Cool Exploit Kit Includes Old Internet Explorer Exploit

You cannot accuse the keepers of the Cool Exploit Kit of not recognizing market trends. Given a rash of recent watering hole attacks and zero-day exploits built around Microsoft’s Internet Explorer browser, it’s no surprise that a 15-month-old IE exploit has been included in the crimeware package...

CVE-2012-6495

creationtimestamp| type| source ---|---|--- 2013-05-08 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/25304 2013-06-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/26422...

NetApp OnCommand System Manager - zapiServlet CIFS Configuration Management Interface Multiple Cross-Site Scripting Vulnerabilities

NetApp OnCommand System Manager - zapiServlet CIFS Configuration Management Interface Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/59688/info NetApp OnCommand System Manager is prone to multiple cross-site scripting and HTML-injection vulnerabilities...

CVE-2013-3320

creationtimestamp| type| source ---|---|--- 2013-05-07 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/38507 2013-05-07 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/38506...

SEC Consult 20130417-0 :: Multiple vulnerabilities in Sosci Survey

SEC Consult Vulnerability Lab Security Advisory 20130417-0 ======================================================================= title: Multiple vulnerabilities in Sosci Survey product: Sosci Survey vulnerable version: 2.3.04a fixed version: 2.3.04a impact: Critical homepage:...

VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 "Scroll" Use-after-free (MS13-028)

VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 "Scroll" Use-after-free MS13-028 Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Microsoft Internet Explorer is a web browser developed by Microsoft and included as part of the...

Fraud-as-a-Service of Zeus Malware advertised on social network

Cyber crime enterprise is showing a growing interest in monetization of botnets, the most targeted sector in recent months is banking. One of most active malware that still menaces Banking sector is the popular Zeus. Zeus is one of the oldest, it is active since 2007, and most prolific malware th...

Brad Arkin Named Adobe CSO

Adobe has named Brad Arkin to the newly created position of CSO, a major expansion of responsibilities for Arkin, who has been leading the company’s product security and privacy initiatives. Adobe has been in the security spotlight for several years now, as attackers have focused their attention ...

Oracle Delays Java 8 Features for Security Overhaul

It’s not quite the development freeze Microsoft underwent during the Trustworthy Computing push, but it’s a start for Oracle, which will delay the release of Java 8 until Q1 of next year, largely because the platform and browser plug-in is such a security disaster. This year has done nothing but...

SuSE 10 Security Update : IBM Java (ZYPP Patch Number 8542)

IBM Java 5 has been updated to SR16 FP1 which bugs and security issues. More information can be found on : http://www.ibm.com/developerworks/java/jdk/alerts/ and on : http://www.ibm.com/developerworks/java/jdk/aix/j564/fixes.htmlSR16FP1 CVEs fixed: CVE-2013-0485 / CVE-2013-0809 / CVE-2013-1493...

Sandbox-Bypass Exploits Hacks Java 7u21 Update

Optimism and praise followed last week’s Java critical patch update. Oracle not only patched 42 vulnerabilities in the Java browser plug-in, but also added new code-signing restrictions and new prompts warning users when applets are potentially malicious. It took less than a week, however, to...

Details Available for Chrome, Java Pwn2Own Flaws

Details have been disclosed about vulnerabilities exploited in Chrome and Java during the Pwn2Own contest. Google made patches available for the Chrome flaw within 24 hours, while Oracle patched Java fully last week. Details were not disclosed by the researchers, who netted tens of thousands for...

[EMET v4.0 Beta] Enhanced Mitigation Experience Toolkit

The enhanced Mitigation Experience Toolkit EMET is designed to help prevent hackers from gaining access to your system. Software vulnerabilities and exploits have become an everyday part of life. Virtually every product has to deal with them and consequently, users are faced with a stream of...

SAP Portal - Unvalidated redirect

Application: SAP NetWeaver JAVA Versions Affected: SAP NetWeaver J2EE 6.40/7.02, probably others Vendor URL: Bugs: Information disclosure Exploits: YES Reported: 20.04.2013 Vendor response: 21.04.2013 Date of Public Advisory: 30.10.2013 Reference: SAP Security Note 1854826 CVSS:...

SuSE 11.2 Security Update : java-1_7_0-ibm (SAT Patch Number 7623)

IBM Java 7 was updated to SR4-FP1, fixing bugs and security issues. More information can be found on : http://www.ibm.com/developerworks/java/jdk/alerts/ and on : http://www.ibm.com/developerworks/java/jdk/aix/j764/Java764.fixes.htm lSR4FP1 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than...

Java 7u21 Released with Code-Signing Restrictions, Warnings

The latest Java update released Tuesday includes new prompts warning users of potentially malicious applets, in addition to patches for 42 vulnerabilities, all but three of which are remotely exploitable. Java 7 update 21 is part of Oracle’s scheduled Critical Patch Updates for the program and...

Sosci Survey 2.x Bypass / XSS / Command Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities in Sosci Survey product: Sosci Survey vulnerable version: 2.3.04a fixed version: 2.3.04a impact: Critical homepage: https://www.soscisurvey.de...

[ExploitSearch.net] Exploit / Vulnerability Search Engine

Exploitsearch.net , is an attempt at cross referencing/correlating exploits and vulnerability data from various sources and making the resulting database available to everyone. Unlike other exploit search engines which are simply custom google searches, this site actually crawls the source...

Microsoft: Uninstall Faulty Patch Tuesday Security Update

Microsoft announced last night that it has stopped pushing a security update originally released on Patch Tuesday because the fix is causing some PCs to blue screen. Microsoft recommends users uninstall the patch, which is also causing compatibility with some endpoint security software. “We’ve...