Intel Firmware Vulnerability

Intel has released recommendations to address a vulnerability in the firmware of the following Intel products: Active Management Technology, Standard Manageability, and Small Business Technology firmware versions 6.x, 7.x, 8.x, 9.x, 10.x, 11.0, 11.5, and 11.6. This vulnerability does not affect...

Microsoft Ending Security Updates for Windows 10 version 1507

After May 9, 2017, devices running Windows 10 version 1507 will no longer receive security updates. US-CERT encourages users and administrators to review Microsoft's Windows 10 version 1507 post for more information and to apply necessary updates. This product is provided subject to this...

Cisco Releases Security Updates

Cisco has released security updates to address a vulnerability in its Prime Home platform. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Cisco Security Advisory for vulnerability an...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe Acrobat, Reader, and Flash Player. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Adobe Security Bulletin...

GRIZZLY STEPPE - Russian Malicious Cyber Activity

The Department of Homeland Security DHS has released a Joint Analysis Report JAR that details Russian malicious cyber activity, designated as GRIZZLY STEPPE. This activity by Russian civilian and military intelligence services RIS is part of an ongoing campaign of cyber-enabled operations directe...

Apple Releases Security Updates

Apple has released security updates to address vulnerabilities in iCloud for Windows, Safari, iTunes for Windows, and macOS Sierra. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review th...

Potential Hurricane Matthew Phishing Scams

US-CERT warns users to remain vigilant for malicious cyber activity seeking to capitalize on interest in Hurricane Matthew. Users are advised to exercise caution in handling any email with subject line, attachments, or hyperlinks related to Hurricane Matthew, even if it appears to originate from ...

Microsoft Releases September 2016 Security Bulletin

Microsoft has released 14 updates to address vulnerabilities in Microsoft software. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the following Microsoft Security Bulletins...

Apple Releases Security Update

Apple has released a security update to address multiple vulnerabilites in iOS. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. The update is for iPhone 4s and later, iPad 2 and later, and iPod touch 5th generation and later. US-CER...

WordPress Releases Security Update

WordPress 4.5.2 and prior versions are affected by several security issues. Exploitation of one of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the WordPress Security Release and upgrade to WordPre...

WP Mobile Detector Vulnerability

WP Mobile Detector, a WordPress plugin, contains a vulnerability in versions prior to 3.6. Exploitation of this vulnerability could allow an attacker to take control of an affected website. US-CERT encourages users and administrators to disable the configuration option allowurlfopen if it is not...

Adobe Releases Security Update for Adobe Connect

Adobe has released a security update to address a vulnerability in Adobe Connect for Windows. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the Adobe Security Bulletin APSB16-17 and apply the...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in multiple products. Exploitation of these vulnerabilities could allow a remote attacker to cause a denial-of-service condition on an affected system. US-CERT encourages users and administrators to review the following Cisco Security...

GNU glibc Vulnerability

GNU glibc contains a buffer overflow vulnerability in the DNS resolver. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Vulnerability Note VU457759 and the glibc Project Notification for...

Microsoft Releases January 2016 Security Bulletin

Microsoft has released nine updates to address vulnerabilities in Microsoft software. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Microsoft Security Bulletins MS16-001...

Apple Releases Multiple Security Updates

Apple has released security updates for iOS, tvOS, OS X, watchOS, Safari, and Xcode to address multiple vulnerabilities, one of which could allow a remote attacker to take control of an affected system. Updates available include: iOS 9.2 for iPhone 4s and later, iPod touch 5th generation and late...

Drupal Releases Security Updates

Drupal has released updates to address multiple vulnerabilities, one of which could allow an attacker with elevated permissions to inject malicious code. Available updates include: Drupal core 6.37 for 6.x users Drupal core 7.39 for 7.x users US-CERT encourages users and administrators to review...

Evolution in Attacks Against Cisco IOS Software Platforms

Cisco has observed increasingly complex attacks that could allow an attacker to gain administrative access to a Cisco IOS device by installing a malicious ROMMON image. Successful exploitation using this image could allow an attacker to manipulate device behavior after the device is rebooted...

