Category Archives: Vulnerabilities
Mozilla patches zero-day flaw in Firefox
Mozilla the makers of Firefox has issued a zero-day security update for Firefox and Firefox Extended Support Release, which were found to contain an actively exploited flaw in the IonMonkey JIT compiler.
What is known
“Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion,” they stated in the official advisory posted by Mozilla, citing the two elements as StoreElementHole and FallibleStoreElmenet. “We are aware of targeted attacks in the wild abusing this flaw.”
Announced January 8, 2020
Impact: critical
Products: Firefox, Firefox ESRFixed in
- Firefox 72.0.1
- Firefox ESR 68.4.1
Designated CVE-2019-17026, the zero-day bug was reported by researchers at Qihoo 360 ATA. The problem has been fixed with the latest release of Firefox 72.0.1 and Firefox ESR 68.4.1
No other details have been provided by firefox. Click here to Download Latest Firefox Software to patch the zero-day flaw.
… Read the rest
Android Phones Vulnerable Due To Pulse Secure VPN
Hackers are exploiting existing vulnerabilities in Pulse Secure VPN and Android Phones. The flaw tracked as CVE-2019-1150, has been rated ‘Highly’ critical. This arbitrary read file vulnerability affects multiple versions of Pulse Connect Secure and Pulse Policy Secure. This flaw allows remote attackers to connect via HTTPS to an enterprise network without the requirement of any valid username or password.
Attackers can use the flaw to view logs and files, turn-off multifactor authentication, download arbitrary files and execute malicious code on enterprise networks.
Good News is Pulse Secure has released a security update to address the issue and users are urged to apply the patches immediately to mitigate such attacks.
- Automating System Updates with Unattended-Upgrades on Ubuntu
- How to Add a Large Disk Partition as Storage in Proxmox VE
- How to Remove Radmin Viewer with PowerShell
- How to Automate Ubuntu Server System Updates and Package Installation
- Introducing Zevonix: Your Pathway
WordPress 5.3.1 patches four security vulnerabilities
WordPress has pushed out version 5.3.1 patching four security issues.
WordPress versions 5.3 and earlier contain a few vulnerabilities and the WordPress is recommending users that utilize WordPress to download the the latest version. This is a short-cycle maintenance release and soon will be superseded by a full update when version 5.4 is released.
WordPress did not make note of any CVEs, but they did say in a PUBLIC MESSAGE that the vulnerabilities included contained an issue where a unprivileged user could make a post sticky via the REST API; an problem where cross-site scripting (XSS) could be stored in well-crafted links; a stored XSS vulnerability using block editor content and the fix also hardens wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute.
- Automating System Updates with Unattended-Upgrades on Ubuntu
- How to Add a Large Disk Partition as Storage in Proxmox VE
- How to Remove Radmin
A Simple But Strong Cyber Security Strategy
It’s quite a task having to protect a small business from online dangers. The threats that can come across your network are vast and in order to avoid them you should consider having a Simple But Strong Cyber Security Strategy.
You don’t have to know much about this topic to know that you absolutely need some sort of cyber security. Here are some Simple But Strong Cyber Security Strategy steps that you can follow in order to protect your small business while still educating yourself and employees about the matter.
Install the latest antivirus software
One of the most important things to have is a business class antivirus software. The antivirus software you use to protect your small business files should always be kept up to date and active on every computer used by your employees within your office space and you should also consider protecting computers that access the … Read the rest
Signs your Android phone may have a Virus or other Malware
Here are some signs your Android phone may have a virus or malware. Remember while the external damage is usually visible, internal damage is usually hidden from view.
Android Malware like virus is known to perform repeated tasks that can take up resources on your devices. Signs of Android malware may show up in these ways.
- Your phone is too slow.
- Apps take longer to load.
- The battery drains faster than expected.
- There is an abundance of pop-up ads.
- Your phone has apps you don’t remember downloading.
- Unexplained data usage occurs.
- Higher phone bills arrive.
How to remove viruses and other malware from your Android device
- Power off the phone and reboot in safe mode. Press the power button to access the Power Off options. Most Android phones come with the option to restart in Safe Mode. Here’s how, according to Google, although Safe Mode can vary by phone: Press
Morons Use Public Wifi!
