Articles about vulnerabilities

Pic: Shutterstock

Drive-by web nasty unmasks Tor Browser users, Mozilla dashes to patch zero-day vuln

Updated Mozilla is scrambling to patch a vulnerability in Firefox that is apparently being exploited in the wild to unmask Tor Browser users. Earlier today, a small package of SVG, JavaScript and x86 code popped up on a Tor mailing list that, when opened by Firefox or Tor Browser on a Windows PC, phones home to a remote server and …
Darren Pauli, 30 Nov 2016
Image by rudall30 http://www.shutterstock.com/gallery-573151p1.html

Microsoft update servers left all Azure RHEL instances hackable

Microsoft has patched flaws that attackers could exploit to compromise all Azure Red Hat Enterprise Linux (RHEL) instances. Software engineer Ian Duffy found the flaws while building a secure RHEL image for Microsoft Azure. During that process he noticed an installation script Azure uses in its preconfigured RPM Package …
Darren Pauli, 28 Nov 2016
Image by Maythee Voran https://www.shutterstock.com/gallery-3935591p1.html

Poison .JPG spreading ransomware through Facebook Messenger

Checkpoint has found an image obfuscation trick it thinks may be behind a recent massive phishing campaign on Facebook that's distributing the dangerous Locky ransomware. The security firm has not released technical details as the flaw it relies on still impacts Facebook and LinkedIn, among other unnamed web properties. The …
Darren Pauli, 25 Nov 2016

WordPress auto-update server had flaw allowing anyone to add anything to websites worldwide

Up to a quarter of all websites on the internet could have been attacked through a since-patched vulnerability that allowed WordPress' core update server to be compromised. The since-shuttered remote code execution flaw was found in a php webhook within api.wordpress.org that allows developers to supply a hashing algorithm of …
Darren Pauli, 23 Nov 2016

Gone in 70 seconds: Holding Enter key can smash through defense

Attackers with a little more than a minute to spare can get their foot in the door on Linux boxes by holding down the Enter key for 70 seconds – an act that gifts them a root initramfs shell. The simple exploit, which requires physical access to the system, exists due to a bug in the Linux Unified Key Setup (LUKS) used in …
Team Register, 16 Nov 2016

Hackers cook god-mode remote exploits against Edge, VMware in world-first

Power of Community Hackers have twice completely compromised Microsoft Edge operating on Windows 10 Red Stone 1 and for the first time twice broken VMWare Workstation without user interaction. The bugs landed via SYSTEM-level remote code execution while the second VMware hacks could also be performed remotely. The four hacks were demonstrated …
Darren Pauli, 10 Nov 2016

Cisco's job applications site leaked personal data

Cisco has fixed a vulnerability in its Professional Careers portal that may have exposed truckloads of personal information. The networking giant has sent an email to affected users in which it says a "limited set of job application related information" was leaked from the mobile version of the website, blaming an "incorrect …
Darren Pauli, 6 Nov 2016

Universal hijack hole turns DIY Wix blogs into botnets

Millions of do-it-yourself websites built with the Wix web maker were at risk of hijack thanks to a brief zero day DOM-based cross-site scripting vulnerability. Wix boasts some 87 million users, among them two million paying subscribers. Contrast Security researcher Matt Austin (@mattaustin) dug up the flaw he rates as severe …
Darren Pauli, 3 Nov 2016

Vuln hunter finds nasty shared server god mode database hack holes

Dangerous since-patched vulnerabilities in MySQL, MariaDB, and Percona's Server and XtraDB Cluster have been found that, when chained, allow attackers in shared environments complete compromise of servers. The database servers are among the world's most popular and count all major tech giants as customers including Google and …
Darren Pauli, 3 Nov 2016

Multiple RCE flaws found in Memcached web speed tool

A remote code execution vulnerability in popular website backend performance tool Memcached has been found and squashed. Cisco penetration tester Aleksandar Nikolich reported three remote code execution holes in the tool used by big name sites including Facebook, Twitter, YouTube, and Reddit to help decrease database burdens …
Darren Pauli, 2 Nov 2016

130 serious Firefox holes plugged this year

Mozilla has shuttered more than 130 serious vulnerabilities reported by community hackers this year. The browser-backing outfit announced the statistics in a post covering its bug bounty program and broader information security efforts. More than 500 million users ran Firefox at the close of 2015. It's since become the world' …
Darren Pauli, 30 Oct 2016

PayPal patches bone-headed two factor authentication bypass

Update Paypal has patched a boneheaded two factor authentication breach that allowed attackers to switch off the critical account control in minutes by changing a zero to a one. British MWR InfoSecurity consultant Henry Hoggart (@_mobisek) discovered and quietly reported the flaw to the payment giant. Attackers with username and …
Darren Pauli, 27 Oct 2016

Joomla! squashes critical privileged account creation holes

Joomla! has revealed it's patched twin critical flaws allowing attackers to bypass rules and create elevated privilege accounts. Project staff warned of the looming patch this week asking administrators to prepare for the patch and apply it immediately. The Joomla! security strike team said at the time only that a hole …
Darren Pauli, 27 Oct 2016

Joomla! readies patch for core vulnerability so critical it isn't talking

The world's second-favourite content management system, Joomla!, is warning of a critical security hole so bad its developers aren't saying what it fixes. The Register understands a patch for the mystery hole will take the name of version 3.6.4 and will be published around 1400 UTC today, October 25th. Joomla! has been …
Darren Pauli, 25 Oct 2016
Gerhard Klostermeier. Image: Darren Pauli, The Register.

Hackers pop top 'secure' wireless keyboard and mouse kits, gain RCE

Ruxcon Wireless keyboard and mouse manufacturers including Microsoft, Fujitsu, and Logitech have been forced to fix borked encryption in peripherals that allow physical attackers to hijack computers. Researchers and phDs Gerhard Klostermeier and Matthias Deeg with Germany-based security firm SySS tested five devices badged as secure …
Darren Pauli, 24 Oct 2016

Slack whacks global account hijack holes

Hipster collaboration platform Slack has shuttered an access control bypass that allowed users to hijack any account. The flaws reported by security researcher David Viera-Kurz lay in twin path traversal and access control bypasses. Slack paid Viera-Kurz US$9000 for privately reporting two flaws under its bug bounty program …
Darren Pauli, 21 Oct 2016

Dirty COW explained: Get a moooo-ve on and patch Linux root hole

Code dive Patch your Linux-powered systems, phones and gadgets as soon as possible, if you can, to kill off a kernel-level flaw affecting nearly every distro of the open-source operating system. Dubbed Dirty COW, the privilege-escalation vulnerability potentially allows any installed application, or malicious code smuggled onto a box, …
Shaun Nichols, 21 Oct 2016

Reading this? Then you can pop root shells on Markvision enterprises

Lexmark has patched two dangerous vulnerability in its Markvision enterprise IT analysis platform that grants remote attackers god-mode system access over the internet. The platform is used by tech shops to manage thousands of devices. Researchers with San Antonio based securtity consultancy Digital Defence reported the twin …
Darren Pauli, 20 Oct 2016

Create a news alert about vulnerabilities, or find more stories about vulnerabilities.

Biting the hand that feeds IT © 1998–2018