Microsoft Releases August 2015 Security Bulletin

Microsoft has released 14 updates to address vulnerabilities in Microsoft Windows. Exploitation of some of these vulnerabilities could allow remote code execution or elevation of privileges and information disclosure. US-CERT encourages users and administrators to review Microsoft Security...

Fraud Alert Issued on Business Email Compromise Scam

The Financial Services Information Sharing and Analysis Center FS-ISAC and federal law enforcement agencies have released a joint alert warning companies of a sophisticated wire payment scam referred to as business email compromise BEC. Scammers use fraudulent information to trick companies into...

Adobe Releases Security Updates for Multiple Products

Adobe has released security updates for Adobe Photoshop Creative Cloud CC and Bridge CC to address multiple vulnerabilities. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Adobe...

Adobe Releases Security Updates for Flash Player

Adobe has released security updates to address multiple vulnerabilities in Flash Player for Windows, Macintosh, and Linux. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Adobe...

Mozilla Releases Security Update for Firefox

The Mozilla Foundation has released Firefox 37.0.1 to address two vulnerabilities, one of which may allow a remote attacker to conduct man-in-the-middle attacks. Users and administrators are encouraged to review the security advisories for Firefox and apply the necessary updates. This product is...

Apple Releases Security Update for OS X Yosemite

Apple has released Security Update 2015-003 for OS X Yosemite v10.10.2 to address multiple vulnerabilities. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Apple Security Update...

Adobe Releases Security Updates for Flash Player

Adobe has released security updates to address multiple vulnerabilities in Flash Player, one of which could allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Adobe Security Bulletin APSB15-04 and apply the necessary updates. This...

Adobe Releases Security Updates for Flash Player

Adobe has released security updates to address a vulnerability in Flash Player, which could potentially allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Adobe Security Bulletin APSB15-02 and apply the necessary updates. This product ...

Drupal Releases Security Advisory

Drupal has released an advisory to address multiple vulnerabilities in Drupal core 6.x versions prior to 6.34 and Drupal core 7.x versions prior to 7.34, one of which could allow a remote attacker to cause a denial of service. US-CERT encourages users and administrators to review Drupal's Securit...

Microsoft Releases Out-of-Band Security Bulletin for Windows Kerberos Vulnerability

Microsoft has released security updates to address a remote elevation of privilege vulnerability which exists in implementations of Kerberos KDC in Microsoft Windows. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. US-CERT encourages users a...

Google Releases Security Update for Chrome

Google has released Chrome 38.0.2125.122 for Windows, Mac and Linux. This update addresses a vulnerability which could potentially allow an attacker to take over an affected system. US-CERT encourages users and administrators to review the Google Chrome release blog and apply the necessary update...

Microsoft Releases September 2014 Security Bulletin

Microsoft released updates to address vulnerabilities in Windows, .NET Framework, Internet Explorer and Lync Server as part of the Microsoft Security Bulletin Summary for September 2014. Some of these vulnerabilities could allow remote code execution, elevation of privilege, or denial of service...

WordPress Releases Security Update

WordPress 3.9.2 has been released to address multiple vulnerabilities, one of which could allow a possible denial of service issue in PHP’s XML processing. WordPress 3.7.3 or 3.8.3 users will be updated to 3.7.4 or 3.8.4. Users operating older, unsupported versions of WordPress are encouraged to...

Security Updates Available for Adobe Flash Player

Adobe has released security updates to address important vulnerabilities in Adobe Flash Player 12.0.0.70 or earlier versions for Windows and Macintosh, and Adobe Flash Player 11.2.202.341 or earlier versions for Linux. Exploitation of these vulnerabilities could compromise data security in a user...

GnuTLS Releases Security Update

GnuTLS has released security updates to address a vulnerability affecting certificate verification functions. An attacker could use a specially crafted X509 certificate to bypass validation checks, impersonate legitimate web sites or services, and perform man-in-the-middle attacks. Many Linux...

Apple Releases Safari 6.1.2 and Safari 7.0.2

Apple has released Safari 6.1.2 and 7.0.2 for OS X to address multiple vulnerabilities in WebKit. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. US-CERT encourages users and administrators to review Apple Support Article HT614...

Network Time Protocol (NTP) Amplification Attacks

A vulnerability in the "monlist" feature of ntpd can allow remote attackers to cause distributed denial of service attack DDoS via forged requests. US-CERT and the Canadian Cyber Incident Response Center CCIRC have both observed active use of this attack vector in recent DDoS attacks. US-CERT...

