APT Group Embeds C&C Data on TechNet Pages

The so-called Deputy Dog APT group has surfaced again with a means of keeping its command and control servers under wraps that involves Microsoft’s TechNet online resources. New research published last week by Microsoft and FireEye revealed targeted attacks against organizations have been...

Angler Exploit Kit Pushing New, Unnamed Ransomware

Attackers are using the infamous Angler exploit kit to disseminate a new, yet unnamed variant of the TeslaCrypt and AlphaCrypt ransomware, according to Rackspace security researcher Brad Duncan. Duncan analyzed the threat on the SANS Internet Storm Center, saying that the malware presents its...

New Utility Decrypts Files Lost to TeslaCrypt Ransomware

Crypto-ransomware variants have enterprises on edge because of the threat of irreversibly damaged files. Some organizations, including most recently the Tewksbury, Ma., police department have gone as far as to pay hundreds of dollars in ransom for the recovery key. Some technology companies are...

OpenBSD 5.6 - Multiple Local Kernel Panics (Denial of Service)

/ Exploit Title: OpenBSD include include include include include include ifndef OpenBSD error "Not OpenBSD !!!1111"; else include endif ifndef i386 error "Not i386 !!!1111"; endif char bigb00bz = " 8M:::::::8888M:::::888:::::::88:::8888888::::::::Mm\n" "...

MediaWiki cross-site scripting vulnerability (CNVD-2015-02416)

MediaWiki is a Wiki program. A cross-site scripting vulnerability exists in the Html class of MediaWiki. When the program uses a language variant, a remote attacker can exploit the vulnerability by replacing strings with LanguageConverter to inject arbitrary web script or HTML...

CVE-2015-2933

Cross-site scripting XSS vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant...

UBUNTU-CVE-2015-2933

Cross-site scripting XSS vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant...

Scientific Linux Security Update : pcre on SL7.x x86_64 (20150305)

A flaw was found in the way PCRE handled certain malformed regular expressions. This issue could cause an application for example, Konqueror linked against PCRE to crash while parsing malicious regular expressions. CVE-2014-8964 This update also adds the following enhancement : - Support for the...

Moderate: Red Hat Security Advisory: ppc64-diag security, bug fix, and enhancement update

Updated ppc64-diag packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which giv...

New Strain of Banking Trojan Targets Android, Steals SMS

A relatively new Android Trojan that specializes in stealing banking information by intercepting SMS messages has been making the rounds. Researchers at zScaler spotted the as yet unnamed Trojan circulating as 888.apk. Like many types of malware that came before it, at least for the moment, the...

Padding-oracle attack on TLS CBC cipher mode

A vulnerability affecting some implementations of TLS 1.x with CBC cipher modes has been discovered that allows an attacker to decrypt some encrypted contents under certain conditions CVE-2014-8730. This padding-oracle attack on TLS CBC cipher modes is a variant of the POODLE vulnerability,...

Microsoft Warns of Crowti Ransomware

Researchers with Microsoft have spotted a spike in Crowti, a ransomware similar to Cryptolocker that encrypts files on victims’ machines and then asks for payment to unlock them. The malware has existed for several months but it wasn’t until mid-October that Microsoft’s Malware Protection Center...

CVE-2 0 1 4-4 1 1 4 variants of sample analysis-vulnerability warning-the black bar safety net

Found a CVE-2 0 1 4-4 1 1 4 variants of the sample, the sample embedded with malicious code, can be directly to the local trigger, no need to from a remote shared server to download malicious code. Use UltraEdit to open the sample can be found within a block of the PE module information: ! ue.jpg...

UBUNTU-CVE-2014-3660

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service CPU consumption via a crafted XML document containing a large number of nested entity references, a...

New GameOver Zeus Botnet Malware Variant Surfaces

The GameOver Zeus takedown was trumpeted as a victory against cybercrime, and for all its success, even those involved understood it was likely a temporary win. Researchers at Seculert have spotted a new variant of GameOver Zeus that has spurned previous versions’ peer-to-peer communication...

Havex, It’s Down With OPC

FireEye recently analyzed the capabilities of a variant of Havex referred to by FireEye as “Fertger” or “PEACEPIPE”, the first publicized malware reported to actively scan OPC servers used for controlling SCADA Supervisory Control and Data Acquisition devices in critical infrastructure e.g., wate...

UBUNTU-CVE-2014-4607

Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run...

SGI IRIX <= 6.2 fsdump Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/355/info A number of vulnerabilities exist in the fsdump program included with Silicon Graphics Inc's IRIX operating system. Each of these holes can be used to obtain root privlilege. Variant 1: irix% /var/rfindd/fsdump...

Adobe Acrobat Reader (UNIX) 5.0 6,Xpdf 0.9x Hyperlinks Arbitrary Command Execution

No description provided by source. source: http://www.securityfocus.com/bid/7912/info A vulnerability has been reported for multiple PDF viewers for Unix variant operating systems. The problem is said to occur when hyperlinks have been enabled within the viewer. Allegedly, by placing a specially...

Microsoft NetMeeting 3.0.1 4.4.3385 Remote Desktop Sharing DoS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1798/info The Remote Desktop Sharing component of Microsoft NetMeeting for Windows NT 4.0 / 2000 does not properly handle a particular type of malformed input string sent over port 1720. CPU utilization can be caused to...