CapTipper - Malicious HTTP traffic explorer tool

CapTipper is a python tool to analyze, explore and revive HTTP malicious traffic. CapTipper sets up a web server that acts exactly as the server in the PCAP file, and contains internal tools, with a powerful interactive console, for analysis and inspection of the hosts, objects and conversations...

Adobe Auto-Update Flash Player Zero Day Patch

Adobe on Saturday began patching a zero-day vulnerability in Flash Player, exploits for which have been included in the notorious Angler Exploit Kit. This is the second of two previously unreported critical flaws in the software that have been patched in the last five days. Adobe last Thursday se...

Flash Player <= 16.0.0.287 Unspecified Code Execution (APSA15-01 / APSB15-03)

According to its version, the Adobe Flash Player installed on the remote Windows host is equal or prior to 16.0.0.287. It is, therefore, affected by the following vulnerabilities : - A use-after-free error exists that allows an attacker to crash the application or execute arbitrary code...

Flash Player <= 16.0.0.257 Information Disclosure (APSB15-02)

According to its version, the installation of Adobe Flash Player installed on the remote Windows host is equal or prior to 16.0.0.257. It is, therefore, affected by a memory leak that can allow bypassing of memory randomization mitigations, aiding in further attacks. %NASLMINLEVEL 70300 C Tenable...

MS KB3033408: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer

The remote host is missing KB3033408. It is, therefore, affected by a memory leak that can allow bypassing of memory randomization mitigations, aiding in further attacks. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid80948; scriptversion"1.13";...

Exploit Pack - Open Source Security Project for Penetration Testing and Exploit Development

Exploit Pack, is an open source GPLv3 security tool, this means it is fully free and you can use it without any kind of restriction. Other security tools like Metasploit, Immunity Canvas, or Core Iimpact are ready to use as well but you will require an expensive license to get access to all the...

KLA10447 Multiple vulnerabilities in Java SE

Multiple serious vulnerabilities have been found in Oracle products. Malicious users can exploit these vulnerabilities to cause loss of integrity, denial of service and obtain sensitive information. Below is a complete list of vulnerabilities 1. Vectors relsted to Swing, Hotspot, JAX-WS,...

ICS-CERT Advisory Warns of Schneider, Emerson Vulnerabilities

Industrial HMI software from Schneider Electric has been updated to patch a buffer overflow vulnerability that could be exploited by a remote attacker. The buffer overflow vulnerability was found in the Wonderware InTouch Access Anywhere Server v10.6 and v11. The server is human machine interface...

Dell iDRAC Products IPMI Arbitrary Command Injection Vulnerability

The remote host is running a version of iDRAC that ships with a version of IPMI that does not sufficiently randomize session ID values. An unauthenticated, remote attacker can exploit this to inject arbitrary commands into a privileged session. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

XSS vulnerability in login redirect param

Security advisory: XSS vulnerability in login redirect param ZfcUser version 1.2.2 has been released and includes a security for this vulnerability. Fix has been applied in @baf0e460 Affected versions All versions below 1.2.2 are affected. dev-master is fixed starting from @2cc167a Exploits Becau...

vBulletin Cross-Site Request Forgery Vulnerability

vBulletin is a forum program. A cross-site request forgery vulnerability exists in vBulletin, which allows remote attackers to perform cross-site scripting attacks via admin authentication requests hijacked by the adminhash and securitytoken parameters...

Two XSS Vulnerabilities in SupportCenter Plus

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in a web-based customer support software SupportCenter Plus. These vulnerabilities can be exploited to perform Cross-Site Scripting attacks against authenticated users of the vulnerable software. 1 Cross-Site Scripting XSS ...

NetDecision-Traffic-4.5.1

Title : Netmechanica NetDecision Traffic Grapher Server Information Disclosure Vulnerability Author : Prabhu S Angadi SecPod Technologies www.secpod.com Vendor : http://www.netmechanica.com Advisory : http://secpod.org/blog/?p=481...

BlueMaho - Bluetooth Security Testing Suite

BlueMaho is GUI-shell interface for suite of tools for testing security of bluetooth devices. It is freeware, opensource, written on python, uses wxPyhon. It can be used for testing BT-devices for known vulnerabilities and major thing to do - testing to find unknown vulns. Also it can form nice...

e107 2 Bootstrap CMS - Cross-Site Scripting

| | | || / | |/' | | || | / / | /| \ / /\ | / / \ |/ / alertString.fromCharCode88, 83, 83 or "alertdocument.cookie ======== Credits: ======== Vulnerability found and advisory written by Ahmet Agar. =========== References: =========== http://www.0x97.info htts://twitter.com/HacKingZ...

Missing Two-Factor Authentication Led to JPMorgan Breach

The biggest U.S. banking breach of all time came down to the smallest of details. The New York Times, citing sources close to the ongoing investigation of the JPMorgan data breach, said hackers found a server unprotected by two-factor authentication to break in using a stolen user name and passwo...

Apple Patches NTP Vulnerabilities in First Automated Patch

Apple last night for the first time pushed an automated patch to Mac OS X users, taking care of critical Network Time Protocol NTP vulnerabilities. The fix was delivered automatically and did not require Mac users to restart their machines. The latest security issue in NTP, which is used by...

MGASA-2014-0541 Updated ntp packages fix security vulnerabilities

Updated ntp packages fix security vulnerabilities: If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated CVE-2014-9293. ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys...

Exploits Circulating for Remote Code Execution Flaws in NTP Protocol

Researchers at Google have uncovered several serious vulnerabilities in the Network Time Protocol and experts warn that there are exploits publicly available for some of the bugs. The vulnerabilities are present in all versions of NTP prior to 4.2.8 and include several buffer overflows that are...

Ettercap 0.8.0 0.8.1 - Multiple Denial of Service Vulnerabilities

Ettercap 0.8.0 0.8.1 - Multiple Denial of Service Vulnerabilities Exploit Title: 6 Remote ettercap Dos exploits to 1 Date: 19/12/2014 Exploit Author: Nick Sampanis Vendor Homepage: http://ettercap.github.io Software Link: https://github.com/Ettercap/ettercap/archive/v0.8.1.tar.gz Version: 8.0-8.1...