7381 matches found
Security Experts Recommend Long, Hard Look at Disabling Java Browser Plug-In
Is the Java browser plug-in the IT equivalent of the human appendix? Would you miss it if it were gone? Probably not, experts say, especially now that attackers are beating the Java sandbox with a rash of zero-day exploits. “It’s simply safer to have the Java plug-in disabled in the browser knowi...
New Strain of Man-in-the-Browser Malware Refines Data Sent to Attacker in Real Time
Hackers fond of man-in-the-browser MiTB attacks have brought efficiency to their work. New strains of MiTB malware have been discovered that are able to parse logs for the sensitive information hackers are targeting, rather than send massive unstructured logs back to the attacker’s command and...
SAP NetWeaver SDM Admin - information disclosure
Application: SAP NetWeaver SDM Versions Affected: SAP NetWeaver SDM Vendor URL: http://www.sap.com Bugs: Information Disclosure Exploits: YES Reported: 10.02.2012 Vendor response: 11.02.2012 Date of Public Advisory: 10.10.2012 Reference: SAP Security Note 1724516 Authors: Alexander Polyakov ERPSc...
Flexera AdminStudio LaunchProcess Function ActiveX Control Remote Command Execution
The remote host has the Flexera AdminStudio LaunchHelp ActiveX control installed. The control is affected by a remote command execution vulnerability that can be triggered by sending a directory traversal string to the 'LaunchProcess' function. By tricking a victim into visiting a specially craft...
BF and XSS vulnerabilities in IFOBS
Hello 3APA3A! I want to warn you about Brute Force and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks. These are the next 36 vulnerabilities in IFOBS: 2 BF and 34 XSS in...
Multiple vulnerabilities in IFOBS
Hello 3APA3A! I want to warn you about Brute Force and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks. These are the first 38 vulnerabilities in IFOBS: 2 BF and 36 XSS...
Omnistar Mailer - Multiple SQL Injections / HTML Injection Vulnerabilities
source: https://www.securityfocus.com/bid/55760/info Omnistar Mailer is prone to multiple SQL-injection vulnerabilities and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow an attacker to compromise the application,...
php file include vulnerability solution-exploits warning-the black bar safety net
Now the program code is written more and more strange, it is a file that contains the code you can write 2 ways: require the include Be the first to say require if error then terminate the output and include if error then continue execution. If a website Management User write in auth. php, and...
Large-Scale Water Holing Attack Campaigns Hitting Key Targets
A new APT-style espionage campaign launched this summer targeting organizations tied to financial services, government agencies and the defense industry used a technique dubbed water holing to entice victims and silently redirect them to sites hosting zero-day exploits. Researchers at RSA Securit...
IFOBS Cross Site Request Forgery / Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Hello list! I want to warn you about Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks...
SAP NetWeaver HTTP - Partial HTTP POST requests DoS
Application: SAP Versions Affected: SAP Netweaver 7.02/7.3, probably others Vendor URL: http://www.sap.com Bugs: Denial of Service Exploits: YES Reported: 25.09.2012 Vendor response: 26.09.2012 Date of Public Advisory: 17.10.2014 Reference: SAP Security Note 1986725 Author: Alexey Tyurin ERPScan...
IFOBS Cross Site Request Forgery / Cross Site Scripting
Hello list! I want to warn you about Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks. These are the next 35 vulnerabilities in IFOBS: 1 CSRF...
Microsoft Releases Out-Of-Band IE Zero-Day Patch
As expected, Microsoft today released a cumulative update for Internet Explorer addressing the zero-day vulnerability in the browser being actively exploited in the wild. Security Update MS 12-063 patches not only the critical remote-execution zero-day, but four other vulnerabilities privately...
Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)
The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components : - Apache - BIND - CoreText - Data Security - ImageIO - Installer - International Components for Unicode - Kernel - Mail - PHP ...
SAP NetWeaver HTTPd - Partial HTTP POST requests DoS
Application: SAP Versions Affected: SAP Netweaver 7.02/7.3, probably others Vendor URL: http://www.sap.com Bugs: Denial of Service Exploits: YES Reported: 19.09.2012 Vendor response: 20.09.2012 Date of Public Advisory: 17.10.2014 Reference: SAP Security Note 1966655 Author: Alexey Tyurin ERPScan...
Researcher Finds Three New Exploits Targeting Latest IE Zero-Day
A researcher at AlienVault has discovered three new servers delivering exploits targeting the latest zero-day vulnerability in Internet Explorer. Jamie Blasco, AlienVault Labs manager, said the one of the servers is delivering a new malware payload, and all of them appear to be targeting defense...
VUPEN - Mozilla Firefox "nsHTMLEditRules" Remote Use-after-free (CVE-2012-3958 / MFSA 2012-58)
VUPEN Security Research - Mozilla Firefox "nsHTMLEditRules" Remote Use-after-free CVE-2012-3958 / MFSA 2012-58 Website : http://www.vupen.com/english/research.php Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Mozilla Firefox is a free and open source web browser and...
Latest IE Zero-Day Flaw Tied to Nitro Hackers and Recent Java Zero-Day Exploits
Security experts are warning enterprise and consumer users to stay away from Internet Explorer until Microsoft issues a patch for a new zero-day vulnerability in the browser. Active exploits have been discovered in the wild and are being linked to Nitro, the same group of hackers from China who...
Tool Scans for RTF Files Spreading Malware in Targeted Attacks
Exploits embedded inside Microsoft Office documents such as Word, PDFs and Excel spreadsheets have been at the core of many targeted attacks during the past 24 months. Detection of these attack methods is improving and nimble hackers are recognizing the need for new avenues into enterprise...
BlackHole Exploit Kit 2.0 released with more latest Exploits
According to release announcement on Pastebin by unknown developers in a Russian-language BlackHole Exploit Kit 2.0 released with more latest Exploits. BlackHole is one of the most dominant exploit toolkits currently available in the underground market. It enables attackers to exploit security...