DOJ Provides Organizations a Framework for Development of a Vulnerability Disclosure Program

The Department of Justice DOJ Criminal Division Cybersecurity Unit has developed a framework to assist organizations interested in creating a formal vulnerability disclosure program. US-CERT encourages users, administrators, and organizations to review the DOJ publication, A Framework for a...

FTC Releases Alert on Digital Security While Traveling

The Federal Trade Commission FTC has released an alert on ensuring good digital security while traveling. Security recommendations include using caution while accessing free Wi-Fi hotspots, keeping all software updated, and using Virtual Private Networks VPNs. US-CERT encourages users to refer to...

FTC Releases Alert on Charity Scams

The Federal Trade Commission FTC has released an alert on charity scams. Recent acts of fraud include solicitations from scammers requesting payment to claim a sweepstakes prize. Anytime someone asks you to pay to obtain a prize, it is a scam. US-CERT encourages consumers to refer to the FTC Aler...

Joomla! Releases Security Update

Joomla! has released version 3.7.3 of its Content Management System CMS software to address several vulnerabilities. A remote attacker could exploit some of these vulnerabilities to take control of an affected website. US-CERT encourages users and administrators to review the Joomla! Security...

VMware Releases Security Updates

VMware has released security updates to address vulnerabilities in vSphere Data Protection. Exploitation of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review VMware Security Advisory VMSA-2017-0010 and...

IC3 Warns of Increase in BEC/EAC Schemes

The Internet Crime Complaint Center IC3 has issued an alert describing a growing number of scams targeting businesses working with foreign suppliers or businesses that regularly perform wire transfer payments. These sophisticated scams are classified as business email compromise BEC or email...

VMware Releases Security Updates

VMware has released security updates to address a vulnerability in vCenter Server. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review VMware Security Advisory VMSA-2017-0007 and apply the...

Microsoft Releases April 2017 Security Updates

Microsoft has released 61 updates to address vulnerabilities in Microsoft software. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of a system. This Security Update addresses a Microsoft Office vulnerability that is actively being exploited to spread...

Apple Releases Security Update for iOS

Apple has released a security update to address a vulnerability in iOS. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the Apple security page for iOS and apply the necessary update. This...

Microsoft Releases March 2017 Security Bulletin

Microsoft has released 18 updates to address vulnerabilities in Microsoft software. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Microsoft Security Bulletins MS17-006 through...

Cisco Releases Security Update

Cisco has released a security update to address a vulnerability in its NetFlow Generation Appliance NGA. Exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service condition. Users and administrators are encouraged to review the Cisco Security Advisory and apply...

CERT/CC Reports a Microsoft SMB Vulnerability

CERT Coordination Center CERT/CC has released information on a Server Message Block SMB vulnerability affecting Microsoft Windows. Exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service condition. No patches are currently available, but mitigations include...

Oracle Releases Security Bulletin

Oracle has released its Critical Patch Update for January 2017 to address 270 vulnerabilities across multiple products. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the Oracle...

Vulnerabilities Identified in Network Time Protocol Daemon (ntpd)

The Network Time Foundation's NTP Project has released version ntp-4.2.8p9 to address multiple vulnerabilities in ntpd. Exploitation of some of these vulnerabilities may allow a remote attacker to cause a denial-of-service condition. US-CERT encourages users and administrators to review...

Cisco Releases Security Updates for Multiple Products

Cisco has released several updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. Users and administrators are encouraged to review the following Cisco Security Advisories and apply the...

Google Releases Security Update for Chrome

Google has released Chrome version 54.0.2840.59 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of some of these vulnerabilities may allow an attacker to take control of an affected system. Users and administrators are encouraged to review the Chrome Releases page an...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in several products. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the following Cisco Security Advisories and...

Cisco Releases Security Update

Cisco has released a security update to address a vulnerability in its IOS XR Software for ASR 9001 Aggregation Services Routers. Exploitation of this vulnerability could allow an remote attacker to cause a denial-of-service condition. US-CERT encourages users and administrators to review the Cis...

Mozilla Releases Security Updates

Mozilla has released security updates to address multiple vulnerabilities in Firefox and Firefox ESR. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Available updates include: Firefox 48 Firefox ESR 45.3 Users and administrators ar...

Apple Releases Multiple Security Updates

Apple has released security updates for iTunes, Safari, tvOS, watchOS, iOS, and OS X El Captain. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Available updates include: iTunes 12.4.2 for Windows 7 and later Safari 9.1.2 for OS X...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Acrobat, Flash Player, Reader, and XMP Tookit for Java. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system Users and administrators are encouraged to review Adobe Securit...

Microsoft Releases June 2016 Security Bulletin

Microsoft has released 16 updates to address vulnerabilities in Microsoft software. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the following Microsoft Security Bulletins...

Symantec Releases Security Updates

Symantec has released security updates to address vulnerabilities in multiple products. Exploitation of some of these vulnerabilities may allow an attacker to take control of an affected system. US-CERT encourages users and administrators to review Symantec Security Advisory SYM16-009 and apply t...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in its Prime Network Analysis Module software. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the following Cisco...

Symantec Releases Security Update

Symantec has released Anti-Virus Engine 20151.1.1.4 to address a vulnerability in Symantec Antivirus products. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Symantec Security Advisory...

Google Releases Security Update for Chrome

Google has released Chrome version 50.0.2661.102 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the Chrome Releases...

