Exploit kits: spring 2019 review

Exploit kit activity remains fairly unchanged since our last winter review in terms of active distribution campaigns. But this spring edition will feature a new exploit kit and another atypical EK, in that it specifically goes after routers. The main driver behind these drive-by download attacks...

Underminer exploit kit improves in its latest iteration

One of the most interesting exploit kits we track is also a bit of an elusive one, and as such does not receive the same scrutiny as its RIG and Fallout counterparts. Underminer was mentioned in our Fall 2018 round up, and at the time was using CVE-2018-8174 Internet Explorer and CVE-2018-4878...

bee-cms.ru XSS vulnerability

Open Bug Bounty ID: OBB-675726 Description| Value ---|--- Affected Website:| bee-cms.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

To see the Hidden Bee how to use a new vulnerability propagation-vulnerability warning-the black bar safety net

! Write in front of words Recently we found a to attempt to exploit CVE-2018-4878 Flash Player vulnerability, vulnerability to attack, its sequence and we currently find any loopholes to use the tool are not the same. After investigation, we found that this is a Chinese security company qihoo 360...

‘Hidden Bee’ miner delivered via improved drive-by download toolkit

This blog post was authored by @hasherezade and Jérôme Segura. We recently detected a drive-by download attack trying to exploit CVE-2018-4878, a vulnerability in Flash Player, in a sequence that was not matching any of the exploit kit patterns that we currently track. Upon investigation, we...

clients.bee-on-web.fr XSS vulnerability

Open Bug Bounty ID: OBB-595234 Description| Value ---|--- Affected Website:| clients.bee-on-web.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

classifieds.fresnobee.com XSS vulnerability

Vulnerable URL: http://classifieds.fresnobee.com/ca/all-categories/search?searchtype=advanced"'--!prompt/OPENBUGBOUNTY///...

ESET Endpoint Antivirus 6 Remote Code Execution

CVE-2016-9892 - Remote Code Execution as Root via ESET Endpoint Antivirus 6 --------------------------------------------------------------------------- Summary ======= Name: Remote Code Execution as Root via ESET Endpoint Antivirus 6 CVE: CVE-2016-9892 Discoverers: Jason Geffner and Jan Bee Vendo...

Maya the Bee: Flowerparty Lite - Base64 encoded String, Customized SSL vulnerabilities

HackApp vulnerability scanner discovered that application Maya the Bee: Flowerparty Lite published at the 'play' market has multiple vulnerabilities...

Maya the Bee: Play and Learn - Base64 encoded String, Customized SSL, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Maya the Bee: Play and Learn published at the 'play' market has multiple vulnerabilities...

Bee Bubble - Base64 encoded String, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Bee Bubble published at the 'play' market has multiple vulnerabilities...

Bee Brilliant - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Bee Brilliant published at the 'play' market has multiple vulnerabilities...

sewing-bee.co.uk XSS vulnerability

Vulnerable URL: http://www.sewing-bee.co.uk/shop/basketnew.php?pagefile=" Details: Description| Value ---|--- Patched:| Yes, at 07.12.2015 Latest check for patch:| 07.12.2015 16:22 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google...

Design/Logic Flaw

The Juniper MX Series routers with Junos 13.3R3 through 13.3Rx before 13.3R6, 14.1 before 14.1R4, 14.1X50 before 14.1X50-D70, and 14.2 before 14.2R2, when configured as a broadband edge BBE router, allows remote attackers to cause a denial of service jpppd crash and restart by sending a crafted P...

WordPress Busy Bee Theme - Remote Code Execution

There are a bug in this theme, that allows any website visitor to run and see the output of any shortcode. This gives unauthenticated visitors the same power to execute code on the server as regular publishers have. Solution Update the theme...

Bee-hive 1.2 - Multiple Remote File Include Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/18654/info Bee-hive is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application. An attacker may leverage these issues to have an arbitrary remote...

[bWAPP] an extremely buggy web application!

bWAPP, or a buggy web application, is a deliberately insecure web application. bWAPP helps security enthusiasts, developers and students to discover and to prevent web vulnerabilities. bWAPP prepares to conduct successful penetration testing and ethical hacking projects. What makes bWAPP so uniqu...

[RemotePasswordWiFi] Script in Ruby, for search passwords WiFi of remote routers

Script in Ruby, for search passwords WiFi of remote routers. Support Routers: Thomson Thechnicolor in next days: bee cisco Download RemotePasswordWiFi...

CVE-2006-3266

Multiple PHP remote file inclusion vulnerabilities in Bee-hive Lite 1.2 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 header parameter to a conad/include/rootGui.inc.php and b include/rootGui.inc.php; 2 mysqlCall parameter to...

CVE-2006-3266

Multiple PHP remote file inclusion vulnerabilities in Bee-hive Lite 1.2 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 header parameter to a conad/include/rootGui.inc.php and b include/rootGui.inc.php; 2 mysqlCall parameter to...