Industry Sharing Feeds, A Step in the Right Direction but Not Enough

Flintstones Chewable Vitamins were among the first multivitamins for kids, and when I was growing up they were all the rage. Today, many adults continue the practice of taking a multivitamin. To get a dietary supplement more tailored to our needs we can choose a formula designed for women or men, for people over 50, or for bone, eye, heart health, etc. This approach gets us part of the way to reaching our goals, but it isn’t tailored to exactly what we need.

http://feedproxy.google.com/~r/Securityweek/~3/pu4oGGlsI0w/industry-sharing-feeds-step-right-direction-not-enough

Microsoft Releases Intel Microcode Patches for Foreshadow Flaws

Microsoft this week made available another round of microcode updates created by Intel for mitigating the recently disclosed speculative execution vulnerabilities tracked as Foreshadow and L1 Terminal Fault (L1TF).

http://feedproxy.google.com/~r/Securityweek/~3/Jg32e794ixc/microsoft-releases-intel-microcode-patches-foreshadow-flaws

Unpatched Ghostscript Vulnerabilities Impact Popular Software

Ghostscript Impacted by Multiple -dSAFER Sandbox Bypass Vulnerabilities

http://feedproxy.google.com/~r/Securityweek/~3/hfAHdSiTbmA/unpatched-ghostscript-vulnerabilities-impact-popular-software

Critical Apache Struts 2 Flaw Allows Remote Code Execution

Updates released on Wednesday for the Apache Struts 2 open source development framework address a critical vulnerability that can be exploited for remote code execution.

The flaw, tracked as CVE-2018-11776, affects Struts 2.3 through 2.3.34, Struts 2.5 through 2.5.16, and possibly unsupported versions of the framework.

http://feedproxy.google.com/~r/Securityweek/~3/OKcyhqelPSw/critical-apache-struts-2-flaw-allows-remote-code-execution

Adobe Patches Critical Code Execution Flaws in Photoshop

Adobe late on Tuesday released updates for the Windows and macOS versions of Photoshop CC to address two critical remote code execution vulnerabilities.

http://feedproxy.google.com/~r/Securityweek/~3/-BS44qsx7aA/adobe-patches-critical-code-execution-flaws-photoshop

Flaws in Emerson Workstations Allow Lateral Movement

Researchers working for two industrial cybersecurity firms have discovered several critical and high severity vulnerabilities in Emerson DeltaV DCS Workstations. The vendor has released patches that should resolve the flaws.

http://feedproxy.google.com/~r/Securityweek/~3/nFfpyDIX1Pg/flaws-emerson-workstations-allow-lateral-movement

North Korean Hackers Exploit Recently Patched Zero-Day

North Koren hackers are exploiting a recently patched vulnerability in Microsoft’s VBScript engine vulnerability <span style="color: #000000; background-color: transparent; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; tex

http://feedproxy.google.com/~r/Securityweek/~3/ec6AD0HR1Ug/north-korean-hackers-exploit-recently-patched-zero-day

NCC Group Releases Open Source DNS Rebinding Attack Tool

Cyber security and risk mitigation company NCC Group has released a new open source tool designed to make it easier for penetration testers and others to perform DNS rebinding attacks.

http://feedproxy.google.com/~r/Securityweek/~3/zuR-YivPXlw/ncc-group-releases-open-source-dns-rebinding-attack-tool

Industry Reactions to Foreshadow Flaws: Feedback Friday

Researchers and several major tech companies this week disclosed the details of three new speculative execution side-channel vulnerabilities affecting Intel processors.

http://feedproxy.google.com/~r/Securityweek/~3/khgu5LTC3io/industry-reactions-foreshadow-flaws-feedback-friday

Google Bug Bounty Program Now Covers Platform Abuse

Google on Wednesday announced the expansion of its bug bounty program to include techniques that can be used to bypass the company’s abuse detection systems.

http://feedproxy.google.com/~r/Securityweek/~3/hncZqE7-L94/google-bug-bounty-program-now-covers-platform-abuse