Monthly Archives: May 2016
Fourth Bank Hit By SWIFT Hackers
Reddit Resets 100,000 User Passwords After Surge In Hacked Accounts
Debian Security Advisory 3587-1
Debian Linux Security Advisory 3587-1 – Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library.
Decision makers at banks ‘in the dark’ about data breaches
Decision makers at banks are in the dark when it comes to data breaches at their organization, according to KPMG’s 2016 Banking Outlook Survey.
The post Decision makers at banks ‘in the dark’ about data breaches appeared first on We Live Security.
Researcher Pockets $30,000 in Chrome Bounties
Mariusz Mlynski is having a May to remember, earning $30,000 in bounties from Google for vulnerabilities he discovered and disclosed, on top of another $15,500 earlier this month from the same program.
Avira Antivirus: Game Mode explained
Many gamers believe that they shouldn’t degrade their computer’s performance by installing and running a security suite, no matter what the risks might be. The main reason for this are the notifications that might pop up and destroy their immersive gaming experience. But there’s a silver lining.
The post Avira Antivirus: Game Mode explained appeared first on Avira Blog.
Path Traversal in extension "Media management" (media)
Release Date: May 27, 2016
Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
Affected Versions: version 4.0.3 and below
Vulnerability Type: Path Traversal
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:F/RL:O/RC:C (What’s that?)
Problem Description: The extension fails to properly sanitize user input and is vulnerable to Path Traversal. This vulernability is only exploitable as TYPO3 backend user having access to the media backend module.
Solution: Updated versions 3.7.5 and 4.0.4 are available from the TYPO3 Extension Manager and at http://typo3.org/extensions/repository/download/media/3.7.5/t3x/ and http://typo3.org/extensions/repository/download/media/4.0.4/t3x/. Users of the extension are advised to update the extension as soon as possible.
Credits: Credits go to Falk Huber who discovered and reported the issue.
General advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list to receive future Security Bulletins via E-mail.
Cross-Site Scripting in extension "Formhandler" (formhandler)
Release Date: May 27, 2016
Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
Affected Versions: version 2.3.0 and below
Vulnerability Type: Cross-Site Scripting
Severity: Low
Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:F/RL:O/RC:C (What’s that?)
Problem Description: The extension fails to properly sanitize user input and is vulnerable to Cross-Site Scripting.
Solution: Updated versions 2.3.1 and 2.0.2 are available from the TYPO3 Extension Manager and at http://typo3.org/extensions/repository/download/formhandler/2.3.1/t3x/ and http://typo3.org/extensions/repository/download/formhandler/2.0.2/t3x/. Users of the extension are advised to update the extension as soon as possible.
Credits: Credits go to Lubomir Stroetmann who discovered and reported the issue.
General advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list to receive future Security Bulletins via E-mail.
Businesses Fear Damage to Reputation More Than Cost of Recovering From a DDoS Attack
More than one in three businesses rank reputational damage and customer trust top consequences of DDoS attacks, reports Kaspersky Lab