2461 matches found
The Great DOM Fuzz-off of 2017
Posted by Ivan Fratric, Project Zero Introduction Historically, DOM engines have been one of the largest sources of web browser bugs. And while in the recent years the popularity of those kinds of bugs in targeted attacks has somewhat fallen in favor of Flash which allows for cross-browser exploi...
MGASA-2017-0284 Updated cvs package fixes security vulnerability
It was discovered that CVS, a centralised version control system, did not correctly handle maliciously constructed repository URLs, which allowed an attacker to run an arbitrary shell command CVE-2017-12836...
CVE-2017-12637
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. Recen...
CVE-2015-4035
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name...
Vulnerability of Android operating system libraries, allowing a hacker to execute arbitrary code
The vulnerability of Android operating system libraries is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2017-8482
creationtimestamp| type| source ---|---|--- 2017-06-21 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42220...
CVE-2017-9747
creationtimestamp| type| source ---|---|--- 2017-06-19 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42200...
ISC Releases Security Updates for BIND
The Internet Systems Consortium ISC has released updates that address several vulnerabilities in BIND. An attacker could exploit one of these vulnerabilities to take control of an affected system. Available updates include: BIND version 9.11.1-P1 BIND version 9.10.5-P1 BIND version 9.9.10-P1 ISC...
Microsoft Plugs Three Zero Day Holes as Part of May Patch Tuesday
Microsoft patched three zero day vulnerabilities actively under attack today as part of its May Patch Tuesday release. Researchers with FireEye who uncovered the three vulnerabilities said the bugs were actively being exploited by threat actors Turla and APT28. Two of the zero day vulnerabilities...
CVE-2017-3503
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Web Access Apache Commons BeanUtils. Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows low...
CVE-2017-3493
Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications subcomponent: Infrastructure. Supported versions that are affected are 12.0.0 and 12.1.0. Easily "exploitable" vulnerability allows low privileged attacker with...
Exception-oriented exploitation on iOS
Posted by Ian Beer, Project Zero This post covers the discovery and exploitation of CVE-2017-2370, a heap buffer overflow in the machvoucherextractattrrecipetrap mach trap. It covers the bug, the development of an exploitation technique which involves repeatedly and deliberately crashing and how ...
CVE-2017-2931
creationtimestamp| type| source ---|---|--- 2017-03-15 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41608 2025-08-31 03:01:29+00:00| seen| MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d...
Fiyo CMS 2.0.6.1 - Privilege Escalation
Fiyo CMS 2.0.6.1 - Privilege Escalation Exploit Title: Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter Google Dork: no Date: 11-03-2017 Exploit Author: @runggareksya, @dvnrcy Vendor Homepage: http://www.fiyo.org Software Link:...
CVE-2016-7288
creationtimestamp| type| source ---|---|--- 2017-02-14 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41357 2017-05-02 17:40:03+00:00| published-proof-of-concept| https://t.me/informationsecuritychannel/4664 2024-10-29 18:47:37+00:00| published-proof-of-concept|...
vsaudit - VOIP Security Audit Framework
This is an opensource tool to perform attacks to general voip services It allows to scans the whole network or single host to do the gathering phase, then it is able to search for most known vulnerabilities on the founds alive hosts and try to exploit them. Install dependencies To start using...
CVE-2016-9554
creationtimestamp| type| source ---|---|--- 2016-12-12 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41414...
CVE-2016-9150
creationtimestamp| type| source ---|---|--- 2016-11-18 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/40790...
Linux Kernel Information Disclosure Vulnerability (CNVD-2016-11074)
The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. Linux Kernel has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...