VMware Releases Security Patch for ESX

VMware has released a security patch for ESX to address a vulnerability. Exploitation of this vulnerability may allow a local user to gain additional privileges on the affected system. US-CERT encourages users and administrators to review VMware knowledgebase article 1029397 and apply any necessa...

Apple Releases iOS 4.2

Apple has released iOS 4.2 for the iPhone, iPod Touch, and iPad to address multiple vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code, initiate a call, cause a denial-of-service condition, gain system privileges, or obtain sensitive information...

Apple Patches Safari Browser Holes

Apple on Thursday issued updates for its Safari Web browser to fix more than two dozen vulnerabilities that left the browser open to Web-based attacks. The company released Safari versions 5.0.3 and 4.1.3 for Mac OS X and Windows XP SP2, Vista and Windows 7. The updated versions fix 27 reported...

Apple Releases Safari 5.0.3 and 4.1.3

Apple has released Safari 5.0.3 and 4.1.3 to address multiple vulnerabilities in the Safari and WebKit packages. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition. US-CERT encourages users and administrators to review Apple article HT4455...

Adobe Flash Player Flash Content Parsing Code Execution

Added: 11/16/2010 CVE: CVE-2010-3654 BID: 44504 OSVDB: 68932 Background Adobe Reader is free software for viewing PDF documents. Problem Adobe Reader 9.x is vulnerable to a remote code execution vulnerability as a result of parsing flash content by the bundled Adobe Flash Player. Resolution Apply...

Adobe Releases Security Updates for Reader and Acrobat

Adobe has released security updates for Reader and Acrobat for Windows and Macintosh. These updates address multiple vulnerabilities including those described in security advisory APSA10-05, a recent Adobe PSIRT blog entry, and security bulletin APSB10-26. Exploitation of these vulnerabilities ma...

MOXA Device Manager Tool 2.1 - Remote Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MOXA Device Manager Tool 2.1 Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in MOXA MDM Tool 2.1. When sending ...

Wyse Rapport Hagent Fake Hserver Command Execution

Wyse Rapport Hagent Fake Hserver Command Execution. CVE-2009-0695. Remote exploits for multiple platform $Id: hagentuntrustedhsdata.rb 10998 2010-11-11 22:43:22Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the...

Adobe Releases Security Update for Flash Media Server

Adobe has released Flash Media Server 4.0.1, 3.5.5, and 3.0.7 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review Adobe security bulletin APSB10-27 and apply appropriate updates to help...

Exposing SCADA Systems With Shodan

Editor’s Note: The U.S.’s Industrial Control System Computer Emergency Response Team ICS-CERT recently issued a warning to its members about the ability of attackers to discover ICS systems using a simple search on Shodan, a public search engine that is used to locate systems accessible from the...

Insecure Loading of Dynamic Link Libraries in Windows Applications

US-CERT is aware of a class of vulnerabilities related to how some Windows applications may load external dynamic link libraries DLLs. When an application loads a DLL without specifying a fully qualified path name, Windows will attempt to locate the DLL by searching a defined set of directories. ...

Microsoft Releases November Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Office and Forefront United Access Gateway as part of the Microsoft Security Bulletin Summary for November 2010. These vulnerabilities may allow an attacker to execute arbitrary code or operate with elevated privileges. US-CER...

Cisco Releases Vulnerability Alert for Intelligent Contact Manager

Cisco has released a vulnerability alert to inform users of a vulnerability affecting the Intelligent Contact Manager Setup Manager. This vulnerability may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the vulnerability alert and consider...

Microsoft Releases Security Advisory for Internet Explorer

Microsoft has released Microsoft security advisory 2458511 to alert users of a vulnerability affecting all supported versions of Internet Explorer. This vulnerability may allow an attacker to execute arbitrary code. Update: Microsoft has released two Fix it tools in Microsoft Support article...

Search Engine Finds Vulnerable SCADA Systems

UPDATED: ICS-CERT, the emergency response team for industrial control systems, has warned companies that run SCADA Supervisory Control and Data Acquisition software that the systems running it may be easily discovered using a free Web based search engine dubbed Shodan. The warning came in the for...

nSense-2010-002: Teamspeak 2 Windows client

nSense Vulnerability Research Security Advisory NSENSE-2010-002 --------------------------------------------------------------- t2'10 infosec conference special release http://www.t2.fi --------------------------------------------------------------- Affected Vendor: Teamspeak Systems GmbH Affecte...

Adobe Releases Security Update for Shockwave Player

Adobe has released a security update for Shockwave Player to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review Adobe security bulletin APSB10-25 and apply any necessary updates to help...

Adobe Releases Security Bulletin for Flash Player, Reader, and Acrobat

Adobe has released a security advisory to alert users of a vulnerability affecting the following applications: Adobe Flash Player 10.1.85.3 and earlier for Windows, Macintosh, Linux, and Solaris Adobe Flash Player 10.1.95.2 and earlier for Android Adobe Reader 9.4 and earlier 9.x versions for...

Firefox 3.5 and 3.6 Vulnerability

Mozilla has released a blog entry indicating that it is aware of a critical vulnerability affecting Firefox 3.5 and Firefox 3.6. This vulnerability may allow an attacker to execute arbitrary code. The blog entry indicates that active exploitation of this vulnerability has been detected. Update: T...

Cisco Releases Security Advisory for CiscoWorks Common Services

Cisco has released a security advisory to address a vulnerability affecting CiscoWorks Common Services for Oracle Solaris and Microsoft Windows. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code with administrative privileges or cause a denial-of-service...