Immunity Canvas: ACROBAT_TOOLBUTTON

Name| acrobattoolbutton ---|--- CVE| CVE-2013-3346 Exploit Pack| CANVAS Description| acrobattoolbutton Notes| CVE Name: CVE-2013-3346 VENDOR: Adobe NOTES: This exploit has been tested on: - Windows XP SP3 EN Acrobat Reader 11.0.2/11.0.1/10.1.4/10.1.2/10.1.1/10.1.0 Vulnerable versions include: =...

OllyDbg / Immunity Debugger Crash

;Title : OllyDbg/Immunity Debugger - Crash POC ;Researcher : Souhail Hammou Dark-Puzzle ;Research Team : http://itsecurity.ma ;Facebook : http://www.facebook.com/dark.puzzle.sec ;Date : 29/07/2013 ;================================================================== .386 .model flat,stdcall option...

Immunity Canvas: STRUTS2_DEFAULT_ACTION_MAPPER

Name| struts2defaultactionmapper ---|--- CVE| CVE-2013-2251 Exploit Pack| CANVAS Description| Apache Struts 2.0.0 - 2.3.15 RCE Notes| References: https://cwiki.apache.org/confluence/display/WW/S2-016 Repeatability: Infinite VENDOR: Apache CVE Url: https://vulners.com/cve/CVE-2013-2251 CVE Name:...

Threat Outbreak Alert: Fake Monetary Award Email Messages on July 9, 2013

Medium Alert ID: 30019 First Published: 2013 July 10 14:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a monetary award for the recipient. The text in the email message attempts to convince the recipient to open the...

Immunity Canvas: MS13_056

Name| ms13056 ---|--- CVE| CVE-2013-3174 Exploit Pack| CANVAS Description| MS13056 Notes| CVE Name: CVE-2013-3174 VENDOR: Microsoft NOTES: This exploit has been tested on: - Windows XP SP 3 EN on IE 8 no jsrecon - Windows 7 PRO SP 1 EN x86-64 on IE 8 32bit jsrecon works No webpage open in the...

Immunity Canvas: PERF_SWEVENT_INIT

Name| perfsweventinit ---|--- CVE| CVE-2013-2094 Exploit Pack| CANVAS Description| perfsweventinit local root Notes| Repeatability: Infinite Notes: Tested on: - Ubuntu 12.10 quantal x8664 3.5.0-27-generic VENDOR: GNU/Linux CVE Url: https://vulners.com/cve/CVE-2013-2094 CVE Name: CVE-2013-2094...

Obama Expands Surveillance to Critical Infrastructure

A little-known policy through which the Departments of Justice, Defense, and Homeland Security offered prosecutorial immunity to companies that helped the U.S. military monitor Internet traffic on the private networks of defense contractors has reportedly been expanded by Executive Order to inclu...

Immunity Canvas: SUDO_TIMESTAMP

Name| sudotimestamp ---|--- CVE| CVE-2013-1775 Exploit Pack| CANVAS Description| sudotimestamp: Linux/MacOS timestamp privilege escalation Notes| CVE Name: CVE-2013-1775 VENDOR: Intel, GNU/Linux, Apple Notes: This exploit runs on GNU/Linux and MacOS X. On both systems this exploit requires: - Use...

Immunity Canvas: LINUX_PTRACE_SETREGS

Name| linuxptracesetregs ---|--- CVE| CVE-2013-0871 Exploit Pack| CANVAS Description| linuxptracesetregs local root Notes| Repeatability: Infinite Notes: Vulnerable kernels = 3.5 64-bit only. Tested on: - Ubuntu 12.10 64bit - Ubuntu 12.04 64bit - Debian 6 64bit Besides running the module inside...

