EquityPandit 1.0 - Password Disclosure Vulnerability

Exploit for Android platform in category local exploits...

Pwning the Nokelock API

Nokelock Vulnerabilities I’ve been talking at some Infosec meet ups about a certain padlock, called the Nokelock. I need to differentiate this right now as there is a product called nokē, this is not about that. This is about a set of Chinese made padlocks called Nokelock from a company called...

SandboxEscaper Drops Three More Windows Exploits, IE Zero-Day

On the heels of releasing a Windows zero-day exploit on Wednesday, developer SandboxEscaper has dropped exploit code for four more flaws on Thursday morning. On Wednesday, she dropped a Windows zero-day exploit that would allow local privilege-escalation LPE, by importing legacy tasks from other...

Update: Hacker Disclosed 4 New Microsoft Zero-Day Exploits in Last 24 Hours

Less than 24 hours after publicly disclosing an unpatched zero-day vulnerability in Windows 10, the anonymous hacker going by online alias "SandboxEscaper" has now dropped new exploits for two more unpatched Microsoft zero-day vulnerabilities. The two new zero-day vulnerabilities affect Microsoft...

WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities

WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities !/usr/bin/env python Author: Simone Quatrini of Pen Test Partners CVEs: 2019-9879, 2019-9880, 2019-9881 Tested on Wordpress 5.1.1 and wp-graphql 0.2.3 https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ import argpars...

News Wrap: WhatsApp, Microsoft, Intel and Cisco Flaws

This week was filled with flaws, flaws and more flaws: From a zero-day under active exploit in the WhatsApp messaging app, to Patch Tuesday glitches addressed by Microsoft. Threatpost breaks down the top vulnerabilities of the week, including: A WhatsApp zero-day vulnerability being exploited in...

Trigmap - A Wrapper For Nmap To Automate The Pentest

Trigmap is a wrapper for Nmap. You can use it to easily start Nmap scan and especially to collect informations into a well organized directory hierarchy. The use of Nmap makes the script portable easy to run not only on Kali Linux and very efficient thanks to the optimized Nmap algorithms. Detail...

Photon OS 2.0: Systemd PHSA-2019-2.0-0153

An update of the systemd package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0153. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Microsoft Internet Explorer CVE-2019-0930 Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to an information-disclosure vulnerability Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Internet Explorer 10 Microsoft Internet Explorer 11 Microsoft...

Photon OS 1.0: Systemd PHSA-2019-1.0-0228

An update of the systemd package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0228. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Microsoft Security Advisory 4500331: Guidance for older platforms (XP / 2003) (BlueKeep)

The remote Windows host is missing a security update. It is, therefore, affected by a unspecified flaw that exists in the Remote Desktop Protocol RDP service. An unauthenticated, remote attacker can exploit this, via a specially crafted application, to execute arbitrary code with full user...

Omron Network Configurator for DeviceNet (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Low skill level to exploit Vendor: Omron Equipment: Network Configurator for DeviceNet Vulnerability: Untrusted Search Path 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-19-134-01 Omron Network...

Chinese Hackers Used NSA Hacking Tools Before Shadow Brokers Leaked Them

In a shocking revelation, it turns out that a hacking group believed to be sponsored by Chinese intelligence had been using some of the zero-day exploits linked to the NSA's Equation Group almost a year before the mysterious Shadow Brokers group leaked them. According to a new report published by...

Exploit for CVE-2013-0422

K8tools 20190428 声明: 工具仅供安全研究或授权渗透，非法用途后果自负。 博客: https://www.cnblogs.com/k8gege 下载: https://github.com/k8gege/K8tools PS: 不定期更新,文件比较大，可按需下载。工具有BUG或建议可直接Github上留言 提权工具均可在远控Cmd或WebShell运行，大部份经过修改编译兼容性稳定性更好 注意：不保证永久有效,喜欢自行保存。 综合工具 + 综合工具 K8飞刀Final.rar + K8data.mdb K8飞刀漏洞数据库20190402 + K8expList.txt...

OPENSUSE-SU-2019:1325-1 Security update for chromium

This update for chromium fixes the following issues: Chromium was updated to 74.0.3729.108 boo1133313: CVE-2019-5805: Use after free in PDFium CVE-2019-5806: Integer overflow in Angle CVE-2019-5807: Memory corruption in V8 CVE-2019-5808: Use after free in Blink CVE-2019-5809: Use after free in...

Atlassian JIRA CVE-2019-3401 Information Disclosure Vulnerability

Description Atlassian JIRA is prone to an information-disclosure vulnerability. Successful exploits of this issue lead to the disclosure of sensitive information which may aid in launching further attacks. Jira versions prior to 7.13.3 and 8.0.0 through and prior to 8.1.1 are vulnerable...

Atlassian JIRA CVE-2019-3403 Information Disclosure Vulnerability

Description Atlassian JIRA is prone to an information-disclosure vulnerability. Successful exploits of this issue lead to the disclosure of sensitive information which may aid in launching further attacks. Jira versions prior to 7.13.3, 8.0.0 through and prior to 8.0.4 and 8.1.0 through and prior...

Debian DSA-4436-1 : imagemagick - security update

This update fixes two vulnerabilities in Imagemagick: Memory handling problems and missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed TIFF or Postscript files are processed. C Tenable Network Security, Inc. The...

Thousands of firms hit by Beapy malware using NSA hacking tools

By Ryan De Souza EternalBlue and DoublePulsar hacking tools are back in action. Symantec security researchers have identified that cybercriminals are still utilizing the classified exploits/hacking tools of the National Security Agency NSA, which were stolen about two years back. The new malware...

CARBANAK Week Part Two: Continuing the CARBANAK Source Code Analysis

Update April 30: Following the release of our four-part CARBANAK Week blog series, many readers have found places to make the data shared in these posts actionable. We have updated this post to include some of this information. In the previous installment, we wrote about how string hashing was us...