ERPSCAN Research Advisory [ERPSCAN-15-017] SAP NetWeaver J2EE DAS service - Unauthorized Access

ERPSCAN Research Advisory ERPSCAN-15-017 SAP NetWeaver J2EE DAS service - Unauthorized Access Application: SAP NetWeaver Versions Affected: SAP NetWeaver AS JAVA, probably others Vendor URL: http://SAP.com Bugs: Unauthorized access Sent: 20.04.2013 Reported: 21.04.2013 Vendor response: 21.04.2013...

VUPEN Launches New Zero-Day Acquisition Firm Zerodium

UPDATE–In the weeks since the Hacking Team breach, the spotlight has shone squarely on the small and often shadowy companies that are in the business of buying and selling exploits and vulnerabilities. One such company, Netragard, this week decided to get out of that business after its dealings...

UK Student's Research a Wassenaar Casualty

U.S.-based security researchers may soon be championing the case of Grant Wilcox, a young U.K. university student whose work is one of the few publicly reported casualties of the Wassenaar Arrangement. Wilcox last week published his university dissertation, presented earlier this spring for an...

Security Researchers Publish Comments on Wassenaar Rules

With the two-month comment period for the proposed U.S. Wassenaar Arrangement rules barely under way, a cast of influential security researchers has wasted no time preparing and submitting their thoughts on the controversial proposal. Researchers who seek out vulnerabilities in software—developin...

Proposed U.S. Wassenaar Rules on Intrusion Software

Two things worth noting from yesterday’s unveiling of the Bureau of Industry and Security’s proposed Wassenaar rules for the U.S. that weren’t so overt: a The U.S. generally leads the way in implementing Wassenaar changes, and this time it’s been beaten by the EU by almost 18 months; and b reques...

Google Awards $5k Bounty for Youtube Video Delete Bug

Student and security researcher Kamil Hismatullin recently took Google up on its vulnerability research grant offer, accepting a $1337 cash advance in exchange for a promise to seek out cross-site scripting and cross-site request forgery bugs in YouTube’s Creator Studio. While conducting that...

RedHat Update for samba RHSA-2015:0251-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Update for samba3x RHSA-2015:0249-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 6 : samba (RHSA-2015:0256)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0256 advisory. Samba is an open-source implementation of the Server Message Block SMB or Common Internet File System CIFS protocol, which allows PC-compatible...

CentOS 7 : samba (CESA-2015:0252)

Updated samba packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from...

Critical: Red Hat Security Advisory: samba security update

Updated samba packages that fix one security issue are now available for Red Hat Storage 3. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the CVE...

DLA-156-1 samba - security update

Bulletin has no description...

Feedback and data-driven updates to Google’s disclosure policy

Posted by Chris Evans and Ben Hawkes, Project Zero; Heather Adkins, Matt Moore and Michal Zalewski, Google Security; Gerhard Eschelbeck, Vice President, Google Security Disclosure deadlines have long been an industry standard practice. They improve end-user security by getting security patches to...

A Token’s Tale

Posted by James Forshaw currently impersonating NT AUTHORITY\SYSTEM. Much as I enjoy the process of vulnerability research sometimes there’s a significant disparity between the difficulty of finding a vulnerability and exploiting it. The Project Zero blog contains numerous examples of complex...

Google Offers Bug Bounty Vulnerability Research Grants

Google last week announced that it has instituted a program for 2015 in which researchers can receive up to 3,133.70 in grant money for bug hunting. Researchers must apply for the grants, which will be an up-front award that will be paid out before a bug is submitted, Google said. “Researchers’...

jetAudio 8.1.3 Basic (mp3) - Crash POC

Exploit for windows platform in category dos / poc Exploit Title : jetAudio 8.1.3 Basic Corrupted mp3 Crash POC Product : jetAudio Basic Date : 8.12.2014 Exploit Author : ITDefensor Vulnerability Research Team http://itdefensor.ru/ Software Link : http://www.jetaudio.com/download/ Vulnerable...

JetAudio 8.1.3 - '.mp4' Crash (PoC)

Exploit Title : jetAudio 8.1.3 Basic Use-after-free Corrupted mp4 Crash POC Product : jetAudio Basic Date : 12.12.2014 Exploit Author : ITDefensor Vulnerability Research Team http://itdefensor.ru/ Software Link : http://www.jetaudio.com/download/ Vulnerable version : 8.1.3 Latest at the moment an...

JetAudio 8.1.3 - .mp4 Crash (PoC)

JetAudio 8.1.3 - .mp4 Crash PoC Exploit Title : jetAudio 8.1.3 Basic Use-after-free Corrupted mp4 Crash POC Product : jetAudio Basic Date : 12.12.2014 Exploit Author : ITDefensor Vulnerability Research Team http://itdefensor.ru/ Software Link : http://www.jetaudio.com/download/ Vulnerable version...

Microsoft Internet Explorer 910 - CFormElement Use-After-Free Memory Corruption (PoC) (MS14-035)

Microsoft Internet Explorer 910 - CFormElement Use-After-Free Memory Corruption PoC MS14-035 loaded = false ; function func if loaded document.body.innerHTML = "" ; // free CFormElement input1 = document.getElementById"input1" ; input1.onclick = func ; loaded = true ; input1.click; // Call DoClic...

Microsoft Internet Explorer 8910 - CInput Use-After-Free Crash (PoC) (MS14-035)

Microsoft Internet Explorer 8910 - CInput Use-After-Free Crash PoC MS14-035 MS14-035 Internet Explorer CInput Use-after-free POC Test check var startfl=false; function changer // Call of changer function will happen inside mshtml!CFormElement::DoReset call, after execution of this function crash ...