KLA11036 Multiple vulnerabilities in VMware products

Multiple serious vulnerabilities have been found in VMware Workstation Pro and VMware Workstation Player. Malicious users can exploit these vulnerabilities to gain privileges or cause a denial of service. Below is a complete list of vulnerabilities: 1. A DLL loading vulnerability can be exploited...

10 Things You Need To Know About 'Wikileaks CIA Leak'

Yesterday WikiLeaks published thousands of documents revealing top CIA hacking secrets, including the agency's ability to break into iPhones, Android phones, smart TVs, and Microsoft, Mac and Linux operating systems. It dubbed the first release as Vault 7. Vault 7 is just the first part of leak...

WikiLeaks Exposed CIA's Hacking Tools And Capabilities Details

WikiLeaks has published a massive trove of confidential documents in what appear to be the biggest ever leak involving the US Central Intelligence Agency CIA. WikiLeaks announced series Year Zero, under which the whistleblower organization will reveal details of the CIA's global covert hacking...

KLA10970 Multiple vulnerabilities in Mozilla Thunderbird

Multiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to obtain sensitive information, run arbitrary code and cause a denial of service. Below is a complete list of vulnerabilities 1. Memory curruption vulnerability in asm.js ca...

Fedora 24 : jenkins / jenkins-remoting (2016-93679a91df)

Security fix for CVE-2016-9299 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

OracleVM 3.2 : Unbreakable / etc (OVMSA-2017-0046)

The remote OracleVM system is missing necessary patches to address critical security updates : - dccp: fix freeing skb too early for IPV6RECVPKTINFO Andrey Konovalov Orabug: 25598277 CVE-2017-6074 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracte...

Publicly Disclosed Windows Vulnerabilities Await Patches

As a consequence of skipping its February Patch Tuesday release, Microsoft is leaving two publicly disclosed vulnerabilities unpatched with proof-of-concept exploits available for both. That raises the stakes exponentially on possible attacks, said Tod Beardsley, senior research director at Rapid...

A Simple JavaScript Exploit Bypasses ASLR Protection On 22 CPU Architectures

Security researchers have discovered a chip flaw that could nullify hacking protections for millions of devices regardless of their operating system or application running on them, and the worse — the flaw can not be entirely fixed with any mere software update. The vulnerability resides in the w...

Siemens SIMATIC Authentication Bypass (Update B)

CVSS v3 9.0 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Siemens Equipment: SIMATIC Vulnerability: Authentication Bypass UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-17-045-03A Siemens SIMATIC Authentication Bypass that was...

EGESPLOIT - A Golang Library For Malware Development

EGESPLOIT is a golang library for malware development, it has few unique functions for meterpreter integration. DOCUMENTATION CalculateChecksumx : Function calculates x digit 8 bit checksum for reverse HTTP/HTTPS meterpreter connections, returns the calculated checksum as string...

NewsBee CMS - SQL Injection

NewsBee CMS - SQL Injection Exploit Title: NewsBee CMS – SQL Injection Date: 06.02.2017 Software Link: https://codecanyon.net/item/newsbee-fully-featured-news-cms-with-bootstrasp-php-mysql/19404937?srank=2 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category:...

SlimarUSER Management 1.0 - 'id' SQL Injection

Exploit Title: SlimarUSER Management v1.0 – 'id' Parameter SQL Injection Date: 03.02.2017 Vendor Homepage: http://slimar.org Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview SlimarUSER is a PHP user management system ful...

Property Listing Script - propid Parameter Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Property Listing Script – Time-Based Blind Injection Date: 02.02.2017 Vendor Homepage: http://phprealestatescript.org/ Software Link: http://phprealestatescript.org/property-listing-script.html Exploit Author: Kaan KAMIS Contact...

Property Listing Script - propid Blind SQL Injection

Property Listing Script - propid Blind SQL Injection Exploit Title: Property Listing Script – Time-Based Blind Injection Date: 02.02.2017 Vendor Homepage: http://phprealestatescript.org/ Software Link: http://phprealestatescript.org/property-listing-script.html Exploit Author: Kaan KAMIS Contact:...

Property Listing Script Blind SQL Injection

Exploit Title: Property Listing Script a Time-Based Blind Injection Date: 02.02.2017 Vendor Homepage: http://phprealestatescript.org/ Software Link: http://phprealestatescript.org/property-listing-script.html Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com...

Property Listing Script - 'propid' Blind SQL Injection

Exploit Title: Property Listing Script – Time-Based Blind Injection Date: 02.02.2017 Vendor Homepage: http://phprealestatescript.org/ Software Link: http://phprealestatescript.org/property-listing-script.html Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com...

Google Android - Unprotected MSRs in EL1 RKP Privilege Escalation Exploit

Exploit for Android platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=980 As part of Samsung KNOX, Samsung phones include a security hypervisor called RKP Real-time Kernel Protection, running in EL2. This hypervisor is meant to ensure that the HLOS...

LogoStore - 'query' SQL Injection

Exploit Title: LogoStore - SQL Injection Date: 27.01.2017 Software Link: https://codecanyon.net/item/logostore-buy-and-sell-logos-online/19379630 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview LogoStore is a web...

Windows Exploit Suggester

Windows Exploit Suggester This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins. Windows...

Itech Classifieds Script 7.27 SQL Injection

Exploit Title: Itech Classifieds Script v7.27 a SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/classifieds-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits...