2015
D-Link Pushes Firmware Updates for Vulnerable Routers
D-Link has begun to push out firmware updates for some of its home routers, to address three separate vulnerabilities that could allow remote code in…
Microsoft confirms Windows vulnerable to FREAK attack
The serious HTTPS FREAK exploit was thought to only affect Android, iOS, and MacOS, but Microsoft has confirmed that it also affects all supported ve…
phpMoAdmin MongoDB GUI affected by a Zero-Day Remote Code Execution flaw
Security experts are alerting on the availability in the underground black market of a zero day exploit for a vulnerability in the phpMoAdmin MongoDB…
Google Fixes 51 Vulnerabilities With Release of Chrome 41
Chrome 41 is available for download. The latest version of Google’s Web browser brings new apps and extension APIs, stability and performance improve…
‘FREAK’ - New SSL/TLS Vulnerability Explained
Another new widespread and disastrous SSL/TLS vulnerability has been uncovered that for over a decade leftMillions of users of Apple and Android devi…
Blu-ray exploits could allow computer malware infection
Stephen Tomkinson, a security researcher for NCC, presented his research at the Securi-Tay conference at Abertay Univeristy in Scotland on Friday. At…
Seagate NAS affected by a Remote Code Execution zero-day vulnerability
A security expert discovered a Remote Code Execution zero-day vulnerability in Seagate Network Attached Storage (NAS) systems.
Network Vision Fixes Code Injection Vulnerability in IntraVUE Software
Organizations that use the IntraVUE network visualization software from Network Vision are advised to update their installations as soon as possible …
Steam Community phishing attacks continue unabated
Phishers are still using look-alike domain names to steal Steam credentials from unsuspecting victims, which suggests that this approach is proving r…
1Tbps over 5G mobile connection could be used for (D)DoS
Record breaking data speed of 1Tbps over 5G mobile network was reached at the university 5G Innovation Centre in Great Britain. This speed is far fas…
Vulnerable plugin in Wordpress
In Wordpress plugin Slimstat in versions prior to 3.9.6. was detected a vulnerability. A "secret" key which is used to sign data send to and from the…
New Samba vulnerability
There is new vulnerability in Samba, that can be exploited by malicious Samba client by sending specially crafted packets to the Samba server. Codes …
Super-fish is bigger than we thought
Malware Super-fish that was found to be pre-installed on Lenovo laptops is more widespread that we though. The same HTTS-breaking technology that gav…
Android Malware Can Spy On You Even When Your Mobile Is Off
Security researchers have unearthed a new Android Trojan that tricks victims into believing they have switched their device off while it continues "s…
BIND Security Update Fixes Server Crash Flaw
The Internet Systems Consortium (ISC) has released security updates to address a medium-severity vulnerability in BIND, the most widely used Domain N…
Visa Wants To Track Your Smartphone to Prevent Credit Card Fraud
The payment processing and credit card giant Visa has came forward to put an end to this problem by letting cardholders the chance to buy things wher…
A critical flaw in NetGear routers exposes them to cyber attacks
The researcher Peter Adkins discovered that several wireless routers produced by Netgear are affected by serious vulnerability that could allow an un…
Google Play, Browser Flaws Expose Android Devices to Remote Code Execution
Vulnerabilities plaguing Google Play and some Android Web browsers can be exploited by an attacker to remotely execute arbitrary code on smartphones,…
Phishing campaign is targeting Apple iCloud users to steal financial data
Security experts at Sophos spotted a new phishing campaign targeting iCloud users. The attackers are interested in the victims’ financial data.
Memex – The new search tool to dig also in the "Deep Web"
DARPA has publicly presented for the first time a new set of search tools called Memex which will improve also researches into the “Deep Web”.
Researcher Publishes 10 Million Usernames and Passwords
In an effort to contribute to making authentication more secure, a researcher has decided to publish 10 million username/password combinations that h…
Seven Best WordPress Security Plugins
In this post, I will discuss various security plugins available for WordPress. These security plugins offer a wide range of features to make your Wor…
Facebook Tag Scam Spreads like Wildfire, New Tactics Emerge
Two weeks ago, we wrote about the re-emergence of tag scams on Facebook. What seemed to be a basic worm at that time turned into inspiration for mult…
Zero-Day Flaw in WordPress Plugin Used to Inject Malware into Sites
Cybercriminals have exploited a zero-day flaw in the popular FancyBox for WordPress plugin to inject malicious iframes into many websites. The vulner…
Adobe Flash Player Security Update Fixes 18 Vulnerabilities
Adobe has released Flash Player security updates that address a total of 18 vulnerabilities, most of which could be exploited for arbitrary code exec…
Flash Player faces its third zero-day flaw in a month, updates coming
Adobe Systems warned users that hackers are exploiting another unpatched vulnerability in Flash Player -- the third one in the past month -- to infec…
Serious security issues in iOS Outlook app Microsoft to access user emails and credentials
A researcher has discovered a series of security issues in the newborn iOS Outlook app that allows Microsoft to access user emails and credentials.
