[SECURITY] CVE-2013-4322 Incomplete fix for CVE-2012-3544 (Denial of Service)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2013-4322 Incomplete fix for CVE-2012-3544 Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.0-RC5 - - Apache Tomcat 7.0.0 to 7.0.47 - - Apache Tomcat 6.0.0 to 6.0.37...

Complete Microsoft EMET Bypass Developed

SAN FRANCISCO — Researchers at Bromium Labs are expected to announce today they have developed an exploit that bypasses all of the mitigations in Microsoft’s Enhanced Mitigation Experience Toolkit EMET. Principal security researcher Jared DeMott is scheduled to deliver a presentation this morning...

Update Adobe Shockwave Player to fix Critical Remote Code Execution Vulnerabilities

Adobe has released a security update to address critical vulnerabilities for Adobe Shockwave Player 12.0.7.148 and earlier versions of the Windows and Mac OS X systems. The Patch fixes two critical remote code execution vulnerabilities, that could potentially allow an attacker to remotely take...

Adobe Patches Shockwave, Fixes Two Vulnerabilities

Adobe joined Microsoft in releasing security patches today, sending out a fix for its Shockwave Player. The patch repairs critical vulnerabilities in the platform that could allow an attacker to remotely takeover an affected system. According to a post on its Product Security Incident Response Te...

The Mask Malware: A 7-Year Cyber Espionage Campaign Unmasked

A sophisticated cyber spying operation, The Mask , that has been under the radar for about 7 years and targeted approximately 31 countries, has now been unmasked by researchers at Kaspersky Labs. Researchers believe the campaign has been active since 2007 and is a highly sophisticated nation-stat...

Extension Spam in Google Chrome Web Store

UPDATE: Twelve seemingly legitimate Chrome browser extensions installed by more than 180,000 users are injecting advertisements on 44 popular websites. According to a Barracuda Labs report, the extensions can be found in the official Chrome Web Store. They advertise themselves and operate as game...

SoapUI 4.6.3 - Remote Code Execution Vulnerability

Exploit for windows platform in category remote exploits Exploit Title: SoapUI Remote Code Execution Date: 25.12.13 Exploit Author: Barak Tawily Vendor Homepage: http://www.soapui.org/ Software Link: http://www.soapui.org/Downloads/download-soapui-pro-trial.html Version: vulnerable before 4.6.4...

CMS Afroditi 1.0 Blind SQL Injection

Exploit Title: CMS Afroditi v.1.0 Blind SQL Injection Date: 30/12/2013 Exploit Author: projectzero labs Vendor Homepage: http://www.naxtech.com Vendor Informed: 20 & 24/12/2013 Software Demo: http://afroditi.naxtech.com Version: v.1.0 About the software: =================== Αs indicated in the...

Codiad 2.0.7 Cross Site Scripting

Exploit Title: Codiad - Stored Persistent Cross Site Scripting Vulnerability Date: 02/12/2013 Exploit Author: Project Zero Labs Vendor Homepage: http://www.codiad.com Software Link: https://github.com/Codiad/Codiad Version: v.2.0.7 Tested on: Kali Linux / Iceweasel v.22 About the software:...

Growing market of zero-day vulnerability exploits pose real threat to Cyber Security

NSS Labs issued the report titled "The Known Unknowns" to explain the dynamics behind the market of zero-day exploits. Last week I discussed about the necessity to define a model for "cyber conflict" to qualify the principal issues related to the use of cyber tools and cyber weapons in an...

Debian DSA-2796-1 : torque - arbitrary code execution

Matt Ezell from Oak Ridge National Labs reported a vulnerability in torque, a PBS-derived batch processing queueing system. A user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these comman...

Cracked.com Compromised, Serving Malware

The popular humor website, Crackeddotcom reportedly hosted malware that infected the machines of its visitors over the weekend and may still be doing so, according to Barracuda Labs research. The malware proliferated via drive-by-downloads, and it is not known how many systems became infected as ...

Debian: Security Advisory (DSA-2796-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-3906 : Zero Day Vulnerability in Microsoft Graphics Component

Microsoft has issued a temporary fix for a 0day vulnerability that can be exploited to install malware via infected Word documents. A Zero-day Remote code execution flaw, which has been dubbed CVE-2013-3906, exploits a vulnerability in a Microsoft graphics component, to target Microsoft Office...

Win32k Memory Allocation Vulnerability(MS13-053)

No description provided by source. / more detials: https://labs.mwrinfosecurity.com/blog/2013/09/06/mwr-labs-pwn2own-2013-write-up-kernel-exploit/ this poc is written by 0xBigBan / include windows.h define NtUserMessageCall 0x11ea //on win7 sp1 x86 void SystemCallDWORD ApiNumber, ... asm lea edx,...

Tor Botnet Makes Bad Move to Anonymity Network

MEvade, the massive botnet using Tor as a communication protocol, may have moved operations to the network in order to hamper potential takedown efforts, but according to security researchers, the move just served to shine a spotlight on the botnet’s activities. Rather than hide traffic from bots...

Paypal Account Deletion

Title: ====== PayPal Bug Bounty 110 - Auth Bypass Session Vulnerability Date: ===== 2013-08-21 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1056 PayPal Security UID: oebaLK VL-ID: ===== 1056 Common Vulnerability Scoring System: ==================================== 9....

Snowden Confirms Stuxnet Malware developed by NSA and Israel Together

In an interview with Germany's Der Spiegel Magazine, American whistleblower Edward Snowden has Confirmed that Stuxnet Malware was developed by NSA and Israel Together. Stuxnet made international headlines in 2010 for specifically target a uranium enrichment facility in Natanz, Iran. Stuxnet was...

Snowden Confirms Stuxnet Malware developed by NSA and Israel Together

In an interview with Germany’s Der Spiegel Magazine, American whistleblower Edward Snowden has Confirmed that Stuxnet Malware was developed by NSA and Israel Together. Stuxnet made international headlines in 2010 for specifically target a uranium enrichment facility in Natanz, Iran. Stuxnet was...

PayPal QR Labs Authentication Bypass

Title: ====== Paypal Bug Bounty 102 QR Dev Labs - Auth Bypass Vulnerability Date: ===== 2013-07-05 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=995 PayPal Security UID: ZVf25kC VL-ID: ===== 995 Common Vulnerability Scoring System: ====================================...