A vulnerability patched recently in the Drupal content management system (CMS) has been exploited in the wild to deliver cryptocurrency miners and other payloads. The attacks started just three days after a fix was released. The flaw, tracked as CVE-2019-6340, is caused by the lack of proper data sanitization in some field types and it ..
Tag : Vulnerabilities
Malicious actors could plant firmware backdoors on bare metal cloud servers and use them to disrupt applications, steal data, and launch ransomware attacks, firmware security company Eclypsium warned on Tuesday. Bare metal cloud services provide organizations the hardware needed to run their applications, without providing a hypervisor. Unlike in the case of other types of ..
The Face ID and Touch ID authentication feature introduced recently to WhatsApp for iOS can be easily bypassed, but a patch has been released. An update rolled out in early February for the iOS version of WhatsApp introduced a new feature that allows users to lock the application on their iPhone using the smartphone’s Face ..
A researcher says he has discovered yet another critical cross-site scripting (XSS) vulnerability in Yahoo Mail. The recently patched flaw could have been exploited to steal the targeted user’s emails and attach malicious code to their outgoing messages. Jouko Pynnönen of Finland-based software company Klikki Oy discovered the first stored XSS vulnerability in Yahoo Mail ..
reader comments 32 with 28 posters participating Share this story Millions of sites that run the Drupal content management system run the risk of being hijacked until they’re patched against a vulnerability that allows hackers to remotely execute malicious code, managers of the open source project warned Wednesday. CVE-2019-6340, as the flaw is tracked, stems ..
Cisco this week released patches for more than a dozen vulnerabilities across its product portfolio, including high severity flaws in HyperFlex, Prime Infrastructure, and Prime Collaboration Assurance. Two High risk security bugs were addressed in HyperFlex software, namely a command injection issue in the cluster service manager of the application, and an unauthenticated root access ..
Adobe on Thursday released a second fix for the Reader vulnerability tracked as CVE 2019-7089 after the researcher who discovered the flaw managed to bypass the first patch. The security hole, identified by Alex Inführ from Cure53, allows a specially crafted PDF document to send SMB requests to the attacker’s server when the file is ..
Microsoft informed users on Wednesday that Windows servers running Internet Information Services (IIS) are vulnerable to denial-of-service (DoS) attacks that rely on malicious HTTP/2 requests. According to the tech giant, sending specially crafted HTTP/2 requests can cause the machine’s CPU to temporarily spike to 100% until IIS kills the malicious connections. “The HTTP/2 specification allows ..
WinRAR, the popular data compression tool utilized by over 500 million users worldwide, is affected by a serious vulnerability that can allow arbitrary code execution through specially crafted ACE archives. Tests conducted by researchers at Check Point Software Technologies using the WinAFL fuzzer led to the discovery of a security bug in the unacev2.dll library ..
Security updates released on Wednesday for the Drupal content management system (CMS) patch a “highly critical” vulnerability that can be exploited for remote code execution. The security hole, tracked as CVE-2019-6340, is caused by the lack of proper data sanitization in some field types, which, in some cases, can allow an attacker to execute arbitrary ..
