Exploits for Social Warfare WordPress Plugin Reach Critical Mass

UPDATE Active exploits for a recently disclosed bug in a popular WordPress plugin, Social Warfare, are snowballing in the wild – potentially putting more than 40,000 websites at risk. The vulnerability, CVE-2019-9978, tracks both a stored cross-site scripting XSS vulnerability and a remote...

One_gadget and UAF combined with the use of a heap overflow vulnerability research-exploit warning-the black bar safety net

! Overview: through a simple ROP topics understanding Onegadget works, then use it to provide the ROP chain to achieve a heap of UAF vulnerabilities. Stack Overflow as a CTF pwn a big question, very worthy of study. The present article is for a certain Stack Overflow, and the stack use of the...

Fedora 29 : 2:samba (2019-db21b5f1d2)

Update to Samba 4.9.6, Security fixes for CVE-2019-3870 and CVE-2019-3880 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

KLA11471 Multiple vulnerabilities in Oracle VirtualBox

Multiple vulnerabilities were found in Oracle VirtualBox. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, cause denial of service. Below is a complete list of vulnerabilities: 1. Multiple vulnerabilities in Core component of Oracle ...

Juniper JSA10925

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10925 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version numbe...

Juniper JSA10935

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10935 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version numbe...

KLA11472 ACE vulnerability in Apache Tomcat

Multiple vulnerabilities was found in Apache Tomcat. Malicious users can exploit this vulnerability to execute arbitrary code and perform cross-site scripting attack. Below is a complete list of vulnerabilities: 1. A vulnerability in CGI Servlet component can be exploited via due to a bug in the...

CVE-2019-0841

creationtimestamp| type| source ---|---|--- 2019-04-10 08:14:06+00:00| published-proof-of-concept| https://t.me/ExcreamOnSecurity/40 2019-04-10 08:15:27+00:00| published-proof-of-concept| https://t.me/ExcreamOnSecurity/41 2019-04-10 21:31:35+00:00| published-proof-of-concept|...

Patch Tuesday Lowdown, April 2019 Edition

Microsoft today released fifteen software updates to fix more than 70 unique security vulnerabilities in various flavors of its Windows operating systems and supported software, including at least two zero-day bugs. These patches apply to Windows, Internet Explorer IE and Edge browsers, Office,...

Microsoft Internet Explorer Scripting Engine CVE-2019-0835 Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to an information disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Internet Explorer 10 Microsoft Internet Explorer 11 Recommendation...

Microsoft Edge CVE-2019-0833 Information Disclosure Vulnerability

Description Microsoft Edge is prone to an information disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Edge Recommendations Run all software as a nonprivileged user with minimal acce...

KLA11458 Multiple vulnerabilities in Adobe Acrobat and Acrobat Reader

Multiple vulnerabilities were found in Adobe Acrobat and Reader. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Multiple out-of-bounds read vulnerabilities can be exploited remotely to obta...

New Mirai Samples Grow the Number of Processor Targets

New samples of the Mirai malware have been identified, targeting an array of embedded processors and architectures within connected devices. Researchers said that they discovered new Mirai samples in February 2019, capable of infecting IoT devices running Altera Nios II, OpenRISC, Tensilica Xtens...

MikroTik RouterOS Unauthenticated Intermediary

The remote networking device is running a version of MikroTik RouterOS vulnerable to an unauthenticated intermediary vulnerability. Therefore, an unauthenticated remote attacker could use the MikroTik router to proxy arbitrary traffic or bypass the router's firewall. %NASLMINLEVEL 70300 C Tenable...

PHP 7.1.x < 7.1.28 Multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.28. It is, therefore, affected by multiple vulnerabilities: - A heap-based buffer over-read condition exists in phpifdget32s in exif.c. - A heap-based buffer overflow condition exists in...

Scientific Linux Security Update : freerdp on SL7.x x86_64 (20190402)

Security Fixes : - freerdp: Integer truncation leading to heap-based buffer overflow in updatereadbitmapupdate function CVE-2018-8786 - freerdp: Integer overflow leading to heap-based buffer overflow in gdiBitmapDecompress function CVE-2018-8787 - freerdp: Out-of-bounds write in nscrledecode...

Lob: Old WebKit HTML agent in Template Preview function has multiple known vulnerabilities leading to RCE

Summary: The Template Preview function allows users to render arbitrary HTML to a PDF document, this includes the ability to execute arbitrary Javascript. The HTML agent used to render the HTML is based on an old version of WebKit which has known security issues, for which public exploits and Pro...

metasploit-framework

This is a repository for the Metasploit Framework, a penetration testing tool. The repository contains various files and directories related to the project, including configuration files, documentation, and test scripts. The Metasploit Framework is a powerful tool for testing the security of...

Mozilla Firefox < 66.0 Multiple Vulnerabilities

Binary data 700487.prm...

USN-3927-1: Thunderbird vulnerabilities

It was discovered that Thunderbird allowed PAC files to specify that requests to localhost are sent through the proxy to another server. If proxy auto-detection is enabled, an attacker could potentially exploit this to conduct attacks on local services and tools. CVE-2018-18506 Multiple security...