Okta Rex (Research and Exploitation) researcher Josh Pitts has discovered a method of exploiting the code signing mechanism in MacOS. If exploited, the flaw could allow malicious untrusted code to masquerade as legitimate trusted code and bypass checks by other security software.
http://feedproxy.google.com/~r/Securityweek/~3/cYM7VCPOQT0/code-signing-flaw-affects-all-mac-os-versions-2005
Crestron recently addressed a command injection vulnerability in the console service preinstalled on the Digital Graphics Engine 100 (DGE-100) and other hardware controllers made by the company.
http://feedproxy.google.com/~r/Securityweek/~3/OzwHhN1BBro/crestron-patches-command-injection-flaw-dge-100-controller
An ActiveX zero-day vulnerability discovered recently on the website of a South Korean think tank focused on national security has been abused by the North Korean-linked Lazarus group in attacks, AlienVault reports.
http://feedproxy.google.com/~r/Securityweek/~3/jZNoAcJe1d8/north-korean-hackers-abuse-activex-recent-attacks
VMware has addressed a critical remote code execution vulnerability in the AirWatch Agent applications for Android and Windows Mobile.
The VMware Workspace ONE platform, which is powered by AirWatch unified endpoint management (UEM) technology, is designed to help organizations manage corporate endpoints and improve enterprise productivity.
http://feedproxy.google.com/~r/Securityweek/~3/EKqvufnif8o/vmware-patches-code-execution-flaw-airwatch-agent
Researchers discovered several critical vulnerabilities in door communication systems made by Switzerland-based industrial tech company ABB. Both patches and workarounds have been made available by the vendor.
http://feedproxy.google.com/~r/Securityweek/~3/6Z4u-NSS9Fo/critical-flaws-expose-abb-door-communication-systems-attacks
Many vendors ship Android devices with the Android Debug Bridge (ADB) feature enabled, thus rendering them exposed to various attacks, security researcher Kevin Beaumont has discovered.
http://feedproxy.google.com/~r/Securityweek/~3/b3OyN2r_vLs/many-android-devices-ship-adb-enabled
http://feedproxy.google.com/~r/Securityweek/~3/ZkwzMtTlsc4/hackers-can-hijack-sink-ships-researchers
Cisco informed customers this week that it has patched one critical and five high severity vulnerabilities in Prime Collaboration Provisioning (PCP), a web-based provisioning solution that allows organizations to manage their communications services.
http://feedproxy.google.com/~r/Securityweek/~3/XpF-r7i-Nrk/cisco-patches-severe-vulnerabilities-prime-collaboration-provisioning
The Drupal Security Team has refuted reports that at least 115,000 websites are still vulnerable to Drupalgeddon2 attacks, arguing that the methodology used by the researcher who announced that number is flawed.
http://feedproxy.google.com/~r/Securityweek/~3/7L9Sw784qm4/drupal-refutes-reports-115000-sites-still-affected-drupalgeddon2
Facebook acknowledged Thursday a software glitch that changed the settings of some 14 million users, potentially making some posts public even if they were intended to be private.
http://feedproxy.google.com/~r/Securityweek/~3/LVCO-DXvYzE/facebook-admits-privacy-settings-bug-affecting-14-million-users