Windows 10^H^H Symbolic Link Mitigations

Posted by James Forshaw, abusing symbolic links like it’s 1999. For the past couple of years I’ve been researching Windows elevation of privilege attacks. This might be escaping sandboxing or gaining system privileges. One of the techniques I’ve used multiple times is abusing the symbolic link...

RPC Portmapper Reflective DDoS Attacks

A number web hosting providers and businesses in the gaming industry were last month guinea pigs for a new type of amplified DDoS attack. Attackers have figured out how to use Portmapper, or RPC Portmapper, in reflection attacks where victims are sent copious amounts of responses from Portmapper...

WordPress Plugin WP Symposium 15.1 - Blind SQL Injection

WordPress Plugin WP Symposium 15.1 - Blind SQL Injection Details ================ Software: WP Symposium Version: 15.1 Homepage: https://wordpress.org/plugins/wp-symposium Advisory report:...

WordPress Plugin WP Symposium 15.1 - Blind SQL Injection

Details ================ Software: WP Symposium Version: 15.1 Homepage: https://wordpress.org/plugins/wp-symposium Advisory report: https://security.dxw.com/advisories/blind-sql-injection-in-wp-symposium-allows-unauthenticated-attackers-to-access-sensitive-data/ CVE: Awaiting assignment CVSS: 6.4...

Lenovo Service Engine (LSE) BIOS Vulnerability

Certain Lenovo personal computers contain a vulnerability in LSE a Lenovo BIOS feature. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the Lenovo Security Advisories for notebooks and desktops...

Google Analytics By Yoast Premium 5.4.4 Cross Site Scripting

Details ================ Software: Google Analytics by Yoast Premium Version: 5.4.4 Homepage: https://yoast.com/wordpress/plugins/google-analytics/ Advisory report: https://security.dxw.com/advisories/xss-in-google-analytics-by-yoast-premium-by-privileged-users/ CVE: Awaiting assignment CVSS: 5.5...

WordPress 3.8.1 / 3.8.2 / 4.2.2 Cross Site Request Forgery Vulnerability

A cross site request forgery vulnerability in the comment form of WordPress versions 3.8.1, 3.8.2, and 4.2.2 allows for administrative impersonation. Details ================ Software: WordPress Version: 3.8.1,3.8.2,4.2.2 Homepage: http://wordpress.org/ Advisory report:...

WordPress iframe 3.0 Stored Cross Site Scripting

Details ================ Software: iframe Version: 3.0 Homepage: http://wordpress.org/plugins/iframe/ Advisory report: https://security.dxw.com/advisories/stored-xss-in-iframe-allows-less-privileged-users-to-do-almost-anything-an-admin-can/ CVE: Awaiting assignment CVSS: 5.5 Medium;...

WordPress iframe 3.0 Reflective Cross Site Scripting

Details ================ Software: iframe Version: 3.0 Homepage: http://wordpress.org/plugins/iframe/ Advisory report: https://security.dxw.com/advisories/reflected-xss-in-iframe-allows-unauthenticated-users-to-do-almost-anything-an-admin-can/ CVE: Awaiting assignment CVSS: 5.8 Medium;...

WordPress Flickr Justified Gallery 3.3.6 Cross Site Scripting Vulnerability

WordPress Flickr Justified Gallery plugin version 3.3.6 suffers from a cross site scripting vulnerability. Details ================ Software: Flickr Justified Gallery Version: 3.3.6 Homepage: https://wordpress.org/plugins/flickr-justified-gallery/ Advisory report:...

WordPress Flickr Justified Gallery 3.3.6 Cross Site Scripting

Details ================ Software: Flickr Justified Gallery Version: 3.3.6 Homepage: https://wordpress.org/plugins/flickr-justified-gallery/ Advisory report:...

WordPress Subscribe To Comments 2.1.2 LFI / Code Execution Vulnerabilities

Exploit for php platform in category web applications Details ================ Software: Subscribe to Comments Version: 2.1.2 Homepage: http://wordpress.org/plugins/subscribe-to-comments/ Advisory report:...

Significant Flash exploit mitigations are live in v18.0.0.209

Posted by Mark Brand and Chris Evans, isolators of heaps Whilst Project Zero has gained a reputation for vulnerability and exploitation research, that's not all that we do. One of the main reasons we perform this research is to provide data to defenders; and one of the things that defenders can d...

WordPress BuddyPress Activity Plus 1.5 CSRF / File Deletion

Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/ CVE: Awaiting assignment CVSS: 8.5 High;...

The Events Calender: Eventbrite Tickets 3.9.6 Cross Site Scripting

Details ================ Software: The Events Calendar: Eventbrite Tickets Version: 3.9.6 Homepage: https://theeventscalendar.com/product/wordpress-eventbrite-tickets/ Advisory report:...

WordPress Plotly 1.0.2 Cross Site Scripting

Details ================ Software: Plotly Version: 1.0.2 Homepage: http://wordpress.org/plugins/wp-plotly/ Advisory report: https://security.dxw.com/advisories/stored-xss-in-plotly-allows-less-privileged-users-to-insert-arbitrary-javascript-into-posts/ CVE: CVE-2015-5484 CVSS: 6.5 Medium;...

WordPress GD bbPress Attachments 2.1 Cross Site Scripting

Details ================ Software: GD bbPress Attachments Version: 2.1 Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/ Advisory report: https://security.dxw.com/advisories/reflected-xss-in-gd-bbpress-attachments-allows-an-attacker-to-do-almost-anything-an-admin-can/ CVE: Awaiting...

CUPS 2.0.3 - Multiple Vulnerabilities

Exploit for multiple platform in category remote exploits Source: http://googleprojectzero.blogspot.se/2015/06/owning-internet-printing-case-study-in.html Abstract Modern exploit mitigations draw attackers into a game of diminishing marginal returns. With each additional mitigation added, a subse...

CUPS 2.0.3 - Multiple Vulnerabilities

CUPS 2.0.3 - Multiple Vulnerabilities Source: http://googleprojectzero.blogspot.se/2015/06/owning-internet-printing-case-study-in.html Abstract Modern exploit mitigations draw attackers into a game of diminishing marginal returns. With each additional mitigation added, a subset of software bugs...

CUPS XSS / String Handling / Improper Teardown

Source: http://googleprojectzero.blogspot.se/2015/06/owning-internet-printing-case-study-in.html Abstract Modern exploit mitigations draw attackers into a game of diminishing marginal returns. With each additional mitigation added, a subset of software bugs become unexploitable, and others become...