13671 matches found
Microsoft Windows Graphics Component CVE-2017-0286 Information Disclosure Vulnerability
Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Office 2007 Service Pack 3 Microsoft Office 2010 Service Pack 2 32-bit...
Business Process Compromise: The Next Step in Advanced Targeted Attacks
Targeted attacks have come a long way in recent years, leveraging increasingly advanced techniques aimed at specific individuals. Often, these hackers pinpoint a single person within an enterprise, steal their credentials, log into an account, and leverage this position to find sensitive...
Blinking Router LEDs Leak Data From Air-Gapped Networks
Researchers have uncovered a new data extraction hole inside air-gapped networks that takes advantage of the blinking LED lights on top of routers to steal data. In a report published last week, researchers at Ben-Gurion University in Israel demonstrated how a router or switch running malware...
Please stop posting your X-rays to social media
Social media is fun. Posting pictures and sharing them with friends is a great technology. But please, we beg you, stop posting your medical imaging results to Instagram, Twitter, and Facebook. Why? What if you get a gnarly fracture from a really awesome snowboarding stunt and you want to share...
[SECURITY] [DSA 3874-1] ettercap security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3874-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 09, 2017 https://www.debian.org/security/faq -...
EulerOS 2.0 SP2 : nss (EulerOS-SA-2017-1109)
According to the version of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application...
EFS Easy Chat Server 3.1 - Remote Buffer Overflow (SEH)
Exploit Title: Easy Chat Server User Registeration Buffer Overflow SEH Date: 09/10/2017 Software Link: http://echatserver.com/ecssetup.exe Exploit Author: Aitezaz Mohsin Vulnerable Version: v2.0 to v3.1 Vulnerability Type: Buffer Overflow Severity: Critical Tested on: Windows XP Sp3 Eng...
EulerOS 2.0 SP1 : ghostscript (EulerOS-SA-2017-1100)
According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a...
EulerOS 2.0 SP1 : openjpeg (EulerOS-SA-2017-1088)
According to the versions of the openjpeg package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause...
Debian DLA-980-1 : ming security update
It was found that ming, a library to parse and generate SWF Flash files, is susceptible to an integer overflow that would lead into out of bound memory writes via a maliciously crafted file. For Debian 7 'Wheezy', these problems have been fixed in version 1:0.4.4-1.1+deb7u3. We recommend that you...
Digital Canal Structural Wind Analysis
CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Digital Canal Structural Equipment: Wind Analysis Vulnerability: Stack-Based Buffer Overflow AFFECTED PRODUCTS The following versions of Wind Analysis, a structural engineering software platform, are affected: Wind...
QakBot Returns, Locking Out Active Directory Accounts
QakBot, a worm-like strain of information-stealing malware that’s been around since 2009, has resurfaced again. The malware has been a thorn in the side of administrators as of late. After a recent stretch of inactivity, researchers now link a rash of recent Microsoft Active Directory lockouts to...
Cuvva: Session cookie without secure flag on https://underwriter.partner.cuvva.com
Issue detail The following cookie was issued by the application and does not have the secure flag set: csrf=SPncw9jJEynL2b4TYJqybsdc; Path=/; Session; HostOnly; The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of...
Virtuozzo 7 : readykernel-patch (VZA-2017-045)
According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - The tcpv6synrecvsock function in net/ipv6/tcpipv6.c in the Linux kernel mishandles inheritance, which allows local...
This CIA Tool Hacks Windows Computers Silently Over the Network
WikiLeaks has published a new batch of the ongoing Vault 7 leak, this time detailing an alleged CIA project that allowed the agency to turn Windows file servers into covert attack machines that can silently infect other computers of interest inside a targeted network. Codenamed Pandemic, the tool...
Mozilla Network Security Services Denial of Service Vulnerability (CNVD-2017-11837)
Mozilla Network Security Services NSS is the United States Mozilla Foundation developed a library network security services library, it can provide cross-platform support for SSL, S/MIME and other Internet security standards. Mozilla Network Security Services is prone to a denial of service...
CentOS 6 : nss (CESA-2017:1364)
An update for nss is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
SUSE SLES12 Security Update : postgresql93 (SUSE-SU-2017:1441-1)
This update for postgresql93 fixes the following issues: The PostgreSQL package was updated to 9.3.17, bringing various bug and security fixes. Bug fixes : - bsc1029547: Fix tests with timezone 2017a - CVE-2017-7486: Restrict visibility of pgusermappings.umoptions, to protect passwords stored as...
Bypassing NGFW/WAFs using data format obfuscations
A lot of network security solutions today supports a lot data format inside HTTP and other protocols. The main question here is understanding, based on traffic analysis, which data formats such as JSON/Base64/XML/etc should be applied to which field. This is an analytically unsolvable problem...
