Google предлагает вознаграждение за эксплойты $20000-$60000

Компания Google объявила о расширении программы вознаграждений Chromium Security Rewards. В частности, предлагается премия за 0-day эксплойты Chrome, Flash, Windows и др. За них будут платить от $20K до $60K. Программа Chromium Security Rewards предполагает выплату вознаграждения за найденные...

CVE-2012-1188

creationtimestamp| type| source ---|---|--- 2012-02-28 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36894 2012-02-28 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36893...

CVE-2012-4923

creationtimestamp| type| source ---|---|--- 2012-02-27 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36831 2012-02-27 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36832 2012-02-27 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36833...

Endian Firewall 2.4 - 'dnat.cgi?createrule' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52076/info Endian Firewall is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal...

New Version of Flashback Mac Trojan Found Using Java Exploits

A new version of the Flashback Trojan that targets Macs has appeared, and this one uses a drive-by download technique to attempt exploits of two Java vulnerabilities. The Flashback.G malware also tries to trick users into accepting a fake digital certificate, which will install the malware if the...

Metasploit Framework 4.2.0 : IPv6, VMware, and Tons of Modules!

Metasploit Framework 4.2.0 : IPv6, VMware, and Tons of Modules! Since last release in October, Metasploit added 54 new exploits, 66 new auxiliary modules, 43 new post-exploitation modules, and 18 new payloads. Metasploit 4.2 now ships with thirteen brand new payloads, all added to support opening...

The Uploader 2.0.4 (English/Italian) - Arbitrary File Upload / Remote Code Execution (Metasploit)

require 'msf/core' class Metasploit3 'The Uploader 2.0.4 Eng/Ita Remote File Upload', 'Description'= %q This module exploits various flaws in The Uploader to upload a PHP payload to target system. When run with defaults it will search possible URIs for the application and exploit it automatically...

Call for Paper - DEF CON Rajasthan March 2012 Meet

Call for Paper - DEF CON Rajasthan March 2012 Meet DEF CON Rajasthan - March 2012 Jaipur Meet, Call For Papers is now officially Open and will close on March 10, 2012. DEF CON Rajasthan DC91141 is a DEF CON Registered group of people interested in exploring technology and it implications in...

KLA10356 Multiple vulnerabilities in pcAnywhere

Multiple serious vulnerabilities have been found in Symantec products. Malicious users can exploit these vulnerabilities to obtain access to client information or cause denial of service. Below is a complete list of vulnerabilities 1. lack of client state control can be exploited remotely by...

FreePBX gen_amp_conf.php Information Disclosure

By requesting the 'admin/modules/framework/bin/genampconf.php' script directly, an unauthenticated, remote attacker can discover all the configuration parameters, including the admin password, for the FreePBX installed on the remote host, thereby gaining administrative access to it. %NASLMINLEVEL...

CVE-2012-5322

creationtimestamp| type| source ---|---|--- 2012-02-21 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36866 2012-02-21 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36865...

CVE-2012-2986

creationtimestamp| type| source ---|---|--- 2012-02-17 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/18893 2012-05-21 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/18901...

CVE-2012-4362

creationtimestamp| type| source ---|---|--- 2012-02-17 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/18893 2012-05-21 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/18901...

Armitage Update : Graphical cyber attack management tool for Metasploit

Armitage Update : Graphical cyber attack management tool for Metasploit Armitage is a graphical cyber attack management tool for Metasploit that visualizes your targets, recommends exploits, and exposes the advanced capabilities of the framework. Armitage aims to make Metasploit usable for securi...

LEPTON 1.1.3 - Cross-Site Scripting

LEPTON 1.1.3 - Cross-Site Scripting source: https://www.securityfocus.com/bid/52026/info LEPTON is prone to multiple input-validation vulnerabilities, including: 1. A cross-site scripting vulnerability 2. An SQL-injection vulnerability 3. A local file-include vulnerability 4. Multiple...

CVE-2012-0996

creationtimestamp| type| source ---|---|--- 2012-02-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36785 2012-02-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36784...

Bloody Valentine For Critical Infrastructure: EtherNet/IP Exploit Could Crash Devices

Security researchers made good on a promise to release new exploits for programmable logic controllers PLCs. The exploits include one targeting a flaw in the implementation of the EtherNet/IP Industrial Protocol used in many IP-enabled PLCs. The security hole, if left unaddressed, could enable a...

Microsoft Silverlight & .NET Framework Heap Corruption Remote Code Execution Vulnerability

Description Microsoft Silverlight and Microsoft .NET Framework are prone to a remote code-execution vulnerability. Successful exploits will allow an attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely result in a denial-of-service...

LuraWave JP2 ActiveX Control < 2.1.5.11 jp2_x.dll Remote Buffer Overflow

The version of the LuraWave JP2 ActiveX control installed on the remote Windows host reportedly contains a stack-based buffer overflow vulnerability. If an attacker can trick a user on the affected host into viewing a specially crafted HTML document, he can leverage this issue to execute arbitrar...

Security advisory for Bugzilla 4.2rc2, 4.0.4, 3.6.8 and 3.4.14

Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: When a user creates a new account, Bugzilla doesn't correctly reject email addresses containing non-ASCII characters, which coul...