Mozilla Releases Multiple Updates

The Mozilla Foundation has released updates for the following products to address multiple vulnerabilities. Firefox 26 Firefox ESR 24.2 Thunderbird 24.2 SeaMonkey 2.23 These vulnerabilities could allow a remote attacker to bypass intended security restrictions, conduct a spoofing attack, execute...

Google Releases Google Chrome 30.0.1599.101

Google has released Google Chrome 30.0.1599.101 for Windows, Mac, Linux and Chrome Frame operating systems to address multiple vulnerabilities. These vulnerabilities could allow a remote attacker to cause a denial-of-service condition or trigger multiple conflicting uses of the same object. US-CE...

Cisco Releases Security Advisories

Cisco has released four security advisories to address multiple vulnerabilities. These vulnerabilities may allow a remote attacker to execute arbitrary code on a vulnerable system or cause a denial-of-service condition. US-CERT encourages users and administrators to review the following Cisco...

Oracle Java SE Critical Patch Update Announcement - June 2013

Oracle has released a June 2013 Critical Patch Update for Oracle Java SE. This Critical Patch Update is a collection of patches for multiple security vulnerabilities in Oracle Java SE. The update contains 40 new security vulnerability fixes, including a patch for Oracle JavaDoc frame injection...

Google Releases Google Chrome 23.0.1271.64

Google has released Google Chrome 23.0.1271.64 for Windows, Macintosh, Linux and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the Google Chrome Release blog entry and...

Microsoft Releases a Security Advisory for Windows Sidebar and Gadgets

Microsoft has released security advisory 2719662 to address a vulnerability in Microsoft Windows Sidebar and Gadgets. This vulnerability may allow an attacker to execute arbitrary code, take control of an affected system, or disclose sensitive information. US-CERT encourages users and...

Microsoft Releases July Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Internet Explorer, Office, Developer Tools, and Server Software as part of the Microsoft Security Bulletin summary for July 2012. These vulnerabilities may allow an attack to execute arbitrary code, operate with...

Microsoft Releases Advanced Notification for May Security Bulletin

Microsoft has issued a Security Bulletin Advanced Notification indicating that its May release will contain seven bulletins. These bulletins will have the severity rating of critical and important and will be for Microsoft Windows, Office, .NET Framework, and Silverlight. Releases of these...

DNSChanger Malware

US-CERT encourages users and administrators to ensure their systems are not infected with the DNSChanger malware by utilizing tools and resources available at the DNS Changer Working Group DCWG website. Computers testing positive for infection of DNSChanger malware will need to be cleaned of the...

Oracle Releases Critical Patch Update for April 2012

Oracle has released its Critical Patch Update for April 2012 to address 88 vulnerabilities across multiple products. This updates contains the following security fixes: 6 for Oracle Database Server 11 for Oracle Fusion Middleware 6 for Oracle Enterprise Manager Grid Control 4 for Oracle E-Busines...

Google Releases Google Chrome 18.0.1025.142

Google has released Chrome 18.0.1025.142 for Linux, Macintosh, Windows, and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, or perform a cross-site scripting attack. US-CERT encourages...

Google Releases Google Chrome 17.0.963.83

Google has released Chrome 17.0.963.83 for Linux, Macintosh, Windows, and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition. US-CERT encourages users and administrators to review the Googl...

Symantec pcAnywhere Hotfix

Symantec has released an update for pcAnywhere to address multiple vulnerabilities for the following software versions running on Windows: pcAnywhere 12.5 SP3 pcAnywhere Solutions 7.1 GA, SP 1, and SP 2 US-CERT encourages users and administrators to review the Symantec pcAnywhere hot fix and appl...

Google Releases Chrome 16.0.912.77

Google has released Chrome 16.0.912.77 for Linux, Mac, Windows, and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition. US-CERT encourages users and administrators to review the Google Chro...

Microsoft Releases September Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Microsoft Office, and Microsoft Server Software as part of the Microsoft Security Bulletin Summary for September 2011. These vulnerabilities may allow an attacker to execute arbitrary code or operate with elevated...