Well as the title implies, Morons Use Public WiFi! Sorry, not Sorry. I am getting straight to the point and ripping off the band-aid. You are a moron if you use public WiFi and its probably not your fault but this day in age there is no excuse and these 7 reasons below will tell you why you should stay off Public WiFi.
1. The Man-in-the-middle Attack
One of the most common types of Wi-Fi security threats is the man-in-the-middle attack. This is where hackers intercepts data through techniques to eavesdrop on you. The hackers will intercept and relay messages between two different points which makes it appear everything is normal, but in reality, the attacker is controlling the entire communication.
2. Attack cloning
Here is a simple and one of my favorite tricks. The hackers would divert your internet traffic to a cloned site. The technical term for this … Read the rest
Hackers Using Discord to Steal Your Information With Malware
Researchers found that Hackers are injecting malware into Discord to steal your information. The Windows Discord application functionality is based on HTML, CSS, and JavaScript. This allows malware to modify its core files so that the client executes malicious behavior on startup.
This Discord malware is targeting data that can be obtained from the chatting platform itself:
- details about the Discord version used;
- the browser user agent;
- first 50 characters out of the victims’ Windows clipboard;
- zoom factor;
- stored payment information;
- username;
- email address;
- phone number;
- a public IP address;
- a local IP address;
- screen resolution;
- timezone;
- Discord user token.
How to check if you are infected
Checking if your Discord client has been modified is very easy as the targeted files normally have only one line of code in them.
To check the %AppData%\Discord\[version]\modules\discord_modules\index.js simply open it in Notepad and it should only contain the single line of “module.exports … Read the rest
Keeping Windows 7 Will Put Companies And Users At Risk
Keeping Windows 7 will put Companies and users at risk if they do not move onto Windows 10. Microsoft will terminate support for Windows 7 on January 14, 2020 and this is coming up quickly there is not much time.
It’s not just Windows 7 and Windows Server 2008 that are approaching the end of life. This table shows you the Microsoft products that are approaching the end of life.
| Operating System | End of life date |
| Windows 7 | January 14th 2020 |
| Windows Server 2008 | January 14th 2020 |
| Office 2010 | October 13th 2020 |
| Windows Server 2012 | January 10th 2023 |
| Windows 8 / 8.1 | January 10th 2023 |
| Office 2013 | April 11th 2023 |
| Windows 10 | October 14th 2025 |
| Office 2016 | October 14th 2025 |
What is end of life?
Products go through life cycles and as a company produces a new version of software the one it replaces heads towards end of life. When … Read the rest
Apple iTunes Bug Exploited To Deliver Ransomware
The Hackers have been exploiting the “unquoted path” flaw in the Bonjour updater in iTunes for Windows to deliver BitPaymer/iEncrypt ransomware.
The Researchers from Morphinsec Labs have identified this flaw with Bonjour updater back in August the team from Morphisec immediately disclosed the vulnerability to Apple. Apple has recently patched the flaw for Windows. Windows desktops will still need to rely on iTunes for the foreseeable future even though Apple is dropping iTunes in their own ecosystem.
The type vulnerability allowed a combination of BitPaymer/iEncrypt ransomware to be exploited. The attack exploits an unquoted path vulnerability in Bonjour, which is a software that organizations may not even know is running on their systems, the firm said in a Thursday posting.
This vulnerability makes it easy for attackers to evade common detection because most of the Antivirus programs now a days are based on behavior monitoring, and the Bonjour component … Read the rest
Google Warns Zero-Day Bug For Android Under Active Attack
Google has stated a warning of an Android zero-day flaw actively being exploited in the wild. This flaw impacts 18 Android models including Google’s flagship Pixel, Samsung, Huawei and Xiaomi.
Project Zero member Maddie Stone wrote in a technical post . which said the unpatched vulnerability(CVE-2019-2215) can be exploited in several ways. In one scenario, a target is enticed to download a rogue app. The second method of infection includes chaining the bug with an additional vulnerability in code the Chrome browser uses to render content.
“It is a kernel privilege escalation [bug] using a use-after free vulnerability, accessible from inside the Chrome sandbox,” Stone said. “The vulnerability is exploitable in Chrome’s renderer processes under Android’s ‘isolated_app’ SELinux domain, leading to us suspecting Binder as the vulnerable component.”
A patch for the vulnerability is expected in the next few days as part of Google’s October Android security … Read the rest
Loading ...