What's Your IT Question?

Want to know more about this topic or about us? Contact us!

All posts in XSS

Apple devices get urgent patch for zero-day exploit – update now!

by Paul Ducklin Apple has just pushed out an emergency “one-bug” security update for its mobile devices, including iPhones, iPads and Apple Watches. Even users of older iPhones who are still on the officially-supported iOS 12 version need to patch, so the versions you should be updating to are as . . . Read more

QNAP High-Severity Flaws Plague NAS Systems

The high-severity cross-site scripting flaws could allow remote-code injection on QNAP NAS systems. QNAP Systems is warning of high-severity flaws that plague its top-selling network attached storage (NAS) devices. If exploited, the most severe of the flaws could allow attackers  to remotely take over NAS devices. NAS devices are systems . . . Read more

Bug-Bounty Awards Spike 26% in 2020

The most-rewarded flaw is XSS, which is among those that are relatively cheap for organizations to identify. Cross-site scripting (XSS) remained the most impactful vulnerability and thus the one reaping the highest rewards for ethical hackers in 2020 for a second year running, according to a list of top 10 . . . Read more

Facebook, News and XSS Underpin Complex Browser Locker Attack

An elaborate set of redirections and hundreds of URLs make up a wide-ranging tech-support scam. A sophisticated “browser locker” campaign is spreading via Facebook, ultimately pushing a tech-support scam. The effort is more advanced than most, because it involves exploiting a cross-site scripting (XSS) vulnerability on a popular news site, . . . Read more

Adobe Fixes 16 Critical Code-Execution Bugs Across Portfolio

The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.

Wormable Apple iCloud Bug Allows Automatic Photo Theft

The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.

Post Grid WordPress Plugin Flaws Allow Site Takeovers

The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.

Stubborn WooCommerce Plugin Bugs Get Third Patch

The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.

Critical Adobe Flaws Allow Attackers to Run JavaScript in Browsers

The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.