[SSL Certificate Downloader] Command-line Tool to grab SSL Certificate from Server Remotely

SSL Cert Downloader is a free command-line tool to grab SSL certificate from server remotely. It can be used to download certificate from any of the SSL enabled services including HTTPS 443 LDAPS 636 SMTPS 465 POPS 995 IMAPS 993 You can either specify IP address or host name of the server. Also y...

Java CMM Remote Code Execution

This module abuses the Color Management classes from a Java Applet to run arbitrary Java code outside of the sandbox as exploited in the wild in February and March of 2013. The vulnerability affects Java version 7u15 and earlier and 6u41 and earlier and has been tested successfully on Windows XP...

Microsoft, Symantec Join Forces to Take Down Bamital Click-Fraud Botnet

Microsoft and Symantec have shut down a massive click fraud botnet known as Bamital, numerous variants of which have been in circulation since 2009 amassing several million dollars in fraudulent profit for the attackers as well as spreading more malware including scareware. The botnet thrived on...

DNS Changer malware mastermind pleaded guilty

Remember the DNS Changer malware that infected at least four million computers in more than 100 countries, including 500,000 in the United States, with malicious software or malware ? Valeri Aleksejev, 32 years old from Estonia, is the first of the seven individuals to enter a plea, admitting his...

DNS Changer malware mastermind pleaded guilty

Remember the DNS Changer malware that infected at least four million computers in more than 100 countries, including 500,000 in the United States, with malicious software or malware ? Valeri Aleksejev, 32 years old from Estonia, is the first of the seven individuals to enter a plea, admitting his...

Firefox Continues to Curb Out-of-Date, Flawed Third-Party Plug-ins

After pushing its “click-to-play” blacklisting function live last fall, Mozilla has announced plans to further implement the security feature in its Firefox browser. The company is planning to make it so only the most recent version of Flash is automatically run on web pages while users will have...

Java Applet Reflection Type Confusion Remote Code Execution

This module abuses Java Reflection to generate a Type Confusion, due to a weak access control when setting final fields on static classes, and run code outside of the Java Sandbox. The vulnerability affects Java version 7u17 and earlier. This exploit bypasses click-to-play throw a specially craft...

phpwcms <= v1.5.4.6 "preg_replace" Multiple Vulnerabilities

Exploit for php platform in category web applications ?php / phpwcms = v1.5.4.6 "pregreplace" remote code execution exploit vendor: http://www.phpwcms.de/ Download: github.com/slackero/phpwcms by: aeon Well it appears there are multiple remote code execution bugs that exists in phpwcms for quite...

PHPWCMS 1.5.4.6 - 'preg_replace' Multiple Vulnerabilities

?php / phpwcms = v1.5.4.6 "pregreplace" remote code execution exploit vendor: http://www.phpwcms.de/ Download: github.com/slackero/phpwcms by: aeon Well it appears there are multiple remote code execution bugs that exists in phpwcms for quite some time now. Here I will exploit one of them, but ma...

ESA-2012-052 RSA NetWitness Informer Cross-Site Request Forgery and Click-jacking Vulnerabilities

ESA-2012-052.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-052: RSA NetWitness Informer Cross-Site Request Forgery and Click-jacking Vulnerabilities EMC Identifier: ESA-2012-052 CVE Identifier: CVE-2012-4608 CVE Identifier: CVE-2012-4609 Severity Rating: CVSS v2 Base Score: 6. 8...

Fedora 18 : firefox-17.0-1.fc18 / thunderbird-17.0-1.fc18 / thunderbird-enigmail-1.4.6-2.fc18 / etc (2012-18731)

First revision of the Social API and support for Facebook Messenger - Click-to-play blocklisting implemented to prevent vulnerable plugin versions from running without the user's permission see blog post - Updated Awesome Bar experience with larger icons - JavaScript Maps and Sets are now...

Mozilla Releases Firefox 17 with Click-to-Play, Updates Firefox for Android

Mozilla pushed out the latest build of its flagship browser, Firefox 17, today, adding a new click-to-play blocklisting feature that will help prevent users from running out-of-date or vulnerable versions of plug-ins or extensions. The update tweaks click-to-play in Firefox prompting users to...

Mozilla Adding More Stringent HTTPS Enforcement to Firefox

Mozilla is adding an extra layer of security in its Firefox browser by implementing HTTP Strict Transport Security HSTS, a mechanism that will force some sites into establishing a secure, HTTPS connection with the browser if its presented with the right certificate. According to an entry on...

Multiplatform Java Jacksbot Malware infecting Windows, Linux and Mac

Intego discovered a Multiplatform Java Malware called "Jacksbot" , which is infecting Windows, Linux and Mac systems. The Jacksbot is described as a 'backdoor Trojan Java "on infected computers and collects system information, make screenshots, delete files, steal passwords and perform click frau...

ZeroAccess Botnet Cashing in on Click Fraud and Bitcoin Mining

A mid-year switch in communication protocol and distribution strategy is behind a spike in activity from the ZeroAccess botnet, a prolific and malicious ad click fraud network. Researchers at Kindsight Security Lab reported today that ZeroAccess accounts for 29 percent of home network infections ...

Indian CERT issue warning about ongoing Skype Spam attack

Last month we reported a worm targeting Skype users with spam messages designed to infect machines with the Dorkbot ransomware has been discovered. This malware is spreading through a question/ phrase sent to the users by someone and the question is: "lol is this your new profile pic?" Same spam...

Mozilla Patches Cross-Site Scripting Flaws in Firefox

Mozilla is delivering security updates fast and furious this month, the latest coming late last week when a new version of Firefox repaired three vulnerabilities related to the Location object. The Location object is supported by all major browsers and contains information about the URL being...

Spam campaign tricking thousands with shortened .gov URLs

Symantec has reported an increase in spam messages containing .gov URLs. Cybercriminals are using 1.usa.gov links in their spam campaigns to trick users into thinking the links lead to genuine US government Web sites. Spammers have created these shortened URLs through a loophole in the URL...

SeaMonkey < 2.13 Multiple Vulnerabilities

The installed version of SeaMonkey is affected by the following vulnerabilities : - Several memory safety bugs exist in the browser engine used in Mozilla-based products that could be exploited to execute arbitrary code. CVE-2012-3983 - '' elements can be abused to cover arbitrary portions of a...

Mozilla Thunderbird < 16.0 Multiple Vulnerabilities

The installed version of Thunderbird is earlier than 16.0 and thus, is affected by the following vulnerabilities : - Several memory safety bugs exist in the browser engine used in Mozilla-based products that could be exploited to execute arbitrary code. CVE-2012-3983 - '' elements can be abused t...