PonyFinal Ransomware Targets Enterprise Servers Then Bides Its Time

A Java-based ransomware known as PonyFinal has galloped onto the scene, targeting enterprise systems management servers as an initial infection vector. According to a warning on Twitter from Microsoft Security Intelligence on Wednesday, PonyFinal is not an automated threat, but rather has humans...

ManageEngine Desktop Central < 10 Build 10.0.515 Information Disclosure

The ManageEngine Desktop Central application running on the remote host is prior to version 10 build 10.0.515. It is, therefore, affected by an information disclosure vulnerability in the PDFGenerationServlet component due to improper access controls. An unauthenticated, remote attacker can explo...

Live Coronavirus Map Used to Spread Malware

Cybercriminals constantly latch on to news items that captivate the public's attention, but usually they do so by sensationalizing the topic or spreading misinformation about it. Recently, however, cybercrooks have started disseminating real-time, accurate information about global infection rates...

File upload vulnerability in jpress

JPress is a product developed in Java, similar to WordPress. Incorporating the microsoft ecosystem, the jpress has a file upload vulnerability that can be exploited by attackers to gain access to the web server...

HtmlUnit Code Execution Vulnerability

HtmlUnit is a Java-based library . A code execution vulnerability exists in HtmlUnit that can be exploited by an attacker to execute arbitrary Java code...

[SECURITY] Fedora 30 Update: jss-4.6.2-1.fc30

Java Security Services JSS is a java native interface which provides a br idge for java-based applications to use native Network Security Services NSS. This only works with gcj. Other JREs require that JCE providers be signed...

CloudBees Jenkins path traversal vulnerability (CNVD-2019-23290)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

XSS Vulnerability at JEESNS Groups

JEESNS is an open source social management system developed on the JAVA enterprise level platform. JEESNS groups at the existence of an XSS vulnerability can be exploited by an attacker to inject arbitrary Web script or HTML...

KonaKart Remote Code Execution Vulnerability

KonaKart is a Java-based shopping cart software solution for online retailers. A remote code execution vulnerability exists in KonaKart version 8.9.0.0. An attacker could exploit the vulnerability to execute code...

NSA Releases GHIDRA Source Code — Free Reverse Engineering Tool

Update 4/4/2019 — Great news. NSA today finally released the complete source code for GHIDRA version 9.0.2 which is now available on its Github repository. GHIDRA is agency's home-grown classified software reverse engineering tool that agency experts have been using internally for over a decade t...

File Upload Vulnerability in OFCMS Backend

OFCMS is a content management system developed based on java technology. A file upload vulnerability exists in the background of OFCMS, which can be exploited by an attacker to upload arbitrary files...

NSA to release its GHIDRA reverse engineering tool for free

The United States' National Security Agency NSA is planning to release its internally developed reverse engineering tool for free at the upcoming RSA security conference 2019 that will be held in March in San Francisco. The existence of the framework, dubbed GHIDRA, was first publicly revealed by...

NSA to release its GHIDRA reverse engineering tool for free

The United States' National Security Agency NSA is planning to release its internally developed reverse engineering tool for free at the upcoming RSA security conference 2019 that will be held in March in San Francisco. The existence of the framework, dubbed GHIDRA, was first publicly revealed by...

CVE-2018-1000838

autopsy version = 4.9.0 contains a XML External Entity XXE vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted CaseMetadata...

nmap4j Arbitrary Command Execution Vulnerability

nmap4j is an Nmap scanner written in the Java language, which is mainly used to execute, scan and persist Nmap output information. A security vulnerability exists in nmap4j version 1.1.0. An attacker can exploit the vulnerability to execute arbitrary commands with the help of shell metacharacters...

Dicoogle PACS 2.5.0 Web Server Directory Traversal Exploit

This module exploits an unauthenticated directory traversal vulnerability in the Dicoogle PACS Web Server v2.5.0 and possibly earlier, allowing an attacker to read arbitrary files with the web server privileges. While the application is java based, the directory traversal was only successful...

Dicoogle PACS Web Server Directory Traversal

This module exploits an unauthenticated directory traversal vulnerability in the Dicoogle PACS Web Server v2.5.0 and possibly earlier, allowing an attacker to read arbitrary files with the web server privileges. While the application is java based, the directory traversal was only successful...

ruibaby Halo Cross-Site Scripting Vulnerability

ruibaby Halo is a Java-based blogging system. A cross-site scripting vulnerability exists in ruibaby Halo version 0.0.2. A remote attacker can inject arbitrary web script or HTML by sending the commentAuthor field to the FrontCommentController.java file...

Remote Execution Flaw Threatens Apps Built Using Spring Framework — Patch Now

Security researchers have discovered three vulnerabilities in the Spring Development Framework, one of which is a critical remote code execution flaw that could allow remote attackers to execute arbitrary code against applications built with it. Spring Framework is a popular, lightweight and an...

Oracle JDeveloper IDE Directory Traversal Vulnerability

Exploit for java platform in category web applications + Credits: John Page aka hyp3rlinx Vendor: ============= www.oracle.com Product: =========== JDeveloper IDE Oracle JDeveloper is a free integrated development environment that simplifies the development of Java-based applications addressing...