OpenSSL Releases Security Updates

OpenSSL has released security updates to address vulnerabilities in previous versions. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system. Available updates include: OpenSSL 1.0.2h for 1.0.2 users OpenSSL 1.0.1t for 1.0.1 users US-CERT...

IRS Warns Taxpayers About Scams as Tax Deadline Approaches

The Internal Revenue Service IRS has issued a press release to warn of a potential increase in scams targeting taxpayers around the April 18 tax deadline. Before and after the deadline, scammers may tempt or pressure taxpayers into revealing personal information. US-CERT and IRS recommend taxpaye...

Google Releases Security Update for Chrome

Google has released Chrome version 50.0.2661.75 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the Chrome Releases...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Flash Player, Creative Cloud Desktop Application, and RoboHelp Server. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to...

Juniper Releases Update for ScreenOS

Juniper has released ScreenOS version 6.3.0r22 to address issues with encryption methods used in prior versions. US-CERT recommends that users and administrators review articles Juniper Networks Completes ScreenOS Update and Advancing the Security of Juniper Products for more information and upda...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in multiple products. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the following Cisco Security Advisories and app...

VMware Releases Security Updates

VMware has released security updates to address vulnerabilities in VMware vRealize Automation and vRealize Business Advanced and Enterprise. Exploitation of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review...

Adobe Releases Security Updates for Flash Player

Adobe has released security updates to address multiple vulnerabilities in Flash Player. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Adobe Security Bulletin APSB16-08 and app...

ISC Releases Security Updates for BIND

The Internet Systems Consortium ISC has released updates that address three vulnerabilities in BIND. Exploitation of these vulnerabilities may allow a remote attacker to cause a denial-of-service condition. Available updates include: BIND 9 version 9.9.8-P4 BIND 9 version 9.10.3-P4 BIND 9 version...

Adobe Releases Security Updates for Acrobat, Reader, and Digital Editions

Adobe has released security updates to address multiple vulnerabilities in Acrobat, Reader, and Digital Editions. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Adobe Security...

Google Releases Security Update for Chrome

Google has released Chrome version 48.0.2564.116 to address a vulnerability for Windows, Mac, and Linux. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Chrome Releases page and apply t...

OpenSSH Client Vulnerability

OpenSSH version 7.1p2 has been released to address vulnerabilities in versions 5.4 through 7.1p1. Exploitation of one of these vulnerabilities may allow a remote attacker to obtain sensitive information from an affected system. Users and administrators are encouraged to review the OpenSSH Release...

Joomla Releases Security Update for CMS

Joomla has released version 3.4.7 of its content management system CMS software to address two vulnerabilities. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected website. Users and administrators are encouraged to review the Joomla Release New...

Adobe Releases Security Updates for Flash Player

Adobe has released security updates to address multiple vulnerabilities in Flash Player. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Adobe Security Bulletin APSB15-32 and apply t...

Google Releases Security Update for Chrome

Google has released Chrome version 47.0.2526.73 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the Chrome Releases...

Dell Computers Contain CA Root Certificate Vulnerability

Dell personal computers using the preinstalled certificate authority CA root certificate eDellRoot contain a critical vulnerability. Exploitation of the vulnerability could allow a remote attacker to read encrypted web browser traffic HTTPS, impersonate spoof any website, or perform other attacks...

VMware Releases Security Updates

VMware has released security updates to address a vulnerability in vCenter, vCloud Director, and Horizon View. Exploitation of this vulnerability may allow an attacker to obtain sensitive information. Users and administrators are encouraged to review VMware Security Advisory VMSA-2015-0008 and...

ACSC Releases 2015 Threat Report

The Australian Cyber Security Centre ACSC has released its 2015 Threat Report. This report provides threat information that Australian organizations are facing, such as cyber espionage, cyber attacks, and cyber crime. Mitigation and remediation steps are also included to assist organizations with...

Microsoft Releases October 2015 Security Bulletin

Microsoft has released six updates to address vulnerabilities in Microsoft Windows. Exploitation of some of these vulnerabilities could allow an attacker to take control of an affected system. US-CERT encourages users and administrators to review Microsoft Security Bulletins MS15-106 through...

Apple Releases Security Updates for OS X El Capitan, Safari, and iOS

Apple has released security updates for OS X El Capitan, Safari, and iOS to address multiple vulnerabilities. Exploitation of some of these vulnerabilities may allow an attacker to run arbitrary code. Available updates include: OS X El Capitan 10.11 for Mac OS X v10.6.8 and later Safari 9 for OS ...

WordPress Releases Security Update

WordPress 4.3 and prior versions contain two cross-site scripting vulnerabilities and a potential privilege escalation. Exploitation of these vulnerabilities could allow a remote attacker to take control of an affected website. Users and administrators are encouraged to review the WordPress...

Adobe Releases Security Update for LiveCycle Data Services

Adobe has released a security update to address a vulnerability in LiveCycle Data Services versions 4.7, 4.6.2, 4.5, and 3.0.x. Exploitation of this vulnerability may allow a remote attacker to obtain sensitive information from an affected system. US-CERT recommends that users and administrators...

OPM Identity-Protection Phishing Campaigns

US-CERT is aware of suspicious domain names that may be used in phishing campaigns masquerading as official communication from the Office of Personnel Management OPM or the identity protection firm CSID. Https://opm.csid.com is the legitimate domain used by CSID, which is responsible for identity...

Cisco UCS Central Software Vulnerability

Cisco has released a security advisory to address a vulnerability in the web framework of Cisco Unified Computing System UCS Central Software. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to revie...