Meet AttackSurfaceMapper; new automated penetration testing tool

By Sudais AttackSurfaceMapper penetration testing tool has been developed in Python 3.x, is compatible with all major operating systems. This is a post from HackRead.com Read the original post: Meet AttackSurfaceMapper; new automated penetration testing tool...

Facebook Plans on Backdooring WhatsApp

This article points out that Facebook's planned content moderation scheme will result in an encryption backdoor into WhatsApp: In Facebook's vision, the actual end-to-end encryption client itself such as WhatsApp will include embedded content moderation and blacklist filtering algorithms. These...

Windows GDI Unauthorized Access

The vulnerability of the Windows GDI component in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

DirectWrite Code Execution

The vulnerability of the DirectWrite application programming interface in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

[SECURITY] Fedora 30 Update: qemu-3.1.0-9.fc30

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

Lynis 2.7.5 - Security Auditing Tool for Unix/Linux Systems

We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...

Windows Audio Service Privilege Escalation

The vulnerability of the Windows Audio service on Windows operating systems is related to privilege management errors. Exploiting this vulnerability can allow an attacker to enhance their privileges by using a specially created program...

Jet Database Engine Code Execution

The vulnerability of the Jet Database Engine database management system for Windows operating systems relates to operations that go beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Exploit for Use After Free in Microsoft

CVE-2019-0708-PoC-Hitting-Path Really Really Bad, don't judg...

[SECURITY] Fedora 30 Update: qemu-3.1.0-8.fc30

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

Microsoft Releases Security Updates to Address Remote Code Execution Vulnerability

Microsoft has released security updates to address a remote code execution vulnerability in the following in-support and out-of-support operating systems: In-support systems: Windows 7, Windows Server 2008 R2, and Windows Server 2008 Out-of-support systems: Windows 2003 and Windows XP A remote...

Microsoft Guidance to mitigate Microarchitectural Data Sampling vulnerabilities

Executive Summary On May 14, 2019, Intel published information about a new subclass of speculative execution side channel vulnerabilities known as Microarchitectural Data Sampling. An attacker who successfully exploited these vulnerabilities may be able to read privileged data across trust...

Win32k Privilege Escalation

The vulnerability of the Win32k component in Windows operating systems exists due to errors in memory object handling. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

Command injection

An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 formerly known as Cisco Workload Automation or CWA. The Enterprise Scheduler for AIX allows local users to gain privileges via Command Injection in crafted Tidal Job Buffers TJB parameters. NOTE: this vulnerability...

CVE-2019-9801

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry...

CVE-2019-9794

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the...

CVE-2019-9801

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry...

CVE-2019-9798

On Android systems, Firefox can load a library from APITRACELIB, which is writable by all users and applications. This could allow malicious third party applications to execute a man-in-the-middle attack if a malicious code was written to that location and loaded. Note: This issue only affects...

CVE-2019-9801

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry...

CVE-2019-9794

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the...