Immunity Canvas: FS_PIPE_RACE_TO_NULL

Name| fspiperacetonull ---|--- CVE| CVE-2009-3547 Exploit Pack| CANVAS Description| fspiperacetonull local root Notes| Repeatability: Infinite NOTES: Tested on Ubuntu 9.04 32-bit, Ubuntu 9.10 32-bit, kernels 2.6.28|29|30|31 Vulnerable kernels = 2.6.31 32bit. VENDOR: Linux CVE Url:...

Immunity Canvas: ACROBAT_XFA

Name| acrobatxfa ---|--- CVE| CVE-2013-0640 Exploit Pack| CANVAS Description| Adobe Acrobat Reader XFA =10.X Notes| CVE Name: CVE-2013-0640 VENDOR: Adobe VersionsAffected: 10.X and below Repeatability: CVE Url: https://vulners.com/cve/CVE-2013-0640 CERT Advisory: None CVSS: 9.3...

Java 7u11 Update Addresses Only One of Two Zero-Day Vulnerabilities

Microsoft can take some solace that it is not alone in sending out security updates that don’t fully address a zero-day vulnerability. A researcher at Immunity Inc., put Oracle on a similar hot seat this week when he reported that a recent out-of-band Java update repaired only one of two Java fla...

FreeBSD : java 7.x -- security manager bypass (d5e0317e-5e45-11e2-a113-c48508086173)

US CERT reports : Java 7 Update 10 and earlier versions of Java 7 contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manage...

Immunity Canvas: JAVA_MBEANINSTANTIATOR_FINDCLASS

Name| javaMBeanInstantiatorfindClass ---|--- CVE| CVE-2013-0422 Exploit Pack| CANVAS Description| javaMBeanInstantiatorfindClass Notes| CVE Name: CVE-2013-0422 VENDOR: Sun Notes: Affected versions JDK and JRE 7 Update 10 and earlier Tested on: - Windows 7 with JDK/JRE 7 update 10 To run from...

java 7.x -- security manager bypass

US CERT reports: Java 7 Update 10 and earlier versions of Java 7 contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manager...

Immunity Canvas: MOINMOIN_RCE

Name| moinmoinrce ---|--- CVE| CVE-2012-6495 Exploit Pack| CANVAS Description| moinmoinrce Notes| CVE Name: CVE-2012-6495 VENDOR: http://moinmoi.in NOTES: This version of the exploit forces a callback by overwriting moin.wsgi. This makes it a one-shot exploit, and if it fails, will result in the...

Immunity Canvas: JAVA_CVE_2012_5088

Name| javaCVE20125088 ---|--- CVE| CVE-2012-5088 Exploit Pack| CANVAS Description| Java MethodHandles.Lookup Remote Code Execution Notes| CVE Name: CVE-2012-5088 VENDOR: Sun Notes: The exploitation technique is abusing bug patched in CVE-2012-5088 which is allowing to use reflection with full...

Immunity Canvas: JAVA_JAXWS

Name| javajaxws ---|--- CVE| CVE-2012-5076 Exploit Pack| CANVAS Description| Java Applet JAX-WS Remote Code Execution Notes| CVE Name: CVE-2012-5076 VENDOR: Sun Notes: Affected versions JDK and JRE 7 Update 7 and earlier Tested on: - Windows XP SP3 with JDK/JRE 7 update 6 To run from command line...

Immunity Canvas: IE_EXECCOMMAND

Name| ieexecCommand ---|--- CVE| CVE-2012-4969 Exploit Pack| CANVAS Description| ieexecCommand Notes| CVE Name: CVE-2012-4969 VENDOR: Microsoft Notes: VersionsAffected: Repeatability: Infinite References: 'http://technet.microsoft.com/en-us/security/advisory/2757760' Date public: 09/17/2012 MSADV...

Oracle Releases Fix For Java CVE-2012-4681 Flaw

Oracle on Thursday released a new version of Java that included a fix for the CVE-2012-4681 vulnerability that has been used in limited targeted attacks in the last couple of weeks. The release of Java 7 update 7 comes about four days after the Java flaw was publicly disclosed, but several months...