Adobe to Patch Vulnerable Flash Player in Shockwave

It’s bad enough that the Flash runtime bundled with Adobe’s Shockwave player is deficient in security patches going back to January 2013, but what’s worse is that the increased attack surface provided by Shockwave might make it easier to exploit. And, in the bargain, Adobe has known about the iss...

Localize: Numerous open ports/services

Looks like you have numerous open ports that also show service versions. An attacker can leverage this information when trying an attack. Ports should be filtered and banners should be removed/generalized. nmap -sV www.localize.io Starting Nmap 6.40-2 http://nmap.org at 2014-04-18 11:08 PDT Stats...

Microsoft EMET 5.0 Technical Preview Released

SAN FRANCISCO – Enterprises beat up by wave after wave of Java exploits and calls to disable the platform may soon have some relief in sight. Microsoft’s free Enhanced Mitigation Experience Toolkit will soon have a new feature that allows users to configure where plug-ins, especially those target...

Bit9 has done the report found a large number of“critical”Java vulnerability-vulnerability warning-the black bar safety net

Bit9 has done recently for Java and its vulnerabilities conducted in-depth research, the results found that nearly half of the enterprises installed two or more versions of Java. Java in the enterprise environment is very General, enterprises usually do not delete the old version, which increases...

[Drozer] The Leading Security Testing Framework for Android.

drozer enables you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Dalvik VM, other apps’ IPC endpoints and the underlying OS. drozer provides tools to help you use and share public Android exploits. It helps you to deploy a droze...

Microsoft Patch Tuesday to Fix Three Critical Remote Code Execution vulnerabilities

Yeah, it’s Patch Tuesday once again. Almost 10 years ago in October, 2003 - Microsoft invented the process of regularly scheduled security updates on every second Tuesday of the Month, as Patch Tuesday. Today, the Microsoft Security team will issue eight security updates in total, out of that --...

Windows RT ARM Bind Shell (Port 4444)

; Title: Windows RT ARM Bind Shell Port 4444 ; Date: July 28, 2013 ; Author: Matthew Graeber @mattifestation ; Blog post: http://www.exploit-monday.com/2013/07/WinRT-ARM-Shellcode.html ; Tested on: Microsoft Surface RT Tablet w/ Windows RT 6.2.9200 ; License: BSD 3-Clause ; Syntax: MASM ; Notes: ...

Windows RT ARM - Bind Shell Port 4444

Windows RT ARM - Bind Shell Port 4444. Shellcode exploit for arm platform ; Title: Windows RT ARM Bind Shell Port 4444 ; Date: July 28, 2013 ; Author: Matthew Graeber @mattifestation ; Blog post: http://www.exploit-monday.com/2013/07/WinRT-ARM-Shellcode.html ; Tested on: Microsoft Surface RT Tabl...

Honeynet Project Researchers Build ICS Honeypot

Industrial control system and SCADA honeypots have been tried before with relative success. While those systems were enticing to hackers who hammered away on them, they were also complicated, required real ICS and SCADA gear, and weren’t publicly available. Two researchers from Norway and Denmark...

Mozilla: Memory corruption found using Address Sanitizer (MFSA 2013-48)

The cairoxlibsurfaceaddglyph function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service invalid write operation via unspecified vectors...

Mozilla: Memory corruption found using Address Sanitizer (MFSA 2013-48)

The cairoxlibsurfaceaddglyph function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service invalid write operation via unspecified vectors...

Schneider Electric MiCOM S1 Studio Improper Authorization Vulnerability

Overview This advisory provides mitigation details for a vulnerability affecting the Schneider Electric MiCOM S1 Studio Software. Independent researcher Michael Toecker of Digital Bond has identified an improper authorization vulnerability in the MiCOM S1 Studio Software using the Microsoft Attac...

First Windows 8 and Windows RT Security Updates Due Next Week

Plenty is happening on the Microsoft patch management front. First, Adobe agreed to sync up its patch release cycles with Microsoft’s on the second Tuesday of every month, moving away from quarterly releases. And now on Tuesday, Microsoft will release its first security updates since the release ...

Microsoft Releases Attack Surface Analyzer Tool

Microsoft has released a public version of its internal Attack Surface Analyzer tool, which helps organizations identify changes to a system’s attack surface as new applications are added. The tool has been in beta for a few months, but this is the first official release. The Attack Surface...

Mozilla: Invalid frees causes heap corruption in gfxImageSurface (MFSA 2012-23)

Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service...

Mozilla: Invalid frees causes heap corruption in gfxImageSurface (MFSA 2012-23)

Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service...

Thinking About Software Security Holistically

While assessing software systems of all types a few common mistakes regularly come up. These aren’t mistakes that lead directly to vulnerabilities, but mistakes in how some software companies think about security, that can lead to invalid assumptions, and ultimately which can allow real security...

GE Proficy Historian Web Administrator XSS

Overview ICS-CERT originally released Advisory ICSA-11-243-02P on the US-CERT secure Portal on August 31, 2011. ICS-CERT has received a report from independent security researchers Billy Rios and Terry McCorkle concerning multiple cross-site scripting XSS vulnerabilities in the GE Intelligent...

Source Code is the New Hacker Currency !

Source Code is the New Hacker Currency ! No doubt you've been paying attention to the data breaches pile up lately... but have you noticed a trend? If you wade through the hype and hyperbole, dig into the details of the most prolific intrusions in recent history you'll notice one thing that shine...

Football Website Manager 1.1 - SQL Injection / Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/47593/info Football Website Manager is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues to compromise the application,...