(Pwn2Own) Adobe Reader Portfolio Preview Privilege Escalation Vulnerability

This vulnerability allows attackers to elevate privileges on vulnerable installations of Adobe Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw occurs within the handling of Portfolio...

Debian DSA-3315-1 : chromium-browser - security update

Several vulnerabilities were discovered in the chromium web browser. - CVE-2015-1266 Intended access restrictions could be bypassed for certain URLs like chrome://gpu. - CVE-2015-1267 A way to bypass the Same Origin Policy was discovered. - CVE-2015-1268 Mariusz Mlynski also discovered a way to...

[SECURITY] [DSA 3315-1] chromium-browser security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3315-1 [email protected] https://www.debian.org/security/ Michael Gilbert July 23, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3315-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3315-1 [email protected] https://www.debian.org/security/ Michael Gilbert July 23, 2015 https://www.debian.org/security/faq -...

Bartalex Variants Spotted Dropping Pony, Dyre Malware

Some strains of Bartalex malware, a macro-based malware that first surfaced earlier this year, have recently been spotted dropping Pony loader malware and the Dyre banking Trojan. Primarily spread through spam, the first iterations of Bartalex were observed in late March embedded in Microsoft Wor...

XPCOM - Race Condition

XPCOM Race Condition Vendor: Mozilla Product: XPCOM Version: Website: http://www.mozilla.org/projects/xpcom/ CVE: CVE-2005-2414 OSVDB: 18226 PACKETSTORM: 38837 Description: xpcom, or cross platform component object model is a framework for writing cross-platform, modular software. The xpcom libra...

Microsoft Office Memory Corruption Vulnerability (CNVD-2015-04590)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Office. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service memory corruption with...

Microsoft Office Memory Corruption Vulnerability (CNVD-2015-04593)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Office. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service memory corruption with...

Microsoft Office Memory Corruption Vulnerability (CNVD-2015-04592)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Office. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service memory corruption with...

Microsoft Office Memory Corruption Vulnerability (CNVD-2015-04589)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Office. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service memory corruption with...

Microsoft Office Memory Corruption Vulnerability (CNVD-2015-04588)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Office. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service memory corruption with...

Microsoft Office Memory Corruption Vulnerability (CNVD-2015-04591)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Office. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service memory corruption with...

Enter: No rate limit which leads to "Users information Disclosure" including verfification documents etc.

HOST api.romit.io Endpoint /v0/cash/auth/login Issue When an attacker tries to login at app.romit.io, he is prompted to enter the PIN . There is no rate limit to verify this. Although there is a an authorization header Authorization: Credential=b67b0b10571ac00444de3cffde0b5b05,...

CVE-2015-2963

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting XSS attacks via a spoofed value, as demonstrated by image/jpeg...

Hacking Team Plans to Continue Operations

UPDATE–It has been absolutely brutal week for Hacking Team. All of the company’s documents, internal communications, emails with customers, and invoices have been published, including its dealings with oppressive regimes and customers in sanctioned countries. But even with all that, company...

OpenSSL Heartbleed 漏洞 (心脏出血)

OpenSSL“心脏出血”漏洞是一个非常严重的问题。这个漏洞使攻击者能够从内存中读取多达64 KB的数据。一些安全研究员表示：无需任何特权信息或身份验证，我们就可以从我们自己的（测试机上）偷来X.509证书的私钥、用户名与密码、聊天工具的消息、电子邮件以及重要的商业文档和通信等数据。这一切是如何发生的呢？让我们一起从代码中一探究竟吧。0x01 Bug请看ssl/dlboth.c，漏洞的补丁从这行语句开始：int dtls1processheartbeatSSL s unsigned char p = &s-s3-rrec.data0, pl; unsigned short hbtype;...

Possible Denial of Service attack in Active Support

Specially crafted XML documents can cause applications to raise a SystemStackError and potentially cause a denial of service attack. This only impacts applications using REXML or JDOM as their XML processor. Other XML processors that Rails supports are not impacted. All users running an affected...

Threat Outbreak Alert RuleID15905: Email Messages Distributing Malicious Software on June 12, 2015

Medium Alert ID: 39328 First Published: 2015 June 12 14:11 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15905 may contain the following files: Name | Siz...

WordPress Group Documents Plugin <= 1.2.1 - Stored Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability, because “Display name” and “Description” fields are not escaped. Solution Update the plugin...

WordPress Group Documents Plugin <= 1.2.1 - Remote Path Traversal

This plugin is prone to a bp-group-documents-settings.php file parameter remote path traversal file location manipulation vulnerability. Solution Upgrade the plugin...