Sony PC Companion 2.1 (Load()) Stack-based Unicode Buffer Overflow

The vulnerability is caused due to a boundary error in PimData.dll when handling the value assigned to the 'File' item in the Load function and can be exploited to cause a stack-based buffer overflow via an overly long string which may lead to execution of arbitrary code on the affected machine...

Persistent Input Validation Zero Day Patched by PayPal

PayPal patched a zero-day vulnerability this week in its core content management system. Researchers at Vulnerability Laboratory in Germany reported the flaw in June and withheld disclosure of the details until this week when PayPal released a fix. Benjamin Kunz Mejri, a frequent PayPal bug hunte...

Samsung Smart TV Bug Allows Remote Access, Root Privileges

It turns out that some smart TVs are a little too smart for their own good–and the good of users. Some specific models of Samsung TVs that have Wi-Fi and other advanced capabilities have a flaw that enables an attacker to take a variety of actions on the TV, including accessing potentially...

Samsung smart TV vulnerability allow attacker to read storage remotely

ReVuln Ltd. , a small security company headed by Donato Ferrante and Luigi Auriemma, post a video that demonstrates that how attacks can gain root on the appliances. Samsung Smart TV contain a vulnerability which allows remote attackers to swipe data from attached storage devices. In this...

Experts Downplay MySQL Database Zero-Days

A rash of zero-day exploits and vulnerabilities in the MySQL database were disclosed to the Full Disclosure mailing list over the weekend, but experts are saying they’re much ado about nothing. Of the half-dozen zero-days reported by a researcher known as King Cope, all but one require legitimate...

Multiple MySQL database Zero-day vulnerabilities published

Researcher discovered Multiple Zero-day vulnerabilities in MySQL database software including Stack based buffer overrun, Heap Based Overrun, Privilege Elevation, Denial of Service and Remote Preauth User Enumeration. Common Vulnerabilities and Exposures CVE assigned as : CVE-2012-5611 — MySQL Lin...

Advantech Studio v7.0 SCADA/HMI Directory Traversal 0-day

Exploit for windows platform in category web applications Exploit Title: Advantech Studio v7.0 SCADA/HMI Directory Traversal 0-day Google Dork: N/A Date: 2012-12-03 Exploit Author: Nin3 Vendor Homepage: http://advantech.com.tw Version: 7.0 Build Number 0501.1111.0402.0000 Tested on: Windows CVE :...

FreeFTPD Remote Authentication Bypass Zeroday Exploit

Exploit for windows platform in category remote exploits FreeFTPD all versions Remote System Level Exploit Zero-Day -- No username needed, straightforward rooting! Discovered & Exploited By Kingcope Year 2011 -- http://www.exploit-db.com/sploits/23079.zip Example banner: WeOnlyDo-wodFTPD 2.3.6.16...

freeFTPd 1.2.6 - Remote Authentication Bypass

FreeFTPD all versions Remote System Level Exploit Zero-Day -- No username needed, straightforward rooting! Discovered & Exploited By Kingcope Year 2011 -- https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23079.zip Example banner: WeOnlyDo-wodFTPD 2.3.6.165 This...

MySQL Denial of Service Zeroday PoC

Exploit for linux platform in category dos / poc 5.5.19-log on SuSE Linux DoS exploit: -------------------------------------------------------------------------------------------------------- use Net::MySQL; use Unicode::UTF8 qwdecodeutf8 encodeutf8; $|=1; my $mysql = Net::MySQL-new hostname =...

freeFTPd 1.2.6 - Remote Authentication Bypass

freeFTPd 1.2.6 - Remote Authentication Bypass FreeFTPD all versions Remote System Level Exploit Zero-Day -- No username needed, straightforward rooting! Discovered & Exploited By Kingcope Year 2011 -- https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/23079.zip...

MySQL Remote Preauth User Enumeration Zeroday

Exploit for windows platform in category remote exploits MySQL User Account Enumeration Utility When an attacker authenticates using an incorrect password with the old authentication mechanism from mysql 4.x and below to a mysql 5.x server the mysql server will respond with a different message th...

Spear Phishing Remains Preferred Point of Entry in Targeted, Persistent Attacks

Persistent targeted attacks against the government, financial services, manufacturing and critical infrastructure take on many characteristics. Attackers can have different backgrounds and motivations, and the tools they use can range from commodity malware to zero-day exploits. One characteristi...

Java zero-day exploit sold in underground Market

Once again a zero day vulnerability exploit is sold by cyber criminals in the underground, once again a the flaw is related to Oracle's Java software that could allow to gain remote control over victim's machine. The news has been reported by KrebsOnSecurity blog that announced that the exploit...

Chrome Zero-Day Presentation Gives Way to Mandatory Military Service

The saga of the latest zero-day vulnerability and exploit for the Google Chrome browser took another mysterious turn over the weekend. The 19-year-old Georgian security researcher who found the vulnerability in the browser was called up for compulsory military duty in his country and was unable t...

Indusoft Thin Client ISSymbol ActiveX Control InternationalSeparator buffer overflow

Added: 11/13/2012 CVE: CVE-2011-0340 BID: 47596 OSVDB: 72865 Background Indusoft Thin Client allows access to Indusoft Web Studio projects without requiring Web Studio to be installed. It includes the ISSymbol ActiveX control, which is also included in Indusoft Web Studio and Advantech Studio...

Window 8 will get its first critical patch this Friday

The Windows 8 and Windows RT security updates will be the first shipped since those operating systems' launch on Oct. 26. The latest vulnerabilities include three critical security vulnerabilities for Windows 8, and one critical security vulnerability for the Surface-based Windows RT operating...

First Windows 8 and Windows RT Security Updates Due Next Week

Plenty is happening on the Microsoft patch management front. First, Adobe agreed to sync up its patch release cycles with Microsoft’s on the second Tuesday of every month, moving away from quarterly releases. And now on Tuesday, Microsoft will release its first security updates since the release ...

Update: Adobe Working to Confirm New Reader Zero-Day Sandbox-Bypass Exploit

Adobe said today it has been in contact with the Russian security company Group-IB, which discovered a zero-day vulnerability in Adobe Reader and yesterday reported the existance of a pricey exploit circulating on the black market. The exploit, according to Group-IB, bypasses Adobe’s sandbox...

Adobe Reader zero-day vulnerability with modified Blackhole Exploit-Kit

Group-IB, a Russian cybercrime investigation company has discovered a zero-day vulnerability, affects Adobe Reader X and Adobe Reader XI. The vulnerability is also included in new modified version of Blackhole Exploit-Kit, which is used for the distributing the banking Trojans Zeus, Spyeye,...