An 18-year-old researcher has earned more than $36,000 from Google after finding a critical remote code execution vulnerability related to the Google App Engine. Part of the Google Cloud offering, the App Engine is a framework that allows users to develop and host web applications on a fully managed serverless platform. read more http://feedproxy.google.com/~r/Securityweek/~3/8dPtymxp0nY/researcher-earns-36000-google-app-en..
Tag : Vulnerabilities
The Drupal websites hacked by cybercriminals using the vulnerabilities known as Drupalgeddon2 and Drupalgeddon3 deliver cryptocurrency miners, remote administration tools (RATs) and tech support scams. read more http://feedproxy.google.com/~r/Securityweek/~3/GLJhaaWRtnI/hacked-drupal-sites-deliver-miners-..
Updates announced on Friday by the Internet Systems Consortium (ISC) for BIND, the most widely used Domain Name System (DNS) software, patch a couple of vulnerabilities. While attackers may be able to exploit both of the flaws remotely for denial-of-service (DoS) attacks, the security holes have been assigned only a “medium” severity rating. read more ..
Enlarge (credit: Lisa Cooper / Flickr) It’s not every day someone develops a malware attack that, with one click, exploits separate zero-day vulnerabilities in two widely different pieces of software. It’s even rarer that a careless mistake burns such a unicorn before it can be used. Researchers say that’s precisely happened to malicious PDF document ..
A misconfigured server operated by CalAmp, a company offering the backend for a broad range of well-known car alarm systems, provided anyone with access to data and even allowed for account and vehicle takeover. read more http://feedproxy.google.com/~r/Securityweek/~3/jJikif00LKI/misconfigured-calamp-server-enabled-vehicl..
Cisco has found and patched three critical unauthorized access vulnerabilities in its Digital Network Architecture (DNA) platform. Cisco DNA is a solution that helps enterprises automate network operations, making it easy to design, provision and apply policies across their environments. read more http://feedproxy.google.com/~r/Securityweek/~3/a5S51Ivf0VA/critical-flaws-cisco-dna-center-allow-unauthori..
Taiwan-based industrial automation company Advantech has released an update for its WebAccess product to address nearly a dozen vulnerabilities, including critical flaws that allow arbitrary code execution. read more http://feedproxy.google.com/~r/Securityweek/~3/5gct7uuOObM/critical-code-execution-flaws-patched-advantech..
Siemens informed customers on Tuesday that some of its SIMATIC S7-400 CPUs are affected by a high severity denial-of-service (DoS) vulnerability. read more http://feedproxy.google.com/~r/Securityweek/~3/Re8bixLPaAk/severe-dos-flaw-discovered-siemens-si..
Open source components have been increasingly used by developers, but failure to patch vulnerabilities in this type of software can pose serious risks. read more http://feedproxy.google.com/~r/Securityweek/~3/jKAHq0xaJJQ/flaws-open-source-components-pose-increasing-risk-..
An update released over the weekend for the desktop version of the privacy-focused communications app Signal patches a critical vulnerability that could have been exploited for remote code execution with no user interaction required. read more http://feedproxy.google.com/~r/Securityweek/~3/yx507hjkDP4/signal-flaw-allowed-code-execution-no-user-i..
