wpa_supplicant -- P2P SSID processing vulnerability

Jouni Malinen reports: A vulnerability was found in how wpasupplicant uses SSID information parsed from management frames that create or update P2P peer entries e.g., Probe Response frame or number of P2P Public Action frames. SSID field has valid length range of 0-32 octets. However, it is...

UBUNTU-CVE-2015-1863

Heap-based buffer overflow in wpasupplicant 1.0 through 2.4 allows remote attackers to cause a denial of service crash, read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries...

SUSE-SU-2015:1013-1 Security update for wpa_supplicant

wpasupplicant was updated to fix three security issues: - CVE-2015-0210: wpasupplicant: broken certificate subject check this adds the 'domainmatch' config option from upstream additional to the already existing domainsuffixmatch - CVE-2014-3686: hostapd command execution - CVE-2015-1863: P2P SSI...

Windows 10 to deliver updates and App downloads via Peer-to-Peer Technology

Does downloading Windows updates from Microsoft's servers and waiting too long really annoy you? It might not be with the arrival of Windows 10. Microsoft seems to make a major change in Windows 10 to the way it delivers updates for the software. The leaked version of Windows 10 build 10036 the...

帝友P2P任意密码支付密码重置让我超越马云爸爸不再是梦想

简要描述： 本屌为穷逼，买不起贵司10+W的而且代码质量高到可怕的产品，所以下了一个D版系统看源码。在网贷之家随机挑了几个站点测试，发现问题都存在…… 详细说明： 听说P2P借贷火成狗，然后看了看几家P2P借贷的站点，长得都差不多，看起来好像就是一个妈生的。本来想吐槽一下，关乎钱的事情，就不能认真点吗？但是，转念一想，艾玛，这不是一个通用程序么……赶紧脱掉裤子爽一发。 听说这货的产品卖得死贵（15W），翻阅了一下写的代码，质量实在对不起这个价格。之前在乌云上厂商还会接点bug打发打发白帽，现在听说弄了个绿M的检测报告之后屌都不屌乌云一下。 扯蛋完毕，本屌是小白一个，还请各位看官海涵。...

MegaNet — New Decentralized, Non-IP Based and Encrypted Network

The Famous Internet entrepreneur and former hacker Kim Dotcom, who introduced legendary Megaupload and MEGA file sharing services to the World, has came up with another crazy idea — To start his very own Internet that uses the "blockchain". Just last month, Kim Dotcom, a German millionaire former...

Android WiFi-Direct - Denial of Service

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Android WiFi-Direct Denial of Service 1. Advisory Information Title: Android WiFi-Direct Denial of Service Advisory ID: CORE-2015-0002 Advisory URL: http://www.coresecurity.com/advisories/android-wifi-direct-denial-service Date...

帝友p2p新业务目录遍历

简要描述： 我本来在找葫芦娃动画片的，谁知道你们的广告弹出来了，没办法。 详细说明： 0x00 说明 帝友p2p（http://www.dyp2p.com）的新业务，帝友云（http://www.diyou.cn） 0x01 思路 一般新业务上线，都会有些许遗漏的地方。假如是加急上线，那么更容易粗心了，这也是人之常情。 所以看到帝友有新的业务上线，我赶紧来瞅瞅我水平不高，只能找这些篓子。 虽说官方搞了个什么口令，大门上了道锁，但是菊花难免不保的时候啊。 0x02 套路 我一般都是按照套路出牌的一边上扫描器，一边人工找篓子。 这不，有了防火墙，忒凶。扫描器都范二了...

Gather Kademlia Server Information

This module uses the Kademlia BOOTSTRAP and PING messages to identify and extract information from Kademlia speaking UDP endpoints, typically belonging to eMule/eDonkey/BitTorrent servers or other P2P applications. This module requires Metasploit: https://metasploit.com/download Current source:...

MLDonkey - multi-protocol P2P file sharing application

MLDonkey is a multi-platform and freely distributed eDonkey client, a P2P Peer-to-Peer file-sharing application. It provides users with both a server daemon and graphical user interface GUI. It seems to be the first ever open source application that could access the eDonkey peer-to-peer file...

Working Resources 1.7.3 BadBlue Null Byte File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5226/info BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems. It has been discovered that a request passed to a BadBlue server containing a...

iMesh <= 7.1.0.x (IMWeb.dll 7.0.0.x) Remote Heap Overflow Exploit

No description provided by source. !-- iMesh = 7.1.0.x IMWebControl Class IMWeb.dll 7.0.0.x remote heap exploit IE7/XP full patched by rgod, site: http://retrogod.altervista.org/ software site: http://www.imesh.com iMesh is a file sharing and online social network. It uses a proprietary,...

Working Resources BadBlue 1.7 EXT.DLL Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5086/info BadBlue is a P2P file sharing application distributed by Working Resources. The ext.dll ISAPI does not sufficiently sanitize input. Because of this, it is possible for a user to create a custom URL containing...

P2P Share Spy 2.2 - Local Password Disclosure Exploit

No description provided by source. / P2P Share Spy 2.2 Local Exploit by Kozan Application: P2P Share Spy 2.2 Vendor: Rebrand Software - www.rebrandsoftware.com Vulnerable Description: P2P Share Spy 2.2 discloses passwords to local users. Discovered & Coded by: Kozan Credits to ATmaCA Web :...

Soulseek 157 NS < 13e/156.x - Remote Peer Search Code Execution PoC

No description provided by source. Soulseek 157 NS 13e & 156. Remote Peer Search Code Execution ============================================= - Release date: July 02, 2009 - Discovered by: Laurent Gaffié ; http://g-laurent.blogspot.com/ - Severity: critical...

ACE Stream Media 2.1 - (acestream://) Format String Exploit PoC

No description provided by source. ? ACE Stream Media 2.1 acestream:// Format String Exploit PoC Vendor: ACE Stream Product web page: http://www.acestream.org Affected version: Ace Player HD 2.1.9 VLC 2.0.5 Summary: Ace Stream is an innovative multimedia platform of a new generation, which includ...

帝友P2P借贷系统搜索型SQL注入

简要描述： RT 详细说明： 标题上面说是v3.1版本，具体是什么版本，亲您懂的。 http://v31.diyou.cc/transfersuccess/index.html?keywords=1&borrowtype=&accountstatus=&borrowinterestrate=&spreadmonth= 注入点keywords 直接带入数据库中查询/ C:\Python27\sqlmapsqlmap.py -u "http://v31.diyou.cc/transfersuccess/index.html...

GameOver Zeus Takedown Shows Good Early Returns

The effect of the takedown of the GameOver Zeus botnet this week has been immediate and significant. Researchers who track the activity of the peer-to-peer botnet’s activity say that the volume of packets being sent out by infected machines has dropped to almost zero. On Friday, the FBI and...

FBI, European Authorities Go After GameOver Zeus Botnet

UPDATE–Law enforcement agencies in Europe and the United States, including Europol and the FBI, ran a coordinated takedown of the GameOver Zeus botnet on Friday, seizing servers and disrupting the botnet’s operation. Authorities say that the same botnet has been used to distribute the CryptoLocke...

KLA10433 Multiple vulnerabilities in Pidgin

Multiple serious vulnerabilities have been found in Pidgin. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary programs and other unknown impact. Below is a complete list of vulnerabilities 1. Improper traffic restrictions can be exploited remotely via...