apache-commons-collections: InvokerTransformer code execution during deserialisation

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

Easy File Sharing Web Server 7.2 - Remote Buffer Overflow (SEH) (DEP Bypass + ROP)

!/usr/bin/env python Exploit title: Easy File Sharing Web Server v7.2 - Remote SEH Buffer Overflow DEP bypass with ROP Date: 29/11/2015 Exploit Author: Knaps Contact: @TheKnapsy Website: http://blog.knapsy.com Software Link: http://www.sharing-file.com/efssetup.exe Version: Easy File Sharing Web...

Commons Collections the Java deserialization vulnerability in-depth analysis-vulnerability warning-the black bar safety net

0x01 background This year so far Java the greatest influence on vulnerability than this period of time lasts a fiery CommonsCollections deserialization vulnerability. In 2 0 1 5 year 1 1 May 6, FoxGlove security team@breenmachine published a lengthy blog post, borrowed from Java deserialization,...

Juniper Networks Junos OS IPv6 mbuf Chain DoS Vulnerability

Junos OS is prone to a DoS vulnerability in the mbuf chain. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if...

apache-commons-collections: InvokerTransformer code execution during deserialisation

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

Inside the Conficker-Infected Police Body Cameras

Rarely does one story run such a gamut of security threats, encapsulating in this case, Internet of Things risks, supply chain infiltration and some circa-2008 malware for good measure. But that’s what we have with this week’s saga of the body cameras, marketed for police use, that were shipped...

The vulnerability of the Oracle Supply Chain Management system allows a perpetrator to modify data.

The vulnerability of the Oracle Agile PLM component of the Oracle Supply Chain Management system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to remotely modify data...

The vulnerability of the Oracle Supply Chain Management system allows a perpetrator to gain unauthorized access and read data.

The vulnerability of the Oracle Configurator component in the Oracle Supply Chain Management system is related to errors in the code. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to read data...

The vulnerability of the Oracle Supply Chain Management system allows a perpetrator to modify data.

The vulnerability of the Oracle Agile PLM component of the Oracle Supply Chain Management system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to remotely modify data...

The vulnerability of the Oracle Supply Chain Management system allows a perpetrator to modify data.

The vulnerability of the Oracle Configurator component in the Oracle Supply Chain Management system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to remotely modify data...

The vulnerability of the Oracle Supply Chain Management system allows a perpetrator to gain unauthorized access and read data.

The vulnerability of the Oracle Agile PLM component in the Oracle Supply Chain Management system is related to errors in the code. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to read data...

The vulnerability of the Oracle Supply Chain Management system allows a perpetrator to modify data.

The vulnerability of the Oracle Agile PLM component of the Oracle Supply Chain Management system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to remotely modify data...

Hack The Galaxy: Hunting Bugs in the Samsung Galaxy S6 Edge

Posted by Natalie Silvanovich, Planner of Bug Bashes Recently, Project Zero researched a popular Android phone, the Samsung Galaxy S6 Edge. We discovered and reported 11 high-impact security issues as a result. This post discusses our motivations behind the research, our approach in looking for...

CVE-2009-0265

Internet Systems Consortium ISC BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 and...

Alreader 2.5 .fb2 - SEH Based Stack Overflow (ASLR and DEP bypass) Vulnerability

Exploit for windows platform in category local exploits !/usr/bin/env python Exploit Title: Alreader 2.5 .fb2 SEH Based Stack Overflow ASLR and DEP bypass Date: 25.10.2015 Category: Local Exploit Exploit Author: g00dv1n Contact: email protected Version: 2.5 Tested on: Windows XP SP3 / Windows 7 /...

Alreader 2.5 .fb2 - Based Stack Overflow (SEH) (ASLR + DEP Bypass)

Alreader 2.5 .fb2 - Based Stack Overflow SEH ASLR + DEP Bypass !/usr/bin/env python Exploit Title: Alreader 2.5 .fb2 SEH Based Stack Overflow ASLR and DEP bypass Date: 25.10.2015 Category: Local Exploit Exploit Author: g00dv1n Contact: [email protected] Version: 2.5 Tested on: Windows XP...

CVE-2015-4917

Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-4892...

Security feature bypass

Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-4892...

Unspecified Vulnerability in Oracle Supply Chain Products Suite (CNVD-2015-06970)

Oracle Supply Chain Products Suite is the United States Oracle Oracle, Inc. of a global supply chain business to plan, manage and optimize the fully integrated system. An unspecified vulnerability exists in Oracle Supply Chain Products Suite 9.3.3 that could allow an authenticated remote user to...

Unspecified Vulnerability in Oracle Supply Chain Products Suite (CNVD-2015-06969)

Oracle Supply Chain Products Suite is the United States Oracle Oracle, Inc. of a global supply chain business to plan, manage and optimize the fully integrated system. An unspecified vulnerability exists in Oracle Supply Chain Products Suite 9.3.4. Allowing an authenticated remote user to...