WordPress Can Be Used to Leverage Critical Ghost Flaw in Linux
The vulnerability revealed by security researchers at Qualys, who dubbed it Ghost, this week could be taken advantage of through WordPress or other P…
A singular Facebook Trojan has already infected nearly 110,000 Facebook users
Security researcher is investigating in a new strain of Facebook Trojan that in just two days has already infected 1110,000 Facebook users.
D-Link routers vulnerable to DNS hijacking
At least one and likely more D-Link routers as well as those of other manufacturers using the same firmware are vulnerable to remote changing of DNS …
Critical glibc update (CVE-2015-0235) in gethostbyname() calls
A heap-based buffer overflow was found in glibc's __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() gl…
Facebook Tag Scams are Back with Malicious Payload
Bad week-end for Facebook users: a malicious tagging campaign ended up infecting at least 5 thousand computer users with a backdoor. This three-day c…
PHP 5 Updates Fix Several Vulnerabilities
Several security vulnerabilities affecting PHP were addressed last week with the release of versions 5.6.5, 5.5.21 and 5.4.37.
Click-fraud malware drives millions of views to YouTube videos
Scammers are earning advertising revenue by spreading click-fraud malware Tubrosa, which sends compromised computers to their YouTube videos.
Three OS X Vulnerabilities Disclosed by Google
The details of three high-severity vulnerabilities affecting Apple’s OS X operating system have been disclosed over the past two days by Google.
If you use either of these WordPress themes update them now
Version 1.4.6 of the PageLines theme and version 1.4.4 of the Platform theme were released three days ago and contain fixes for very serious vulnerab…
GoDaddy Vulnerability Allows Domain Hijacking
An Internet domain registrar and web hosting company GoDaddy has patched a Cross-Site Request Forgery (CSRF or XSRF) vulnerability that allowed hacke…
Ubuntu patched several security vulnerabilities
Ubuntu has released several patches for security vulnerabilities in different versions of the OS, including some CSRF, DoS and remote code execution …
New Angler exploit kit includes a Flash zero-Day
The French security expert Kafeine has discovered an unpatched vulnerability (0day) in Flash Player is being exploited by Angler Exploit Kit.
Google Fixes 62 Security Bugs With Release of Chrome 40
Google announced on Wednesday the release of Chrome 40 for Windows, Mac OS and Linux. The latest update for the popular Web browser (40.0.2214.91) in…
Instagram Patches flaw that Makes Private Photos Visible
Your Instagram is not as Private as You Think. Millions of private Instagram photos may have been exposed publicly on the web until the company patch…
Peerio - End-to-End Encrypted Secure Messenger and File Sharing App
On one end, where governments of countries like Russia is criticizing end-to-end encryption and considering to ban the encrypted communication apps l…
KL-Remote toolkit allows criminals to easily hack online banking accounts
Researchers at IBM Trusteer discovered a new toolkit dubbed KL-Remote that allows criminals to run Remote Overlay Attacks without specific skills.
Apache Fixes DoS Flaw in Qpid Messaging System
A vulnerability in Apache Qpid, the open source messaging system that implements the Advanced Message Queuing Protocol (AMQP), can be exploited by an…
Mozilla Fixes 9 Vulnerabilities in Firefox 35
Mozilla released Firefox 35 on Tuesday. In addition to new features, changes and fixes, the latest version of the popular Web browser addresses sever…
Skeleton Key Malware modifies the Active Directory authentication process
Dell SecureWorks detected the Skeleton Key malware, which modifies authentication process on Active Directory (AD) systems protected by only password…
GE Multilink Switches affected by critical vulnerabilities
GE MultiLink managed switches are affected by two vulnerabilities which could be exploited to gain unauthorized access and run DoS attacks on the dev…
Linux DDoS Trojan embeds RootKit component
Security experts at Avast have analyzed a new strain of DDoS trojan targeting Linux operating system dubbed XOR.DDoS which embeds a RootKit component…
ASUS Routers Plagued by Command Execution Vulnerability
Many ASUS wireless routers are affected by a vulnerability that can be exploited by an attacker with access to the target’s local area network (LAN) …
Android Manifest File Attacks Can Make Devices Inoperable
Researchers at Trend Micro have identified a vulnerability related to the Android manifest file that can be exploited to cause devices to crash.