Vulnerabilities
A Google security engineer discovered that jQuery Mobile can expose websites to cross-site scripting (XSS) attacks if an open redirect vulnerability is also present.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Data Protection
F5 Networks BIG-IP appliances are affected by a serious vulnerability that can be exploited by a remote attacker to extract memory. An Internet scan...
Cybersecurity Funding
Bug bounty platform provider HackerOne announced on Wednesday that it has raised $40 million in a Series C financing round led by Dragoneer Investment Group.
Data Protection
An increasing number of antiviruses and network appliances intercept TLS connections to gain visibility into encrypted traffic, but in many cases this weakens connection...
Vulnerabilities
A 0-day vulnerability (CVE-2017-0016) affecting Windows’ SMBv3 (Server Message Block) protocol that was revealed last week is no longer considered a Critical issue, but...
Cybercrime
The critical vulnerability disclosed last week by WordPress developers has already been exploited to hack thousands of websites, security firm Sucuri warned on Monday.
Application Security
Dozens of popular iOS applications are affected by vulnerabilities that allow man-in-the-middle (MitM) attackers to silently intercept data from connections that should be protected...
Cybercrime
The darknet marketplace Hansa announced last week the launch of a bug bounty program with rewards of up to 10 bitcoins, currently worth more...
Vulnerabilities
A 0-day memory corruption vulnerability discovered in the SMB (Server Message Block) protocol can be exploited to cause denial of service or potentially execute...
ICS/OT
Honeywell has released updates for its XL Web II controllers to address several critical and high severity vulnerabilities that can be exploited remotely from...
Endpoint Security
Intel Security has fixed a critical vulnerability in its McAfee ePolicy Orchestrator (ePO) centralized security management product. Researchers warn that the flaw is ideal...
Vulnerabilities
Gmail will soon drop support for Chrome version 53 and below, a move expected to hit Windows XP and Vista users the most, given...
Audits
Rapid7 has added a hardware bridge to its Metasploit penetration testing framework, making it easier for users to analyze Internet of Things (IoT) devices....
Identity & Access
Cisco has released a software update for its Prime Home remote management and provisioning solution to address a critical authentication bypass vulnerability discovered by...
Incident Response
WordPress has disclosed a critical privilege escalation vulnerability patched on January 26 with the release of version 4.7.2. The developers of the content management...
Mobile & Wireless
Zimperium Launches Exploit Acquisition Program for Android and iOS N-Days, But No Interest in 0-Days
Cybercrime
The Hague - Dutch authorities will count by hand all the votes cast in next month's general elections, ditching "vulnerable" computer software to thwart...
Endpoint Security
Cisco has shared additional information on the recently disclosed vulnerability affecting WebEx, and informed customers that patches have also been made available for the...
Email Security
An update released earlier this month for MailStore Server patches a couple of cross-site scripting (XSS) and open redirect vulnerabilities found by a researcher...
ICS/OT
Schneider Electric has released an update for its StruxureWare Data Center Expert software suite to address a high severity vulnerability related to how the...
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)