Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-4086

Dear List, I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability. Check Point Software Technologies - Vulnerability Discovery Team VDT http://www.checkpoint.com/defense/ Memory corruption when Adobe Shockwave Player parses .dir media file...

[CORE-2010-0624] MS OpenType CFF Parsing Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ MS OpenType CFF Parsing Vulnerability 1. Advisory Information Title: MS OpenType CFF Parsing Vulnerability Advisory Id: CORE-2010-0624 Advisory URL:...

Users Still Making Life Easy for Scareware Crews

Scareware and rogue AV programs have enjoyed a very good run in the last few years, making millions of dollars for their creators and generally making life miserable for victims. And while there’s been some innovation recently in the mechanisms attackers use to keep the programs resident on...

AV Music Morpher Gold 5.0.38 Denial Of Service

!/usr/bin/python Exploit Title: AV Music Morpher Gold .m3u Local Crash PoC Date: 08-20-2010 Author: b0telh0 Software Link: http://www.musicmorpher.com/download.php?product=musicgold Version: 5.0.38 Tested on: Windows XP SP3 pt-br VirtualBox .acd and .bdi files will crash the application too! cras...

AV Music Morpher Gold 5.0.38 (.m3u) Denial of Service

Exploit for windows platform in category dos / poc ===================================================== AV Music Morpher Gold 5.0.38 .m3u Denial of Service ===================================================== !/usr/bin/python Exploit Title: AV Music Morpher Gold .m3u Local Crash PoC Date:...

AV Music Morpher Gold 5.0.38 - '.m3u' Denial of Service

!/usr/bin/python Exploit Title: AV Music Morpher Gold .m3u Local Crash PoC Date: 08-20-2010 Author: b0telh0 Software Link: http://www.musicmorpher.com/download.php?product=musicgold Version: 5.0.38 Tested on: Windows XP SP3 pt-br VirtualBox .acd and .bdi files will crash the application too! cras...

AV Arcade 'ava_code' Cookie Parameter SQL Injection Vulnerability

AV Arcade is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-2933

SQL injection vulnerability in AV Scripts AV Arcade 3 allows remote attackers to execute arbitrary SQL commands via the avacode cookie to the "main page," related to index.php and the login task...

Sql injection

SQL injection vulnerability in AV Scripts AV Arcade 3 allows remote attackers to execute arbitrary SQL commands via the avacode cookie to the "main page," related to index.php and the login task...

CVE-2010-2933

The CVE-2010-2933 entry describes an SQL injection in AV Arcade 3 (AV Scripts) that can be triggered through the ava_code cookie sent to the main page (index.php, login task). Affected component: web application logic handling the ava_code cookie. Root cause: improper handling/validation of the c...

CVE-2010-2933

SQL injection vulnerability in AV Scripts AV Arcade 3 allows remote attackers to execute arbitrary SQL commands via the avacode cookie to the "main page," related to index.php and the login task...

AV Arcade 3 - Cookie Authentication Bypass

AV Arcade 3 - Cookie Authentication Bypass :----------------------------------------------------------------------------: : Software : AV Arcade v3 PHP : : Site : www.avscripts.net : : Date : 28/07/2010 : : Author : saudi0hacker : : Type : Auth Bypass / Cookie : : Greetz to : pr.al7rbi : so busy ...

AV Arcade 3 Insecure Cookie / SQL Injection

:----------------------------------------------------------------------------: : Software : AV Arcade v3 PHP : : Site : www.avscripts.net : : Date : 28/07/2010 : : Author : saudi0hacker : : Type : Auth Bypass / Cookie : : Greetz to : pr.al7rbi : so busy : evil-ksa : Dr.dakota : v4-team.com :...

AV Arcade 3 - Cookie Authentication Bypass

:----------------------------------------------------------------------------: : Software : AV Arcade v3 PHP : : Site : www.avscripts.net : : Date : 28/07/2010 : : Author : saudi0hacker : : Type : Auth Bypass / Cookie : : Greetz to : pr.al7rbi : so busy : evil-ksa : Dr.dakota : v4-team.com :...

Rogue AV Live Tech Support

This is a recording of a live chat session with the technical support agent associated with a rogue AV program. The session was recorded by Nicolas Brulez, a security analyst at Kaspersky Lab.The video is best viewed in full-screen mode...

The Rise of the Rogue AV Testers

By Costin Raiu Recently, I was sitting around with a number of colleagues from Kaspersky Lab, discussing everybody’s favorite subject: the state of anti-virus testing these days. During the talks, somebody brought up the name of a new, obscure testing organization in the Far East. Nobody else had...

How to Run a Scareware Campaign

The infection routines being used by some scareware and rogue AV gangs are much more comprehensive and far-reaching than many current analyses have shown, experts say, including some attacks that not only place a malicious script on a compromised server, but infect every single legitimate script ...

Scareware, Black Hat SEO and You

The scareware and rogue AV problem that initially appeared a few years ago and has since found its way onto thousands and thousands of legitimate Web sites, including The New York Times home page, has now reached epidemic levels. The scams are mostly boilerplate and well-understood, but it’s not...

GoDaddy's WordPress, PHP Sites Hacked Again

WordPress users whose websites are hosted on GoDaddy servers have been targeted by fake AV peddlers yet again. Read the full article. Help Net Security...

AV Arcade Cross Site Scripting

Exploit Title: AV Arcade Search Field XSS/HTML Injection Date: 6/5/2010 Author: Vadim Toptunov, http://www.twitter.com/pentesting Software Link: http://www.avscripts.net/avarcade/ Version: 5.1.4 Free and Pro latest and prior Tested on: Any NIX CVE : N/a Code : below Description: AV arcade is a fr...