Cisco ASA VPN Portal Cross Site Scripting

Exploit author: Juan Sacco - [email protected] Affected program: Cisco ASA VPN Portal - Zero Day Cisco ASA VPN is prone to a XSS on the password recovery page. This vulnerability can be used by an attacker to capture other user's credentials. The password recovery form fails to filter proper...

WordPress Plugin Booking Calendar Contact Form 1.0.23 - Multiple Vulnerabilities

WordPress Plugin Booking Calendar Contact Form 1.0.23 - Multiple Vulnerabilities Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin...

julietsdayspa.com XSS vulnerability

Vulnerable URL: https://www.julietsdayspa.com/products/makeup/mcategory.php?txtTitle=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

They Named it — Einstein, But $6 Billion Firewall Fails to Detect 94% of Latest Threats

The US government's $6 Billion firewall is nothing but a big blunder. Dubbed EINSTEIN, the nationwide firewall run by the US Department of Homeland Security DHS is not as smart as its name suggests. An audit conducted by the United States Government Accountability Office GAO has claimed that the...

ACTi E31 surveillance Cameras 弱密码漏洞

Introduction The Perception Point Research team has identified a 0-day local privilege escalation vulnerability in the Linux kernel. While the vulnerability has existed since 2012, our team discovered the vulnerability only recently, disclosed the details to the Kernel security team, and later...

On the Linux Zero Day, Twitter Users Looking for Answers, and Bot Fraud

Mike Mimoso and Chris Brook discuss the week in news, including the Linux zero day–how it was patched in Android, Twitter users sent nation state messages that are still looking for answers, and bot fraud. Download: ThreatpostNewsWrapJanuary222016.mp3 Music by Chris Gonsalves...

Zero-Day Flaw Found in 'Linux Kernel' leaves Millions Vulnerable

A new critical zero-day vulnerability has been discovered in the Linux kernel that could allow attackers to gain root level privileges by running a malicious Android or Linux application on an affected device. The critical Linux kernel flaw CVE-2016-0728 has been identified by a group of...

gb.last-day.org.tw Open Redirect vulnerability

Open Bug Bounty ID: OBB-125423 Description| Value ---|--- Affected Website:| gb.last-day.org.tw Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet...

Kaspersky Lab found that the Silverlight zero-day-vulnerability warning-the black bar safety net

Recently, Kaspersky Lab found in the Silverlight application in the presence of a dangerous zero-day vulnerabilities, millions of users pose a security risk. On Wednesday, in a blog post, the network security company Kaspersky said the vulnerability would allow an attacker to gain access to the...

Microsoft Silverlight Zero Day Vulnerability Patched

Microsoft Silverlight vulnerabilities certainly don’t have the same hacker cred as bugs in Adobe Flash, for example, but nonetheless, that does not diminish their value, nor does that mean they should be ignored. Microsoft patched a critical flaw in the application framework on Tuesday, and...

Linux/x86 - Egg-hunter Shellcode (13 bytes)

/ Title: Egg Hunter PoC Platform: linux/x86 Date: 2015-01-07 Author: Dennis 'dhn' Herrmann Website: https://zer0-day.pw Github: https://github.com/dhn/SLAE/ SLAE-721 / / egghunter.nasm --------------- BITS 32 global start section .text EGGSIG equ 0x4f904790 ; signature start: cdq ; zero out edx m...

Sandworm Team and the Ukrainian Power Authority Attacks

Update 1.11.16 - SANS ICS Team Connects Dots Updating the blog entry to bring attention to the recent analysis published by Mike Assante from the SANS ICS team. "After analyzing the information that has been made available by affected power companies, researchers, and the media it is clear that...

Zerodium Offers $100K for Adobe Flash Heap Isolation Bypasses

Despite calls to eliminate Adobe Flash Player, researchers inside and outside the vendor continue to invest in and build mitigations against modern attacks. As recently as three weeks ago, Adobe announced it had rewritten its memory manager, laying the groundwork for widespread heap isolation,...

GRUB2 the zero-day vulnerability affecting Linux users, Ubuntu, RHEL patch now available-vulnerability warning-the black bar safety net

Canonical's latest Ubuntu Security Notice displayed in GRUB2GNU GRand Unified Bootloader in the presence of a zero-day security vulnerability, it will affect to GRUB version 2. 0 2 Beta of the GNU/Linux distribution. The security vulnerability is Ismael Ripoll and Hector Marco found that when the...

The EPS Awakens

On September 8, FireEye published details about an attack exploiting zero day vulnerabilities in Microsoft Office CVE-2015-2545 and Windows CVE-2015-2546. The attack was particularly notable because it leveraged PostScript to drive memory corruption in a way that had never been seen before. The...

Attacks Accelerate Against Joomla Zero Day

Update Attacks are accelerating against a now-patched Joomla zero-day vulnerability, putting pressure on site administrators to update quickly. The patch was published on Monday, but not before attacks were spotted in the wild and carried out for at least two days, said researchers at security...

Save the Date — 11th December: Anonymous to Celebrate 'ISIS Trolling Day'

After hacking and taking down social media accounts of ISIS members, the online Hacktivist group Anonymous is back again with its new plan to harass the Islamic State IS militant group that was behind the horrific terror attack in Paris. Anonymous declared total war against ISIS after the last...

Sofacy APT28 Gang Using New Backdoors, Zero Days

A new analysis of the Sofacy APT gang, a Russian-speaking group carrying out targeted attacks against military and government offices for close to a decade, shows a relentless wave of intrusions peaking this summer against victims in a number of NATO countries and the Ukraine. Researchers at...

Adobe Flash Player Days Numbered

If there’s unanimity among security professionals in anything, it’s in their loathing of Adobe’s Flash Player. There’s yet to be an APT or exploit kit that hasn’t welcomed vulnerabilities in the development platform with open arms. And for all that misery tallied up in lost intellectual property...

Design/Logic Flaw

Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 have predictable technician passwords, which makes it easier for remote attackers to obtain access via the web management interface, related to a "password of the day" issue...