Support for Python Packages Added to GitHub Security Alerts

GitHub announced on Thursday that developers will be warned if the Python packages used by their applications are affected by known vulnerabilities.

http://feedproxy.google.com/~r/Securityweek/~3/jIDnUKHiZMw/support-python-packages-added-github-security-alerts

HackerOne Bug Bounty Programs Paid Out $11 Million in 2017

White hat hackers who responsibly disclosed vulnerabilities through bug bounty programs hosted by HackerOne earned more than $11 million last year, according to the company’s 2018 Hacker-Powered Security Report.

http://feedproxy.google.com/~r/Securityweek/~3/GYhwIR7fbQs/hackerone-bug-bounty-programs-paid-out-11-million-2017

Hackers Can Chain Multiple Flaws to Attack WAGO HMI Devices

Germany-based industrial automation company WAGO has patched several vulnerabilities in its e!DISPLAY 7300T Web Panel human-machine interface (HMI) products that can be chained to take control of affected devices.

http://feedproxy.google.com/~r/Securityweek/~3/NxiI433XfI8/hackers-can-chain-multiple-flaws-attack-wago-hmi-devices

Power Grid Protection Firm SEL Patches Severe Software Flaws

Several vulnerabilities, including ones rated high severity, have been discovered in management and configuration tools from power grid protection company Schweitzer Engineering Laboratories (SEL). The vendor has released software updates to address the flaws.

http://feedproxy.google.com/~r/Securityweek/~3/4FHg7OBl_cM/power-grid-protection-firm-sel-patches-severe-software-flaws

CredSSP Flaw Exposes Pepperl+Fuchs HMI Devices to Attacks

A vulnerability in the Credential Security Support Provider (CredSSP) authentication protocol has been found to impact several human-machine interface (HMI) products from Germany-based industrial automation firm Pepperl+Fuchs.

http://feedproxy.google.com/~r/Securityweek/~3/x5hNpFeIDgI/credssp-flaw-exposes-pepperlfuchs-hmi-devices-attacks

Intel Pays $100,000 Bounty for New Spectre Variants

Researchers have discovered new variations of the Spectre attack and they received $100,000 from Intel through the company’s bug bounty program.

The new flaws are variations of Spectre Variant 1 (CVE-2017-5753) and they are tracked as Spectre 1.1 (CVE-2018-3693) and Spectre 1.2.

http://feedproxy.google.com/~r/Securityweek/~3/YwMGIUjAhAA/intel-pays-100000-bounty-new-spectre-variants

Microsoft Patch Tuesday Updates Fix Over 50 Vulnerabilities

Microsoft’s Patch Tuesday updates for July 2018 address more than 50 vulnerabilities, but none of them appear to have been exploited for malicious purposes before the fixes were released.

http://feedproxy.google.com/~r/Securityweek/~3/qGmlW6QNvoQ/microsoft-patch-tuesday-updates-fix-over-50-vulnerabilities

Hide ‘N Seek IoT Botnet Can Infect Database Servers

The <span style="font-size: 11pt; color: #0563c1; background-color: transparent; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; -webkit-text-decoration-skip: none; vertical-align: baseline; white-space: pre-wr

http://feedproxy.google.com/~r/Securityweek/~3/fmd_3nuMfHo/hide-n-seek-iot-botnet-can-infect-database-servers

Over 100 Vulnerabilities Patched in Adobe Acrobat, Reader

Adobe on Tuesday released security updates that patch 105 vulnerabilities in Acrobat and Reader, two in Flash Player, three in Experience Manager, and three in Connect.

http://feedproxy.google.com/~r/Securityweek/~3/zi1gg-AVZt8/over-100-vulnerabilities-patched-adobe-acrobat-reader

Intel Patches Security Flaws in Processor Diagnostic Tool

Intel has updated its Processor Diagnostic Tool to address vulnerabilities that could lead to arbitrary code execution and escalation of privileges.

http://feedproxy.google.com/~r/Securityweek/~3/w0LPrzJ5u3c/intel-patches-security-flaws-processor-diagnostic-tool