CVE-2014-8754

CVE-2014-8754 : Open redirect in WordPress Ad-Manager plugin ≤1.1.2 (track-click.php) allows a remote attacker to redirect victims to arbitrary sites via the out parameter, enabling phishing. Affected: WordPress Ad-Manager plugin 1.1.2. Root cause: unvalidated out parameter in track-click.php. Im...

WordPress Ad-Manager 1.1.2 Open Redirect

CVE-2014-8754 WordPress “Ad-Manager Plugin” Dest Redirect Privilege Escalation Exploit Title: WordPress Ad-Manager Plugin Dest Redirect Privilege Escalation Vulnerability Product: WordPress Ad-Manager Plugin Vendor: CodeCanyon Vulnerable Versions: 1.1.2 Tested Version: 1.1.2 Advisory Publication:...

Ad Manager <= 1.1.2 - Open Redirection

The wordpress-admanager WordPress plugin was affected by an Open Redirection security vulnerability...

Angler Exploit Kit Adds New Flash Exploit

Exploit kit authors are nothing if not opportunistic, and they know a prime opportunity when they see one. Adobe Flash bugs fit that description nicely, and the people behind the Angler exploit kit already are exploiting one of the Flash bugs patched last week in the kit’s arsenal. This is a comm...

UBUNTU-CVE-2014-8769

tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of service packet loss or segmentation fault via a crafted Ad hoc On-Demand Distance Vector AODV packet, which triggers an out-of-bounds memory access...

AT&T Drops Controversial Tracking Header

When information came out earlier this month that some mobile carriers were injecting unique identifying “supercookies” into their users’ Web traffic, privacy groups and users were angered. The practice, used by Verizon and AT&T, enables advertisers to track users’ behavior and assemble informati...

openSUSE Security Update : sssd (openSUSE-SU-2014:1407-1)

sssd was updated to new upstream release 1.12.2 bugfix release, bnc900159 Changes : - Fixed a regression where the IPA provider did not fetch User Private Groups correctly - An important bug in the GPO access control which resulted in a wrong principal being used, was fixed. - Several new options...

Microsoft Active Directory Federation Services Information Disclosure Vulnerability (3003381)

This host is missing an important security update according to Microsoft Bulletin MS14-077. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2014-6331

Microsoft Active Directory Federation Services AD FS 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active...

CVE-2014-6331

CVE-2014-6331 affects Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1 and 3.0. The vulnerability arises when a configured SAML Relying Party lacks a sign-out endpoint and logoff actions are not processed correctly, enabling information disclosure and potential access via an unatte...

KLA10612 Information disclosure vulnerability in Microsoft AD Federation Services

An unspecified vulnerability was found in Microsoft AD Federation Services. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via unattended workstation manipulations. Original advisories CVE-2014-6331 Related products...

Malicious Ads on Yahoo, AOL, Trigger CryptoWall Infections

Attackers have been leveraging the FlashPack Exploit Kit to peddle the CryptoWall 2.0 ransomware on unsuspecting visitors to sites such as Yahoo, The Atlantic and AOL. Researchers believe that for about a month the malvertising campaign hit up to 3 million visitors and netted the attackers $25,00...

Google Search Algorithm to Demote Piracy Sites In Search Results

The Search Engine giant is not going to spare the Pirated content providing sites. Google is ready to fulfill its commitment to downgrade the search rankings of ‘notorious’ piracy sites globally that often rank above legal and commercial sites. Google and the Copyright holders are, to some extent...

Operation DeathClick APT Malvertising Campaign

Advanced persistent threat groups are using malvertising in order to compromise the networks of their adversaries in what appears to be an example of high-level, nation-state attackers borrowing tactics from the typically less sophisticated cybercriminal arsenals. Attackers are also borrowing fro...

Facebook to Double Bounty Payouts For Ad Code Bugs

Popular segments of Facebook code have plenty of white—and black hats—poking around for bugs. The same probably cannot be said for the social network’s ads code, so Facebook has decided to add an incentive to its bug bounty program. Through the end of the year, payments will be doubled for bugs...

WordPress Ad Manager Plugin <=1.1.2 - Open Redirect

This vulnerability is in the track-click.php. It allows the attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the "out" parameter. Solution Update the plugin...

Kyle and Stan Malvertising Network Nine Times Bigger

The Kyle and Stan malvertising network has a much bigger reach than first reported—about nine times bigger. In the two weeks since Cisco’s first report on the malicious ad distribution campaign, researchers had a chance to look closer at telemetry data, connect more dots and learn that nearly 6,5...

X (Formerly Twitter): Delete Credit Cards from any Twitter Account in ads.twitter.com [New Vulnerability]

i've found a new critical logical vulnerability that allow deleteing credit card of any twitter account in ads.twitter.com , the vulnerability affects the Dismiss functionality of credit cards in payments methods section the vulnerability is similair to the one i've reported earlier h1 report 272...

Okta AD Agent Installed (Windows)

Binary data oktaadagentinstalled.nbin...

Java.com, TMZ Serving Malvertising Redirects to Angler Kit

Online ad network AppNexus has again been identified at the core of another malvertising campaign using the Angler Exploit Kit to redirect visitors to sites hosting the Asprox malware. Busy, popular websites including TMZ, Photobucket and Java.com in recent days have been serving malicious...