Design/Logic Flaw

Multiple untrusted search path vulnerabilities in the 1 Presentation, 2 Writer, and 3 Spreadsheets components in Kingsoft Office 2010 6.6.0.2477 allow local users to gain privileges via a Trojan horse plgpf.dll file in the current working directory, as demonstrated by a directory that contains a...

Arasism (IR) CMS Shell Upload

Title: ====== Arasism IR CMS - File Upload Vulnerability Date: ===== 2012-07-12 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=657 VL-ID: ===== 657 Common Vulnerability Scoring System: ==================================== 6.5 Abstract: ========= The Laboratory Research...

Cross-platform Trojan : Mac, Windows, Linux - Nothing safe !

Security researchers working for F-Secure have found a web exploit that detects the operating system of the computer and drops a different trojan to match.The attack was first seen on a Columbian transport website which had been hacked by a third party. This malware is known as GetShell.A and...

Attacks Targeting US Defense Contractors and Universities Tied to China

UPDATE: Researchers have identified an ongoing series of attacks, possibly emanating from China, that are targeting a number of high-profile organizations, including SCADA security companies, universities and defense contractors. The attacks are using highly customized malicious files to entice...

Microsoft Office Works File Converter (CVE-2012-0177) Heap Based Buffer Overflow Vulnerability

Description Microsoft Office is prone to a remote heap-based buffer-overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. An attacker can exploit this issue by enticing an unsuspecting user into opening a specially crafted '.wps' file...

Google Fixes 20 Flaws in Chrome, Adds Scanning of Downloaded Files

Google has released a major update for its Chrome browser, fixing 20 security vulnerabilities and including a new feature that scans downloaded executables and warns users if they’re potentially malicious. The new file-scanning feature is a major upgrade to the way that Chrome handles user...

Microsoft Windows Media Player And Media Center '.dvr-ms' Files Remote Code Execution Vulnerability

Description Microsoft Windows Media Player and Windows Media Center are prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user into opening a malicious file with the vulnerable application. A successful exploit will allow arbitrary code...

Adobe Flash Player ActionScript Recursive StackOverflowError (APSB11-26; CVE-2011-2426)

The vulnerability is due to an error in the ActionScript Virtual Machine AVM while handling malicious Flash files. A remote attacker may exploit this vulnerability by enticing an unsuspecting user to open a web-page containing specially crafted Flash files. Successful exploitation may allow an...

FCKeditor Shell Upload

In The Name Of GOD + Title:FCKeditor all versian Arbitrary File Upload Vulnerability + Date: 2011 + script:http://sourceforge.net/projects/fckeditor/ + Author : pentesters.ir + Website : WwW.PenTesters.IR --------------------------------------------------------- 1.create a htaccess file: code:...

Spam Increased From April to May, Nearly Identical to 2010 Levels

Spam numbers were up by 2.1% in May from the previous month, accounting for 82.9% of global email traffic according to SecureList’s May 2011 spam report. The big story last month, however, was the exploitation of Osama bin Laden’s death by scammers of all kinds. Malware distributors were the firs...

Analysis of the New Adobe Flash Attacks

When Adobe warned customers earlier this week about a newly discovered vulnerability in the Flash Player software, company officials said that there were already attacks underway against the bug. Those attacks are using malicious Flash files buried in Word documents and Microsoft’s security...

Trend Micro WebReputation API 10.5 - URI SecURIty Bypass

Trend Micro WebReputation API 10.5 - URI SecURIty Bypass source: https://www.securityfocus.com/bid/46864/info Trend Micro WebReputation API is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass the filter included in the download mechanism. Successful exploits...

Trend Micro WebReputation API 10.5 - URI SecURIty Bypass

source: https://www.securityfocus.com/bid/46864/info Trend Micro WebReputation API is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass the filter included in the download mechanism. Successful exploits may cause victims to download malicious files onto affect...

HP OpenView Performance Insight Server Backdoor Account Code Execution (CVE-2011-0276)

HP OpenView Performance Insight OVPI implements service level management by monitoring the systems, networks and applications making up a service. It collects, analyzes and summarizes management data from various sources. A remote code execution vulnerability has been reported in HP OpenView...

Reports Show the Prevalence of Spam Dropping

A Kaspersky Lab research report for November 2010 showed the amount of email based spam fell 0.06 percent to 76.8 percent from October. The study also showed there was a .47 percent decrease in the prevalence of phishing emails across all mail traffic and a .13 percent decrease in the frequency o...

Metasploit 3.5.1 adds Cisco device exploitation !

Metasploit now enables security professionals to exploit Cisco devices, performs passive reconnaissance through traffic analysis, provides more exploits and evaluates an organization's password security by brute forcing an ever increasing range of services. This latest release adds stealth...

Aesop GIF Creator 2.1 Buffer Overflow

!/usr/bin/python Exploit Title: Aesop GIF Creator = v2.1 .aep Buffer Overflow Exploit Date: 12/15/2010 Author: xsploitedsec URL: http://www.x-sploited.com/ Contact: xsploitedsec at x-sploited.com Software Link: http://www.yukudr.com/h84561/aesopsetup.exe Vulnerable version: = v2.1 Tested on:...

Microsoft Office TIFF Image Converter (CVE-2010-3950) Memory Corruption Vulnerability

Description Microsoft Office is prone to a remote memory-corruption vulnerability. An attacker can exploit this issue by enticing an unsuspecting user into opening an Office document containing a specially crafted Tagged Image File Format TIFF image. Successfully exploiting this issue allows...

New Adobe Flash Bug Being Exploited

On the same day that it plans to release a patch for a critical flaw in Shockwave, Adobe confirmed on Thursday morning that there is a newly discovered bug in Flash that is being actively exploited already in attacks against Reader. The vulnerability affects Flash on all of the relevant platforms...

Fedora 11 : transmission-1.77-2.fc11 (2010-0388)

Fix potential data loss by maliciously-crafted .torrent files. http://trac.transmissionbt.com/wiki/Changesversion-1.77 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and form...