arbitrary remote XML file via the url query string parameter. Description: The Flash video player http://█████/shared/widgets/popup.asp uses the url query string parameter as an address to fetch an RSS feed type XML document...

GRIZZLY STEPPE - Russian Malicious Cyber Activity

The Department of Homeland Security DHS has released a Joint Analysis Report JAR that details Russian malicious cyber activity, designated as GRIZZLY STEPPE. This activity by Russian civilian and military intelligence services RIS is part of an ongoing campaign of cyber-enabled operations directe...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @mthirup was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Misconfigured password reset vulnerability on a DoD website

A Department of Defense website was mis-configured such that the password reset function could be bypassed to change a user's password. @mthirup was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @mthirup!...

FTC Releases Alert on Fake Apps for Mobile Devices

The Federal Trade Commission FTC has released an alert on fraudulent mobile apps designed to exploit consumers. Some fake apps may steal personal information such as credit card numbers. By taking precautions, users can protect themselves and their private data. US-CERT encourages users and...

VMware Releases Security Update

VMware has released a security update to address a vulnerability in vSphere Hypervisor ESXi. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review VMware Security Advisory VMSA-2016-0023 and...

UTRADE HK for US Markets - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application UTRADE HK for US Markets published at the 'play' market has multiple vulnerabilities...

U.S. Dept Of Defense: DOM Based XSS on an Army website

A U.S. Army website was vulnerable to a DOM based cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. juliocesar was able to demonstrate this vulnerability by crafting a speciall...

FBI Most Wanted Fugitive JPMorgan Hacker Arrested in New York

One of the FBI's most wanted hackers who was behind the largest theft of financial data has finally been arrested at the JFK airport in New York. Joshua Samuel Aaron is accused of being part of a hacking group that attacked several major financial institutions, including JPMorgan Chase, and...

FCA US LLC UconnectPhone - XFS Attack & XSS Vulnerability

Document Title: =============== FCA US LLC UconnectPhone - XFS Attack & XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2020 Release Date: ============= 2016-12-15 Vulnerability Laboratory ID VL-ID: ====================================...

Joomla! Releases Security Update for CMS

Joomla! has released version 3.6.5 of its Content Management System CMS software to address multiple vulnerabilities. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected website. US-CERT encourages users and administrators to review the Joomla!...

Microsoft Releases December 2016 Security Bulletin

Microsoft has released 12 updates to address vulnerabilities in Microsoft software. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the following Microsoft Security Bulletins...

Apple Releases Security Updates

Apple has released security updates to address vulnerabilities in tvOS and iOS. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators review the Apple security pages for tvOS and iOS and apply t...

President Obama Orders 'Full Review' of Possible Russian hacking in US Election

In his final month in office, President Barack Obama has ordered U.S. intelligence agencies to conduct a "full review" of pre-election cyber attacks against Democratic Party organizations that many believe affected the outcome of the 2016 presidential election. The United States intelligence...

gamblinginsider.ca XSS vulnerability

Vulnerable URL: http://www.gamblinginsider.ca/contact-us Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 13:10 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1665282 VIP website status:| No Check...

Netgear R7000 and R6400 cgi-bin Command Injection

This module exploits an arbitrary command injection vulnerability in Netgear R7000 and R6400 router firmware version 1.0.7.21.1.93 and possibly earlier. Module Options msf use exploit/linux/http/netgear/r7000cgibinexec msf undefinedr7000cgibinexec show actions ...actions... msf...

Google Fixes 12 High-Severity Vulnerabilities In Chrome Browser

Google is urging Windows, Mac and Linux users to update their Chrome browsers to fix multiple vulnerabilities that could allow malicious third parties to take control of targeted systems. Released Thursday, Chrome version 55.0.2883.75 for Windows, Mac, and Linux fixes those security issues. It al...

Anonymous Hacktivist 'Barrett Brown' Released From Prison

Barrett Brown, a journalist, formerly served as an unofficial spokesman for the hacktivist collective Anonymous, finally walked free from prison on Tuesday morning after serving more than four years behind bars. The Dallas-born investigative journalist was arrested in 2012 from his home while he...

Mozilla Releases Security Updates

Mozilla has released security updates to address a vulnerability in Firefox, Firefox ESR, and Thunderbird. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. Available updates include: Firefox 50.0.2 Firefox ESR 45.5.1 Thunderbird 45.5.1 US-CERT...

Dlink DIR Routers - Unauthenticated HNAP Login Stack Buffer Overflow (Metasploit) Exploit

Exploit for hardware platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' Payload working status: MIPS: - all valid payloads working the ones that we are able to send...