Nymaim Dropper Updates Delivery, Obfuscation Methods

A new variant of the Nymaim dropper has been identified that includes updated delivery and obfuscation methods, and the use of PowerShell routines to download its payloads. The updated dropper, used primarily to download banking Trojans in the past, has also been spreading ransomware, according t...

MICROSYS PROMOTIC Memory Corruption Vulnerability

OVERVIEW Security researcher Praveen Darshanam of Versa Networks has identified a memory corruption vulnerability in the MICROSYS, spol. s r.o. PROMOTIC application. MICROSYS has produced a new version to mitigate this vulnerability. The researcher has tested the new version to validate that it...

CVE-2016-5518

Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to webfileservices...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to webfileservices...

CVE-2016-5518

Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to webfileservices...

CVE-2016-5518

Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to webfileservices...

CVE-2016-5518

CVE-2016-5518: Unspecified vulnerability in Oracle Agile Engineering Data Management (Oracle Supply Chain Products Suite) versions 6.1.3.0 and 6.2.0.0, specifically in the webfileservices subcomponent. Remote attackers could impact confidentiality, integrity, and availability. Documented impact i...

FLV To MP3 Converter 3.0.5 - Reverse Engineering ByPass Registartion Vulnerability

Most converters can convert MP4 video to MP3 only, but don't support YouTube FLV files. FLV To MP3 Converter is a windows program that fast converts FLV To MP3 audio format. FLV To MP3 Converter also supports MP4, MPG, WMV, MOV and more video formats to MP3 and other audio formats conversion. Cop...

MP3 Cutter 1.1.0 - Reverse Engineering ByPass Registration Vulnerability

MP3 Cutter is a Windows desktop utility allows you to cut and split a big MP3 or video to small audio pieces. With MP3 Cutter, you can split and cut not only MP3 format, but also WMA, WAV, AMR, WMV, AVI, MPG, 3GP, MP4, FLAC, OGG, WMV, MOV and more than 40 audio & video formats. Copy of the Vendor...

Mozilla Turning TLS 1.3 On By Default With Firefox 52

When Mozilla ships Firefox 52, on or around March 7, 2017, the browser will come with the cryptographic protocol TLS 1.3 on by default. Martin Thomson, a principle engineer at Mozilla broke the news Wednesday in an email to Mozilla Development Platform members. “TLS 1.3 removes old and unsafe...

IBM Jazz Foundation Information Disclosure Vulnerability (CNVD-2016-10072)

IBM Rational Collaborative Lifecycle Management CLM, etc. are products of IBM Corporation in the U.S. IBM Rational CLM, Rational Team Concert RTC and Rational Engineering Lifecycle Manager are collaborative lifecycle management solutions; Rational Quality Manager RQM is a collaborative, Web-based...

Unspecified Vulnerability in Oracle Supply Chain Products Suite Agile Engineering Data Management Component

Oracle Supply Chain Products Suite is a suite of supply chain solutions from Oracle that provides value chain planning, value chain execution, product lifecycle management, etc. Oracle Agile Engineering Data Management is one of the Data Management component. A remote security vulnerability exist...

DracOS - Lightweight and Powerful Penetration Testing OS

Dracos Linux www.dracos-linux.org is the Linux operating system from Indonesian , open source is built based on the Linux From Scratch under the protection of the GNU General Public License v3.0. This operating system is one variant of Linux distributions, which is used to perform security testin...

Novell NetIQ Sentinel CVE-2016-1000031 Remote Code Execution Vulnerability

Description Novell NetIQ Sentinel is prone to a security vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Novell NetIQ Sentinel version 7.4x are vulnerable. Technologies Affected Apache Commons FileUpload 1.0...

PHP NEWS 1.3.0 - Cross-Site Request Forgery (Add Admin)

========================================================================================================= Exploit Title: PHP NEWS 1.3.0 - Cross-Site Request Forgery Add Admin Author: Meryem AKDOĞAN Google Dork: - Date: 16/10/2016 Type: webapps Platform : PHP Vendor Homepage:...

Android Banking Trojan Tricks Victims into Submitting Selfie Holding their ID Card

While some payment card companies like Mastercard have switched to selfies as an alternative to passwords when verifying IDs for online payments, hackers have already started taking advantage of this new security verification methods. Researchers have discovered a new Android banking Trojan that...

Potential Hurricane Matthew Phishing Scams

US-CERT warns users to remain vigilant for malicious cyber activity seeking to capitalize on interest in Hurricane Matthew. Users are advised to exercise caution in handling any email with subject line, attachments, or hyperlinks related to Hurricane Matthew, even if it appears to originate from ...

Instruction Trace Visualisation Tool: rgat

An instruction trace visualisation tool intended to help reverse engineers make the link between target behaviour and code. rgat uses dynamic binary instrumentation courtesy of DynamoRIO to produce graphs from running executables. It creates static and animated visualisations in realtime to suppo...

Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin)

Simple PHP Blog 0.8.4 - Cross-Site Request Forgery Add Admin that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- input t...

MP3 Cutter 1.1.0 - Reverse Engineering Issue

Document Title: =============== MP3 Cutter 1.1.0 - Reverse Engineering Issue References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1937 Release Date: ============= 2016-10-05 Vulnerability Laboratory ID VL-ID: ==================================== 1937 Common...