Over the weekend, Microsoft started rolling out a new software update for Windows 10 devices to enable the Retpoline mitigations against Spectre attacks. Publicly detailed in January 2018 along with Meltdown, Spectre is a side-channel attack against modern processors that impacts most modern processors, including those from Intel, AMD, and ARM. Able to bypass memory ..
Tag : Vulnerabilities
Adobe has released out-of-band updates for its ColdFusion web application development platform to address a critical vulnerability that has been exploited in the wild. The zero-day flaw, tracked as CVE-2019-7816, has been described by the vendor as a file upload restriction bypass issue that could lead to arbitrary code execution in the context of the ..
Bug bounty platform HackerOne says two of its members have each earned more than $1 million by helping organizations find and fix vulnerabilities in their systems. While many white hat hackers don’t make much money from bug bounty programs, there are some who have dedicated a lot of time to finding vulnerabilities and they have ..
A recently addressed vulnerability in the Cobalt Strike penetration testing platform could be exploited to identify attacker servers, Fox-IT security researchers reveal. The bug, which was addressed in January with the release of Cobalt Strike version 3.13, consisted of an uncommon whitespace in server responses and had been leveraged by researchers to identify Cobalt Strike ..
One of the multiple hacking groups operating under the “Magecart” umbrella has changed its tactics following a November 2018 report exposing their activity. Generically referred to as Group 4, the actor was described as the most advanced of the six groups that have been employing Magecart web skimmers at the time (the number has increased ..
Exploit detection service EdgeSpot says it has spotted several PDF documents that exploit a zero-day vulnerability in Chrome to collect information on users who open the files through Google’s web browser. EdgeSpot claims to have identified several samples in the wild. When one of the PDFs is opened with Chrome, a document is shown to ..
Researchers have disclosed the details of an attack method that can allow a malicious actor to take control of a computer and gain access to sensitive data by connecting a specially crafted device to its Thunderbolt port. The attack, dubbed Thunderclap, involves a series of vulnerabilities that can be exploited via Thunderbolt, a hardware interface ..
Many popular PDF viewers and online validation services contain vulnerabilities that can be exploited to make unauthorized changes to signed PDF documents without invalidating their signature, researchers have warned. A team of researchers from the Ruhr-University Bochum in Germany has analyzed 22 desktop applications (including their Windows, Linux and macOS versions) and 7 online validation ..
NVIDIA has released a security update for the NVIDIA GPU display driver, to address several High severity vulnerabilities impacting GeForce, Quadro, NVS, and Tesla products. A total of 8 security vulnerabilities were addressed in this round of patches, five of which have a CVSS score of 8.8. Exploitation of these bugs could lead to code ..
Malicious hackers have started exploiting a critical WinRAR vulnerability disclosed less than one week ago, just as RARLab has released the final version of the update that should patch the flaw. Researchers at Check Point Software Technologies warned on February 20 that WinRAR, a tool utilized by over 500 million users worldwide, is affected by a ..
